Chris Radkowski, a Pathlock adviser and former SAP global solution owner for GRC products, says ERP risk is often missing from boardroom discussions because transformations become a mad dash to go live.
Radkowski says toxic access once concerned only the ERP system but now extends to Ariba, SAP BTP and Salesforce as regulation evolves, and AI agents are hard to tell apart from users after the fact.
Radkowski says twice-yearly access reviews, often done manually with spreadsheets, leave long windows where wrong entitlements persist, so organizations should design segregation of duties, emergency access and role controls before go-live.
Why ERP access controls must be designed before go-live
ERP transformations treat access governance as something to sort out after go-live, and that is when it is hardest and most costly to fix. Role design, segregation of duties and emergency access need to be built in early. AI agents acting through business systems at machine speed make twice-yearly manual reviews inadequate, so continuous monitoring of activity against normal patterns becomes necessary.
Takeaways
Access governance is neglected until go-live pressure peaks. Risk is often missing from boardroom talk on ERP programs because transformations become a dash to go live. Yet failure is costly. One consumer goods company said that when SAP stops, trucks back up outside the factory and production halts.
Design controls before go-live, not after. Radkowski advises building segregation of duties controls, emergency access processes, role design and periodic certification in early. Developers should not hold powerful roles in a live system. Retrofitting under pressure is harder, especially when spending is heavy and nobody wants delay.
Toxic entitlement combinations are the core role design risk. Role design should prevent combinations of entitlements that let users steal, change financial information or move money to friends or family. This exposure now reaches beyond the ERP into Ariba, SAP BTP, Salesforce and other systems as regulation evolves.
AI agents blur the line between users and automation. Agents call application APIs and can process transactions faster than any human. Given credentials, an agent acts like a user and is hard to tell apart afterward. Organizations need controls over who can grant credentials, plus transaction monitoring.
Twice-yearly access reviews leave long windows of exposure. Reviews typically happen twice a year, so incorrect entitlements persist for months, and many are run manually in spreadsheets. When a review finds an anomalous transaction, the look-back to see whether it executed is a massive manual task.
Continuous monitoring replaces point-in-time checks. The approach builds a signature of normal transactional activity, sets guardrails such as spending limits and transaction volumes, and combines provisioning data with activity logs from more than 150 integrated applications. Data is king, and AI can then analyse it.
Weak controls carry large financial and brand costs. A material weakness reported in a 10-Q can damage a company's brand and stock price, with impacts that can reach billions of dollars. ITGCs and SOX controls, including segregation of duties and emergency access, are the safeguards.
Moving from ECC to S/4HANA
Tap a name to go there · tap a line to see why they are linked
On this episode 2
Show 1
The structure of entitlements and Fiori tiles differs from ECC, so roles cannot simply be copied across.
Some transactions that existing controls rely on may no longer exist and need to be redesigned.
Privileged accounts in business systems differ from IT administrator accounts, and both need management.
Data such as Coca-Cola's formula or NVIDIA's chip designs must be tightly restricted.