The permission structure in an ERP is the most critical setting for both internal control and data security. In most implementations it's set broadly on day one to make life easy and never touched again.
01. The Authorisation Matrix
Which role can do what on which screen should be written in a table. Without it, permissions granted over time turn into a structure nobody can explain.
02. Segregation of Duties
The person raising a purchase order and the one approving it, the person entering an invoice and the one making the payment, should not be the same. Most fraud cases stem from that separation not being built.
03. Critical Transactions
Changing prices, granting discounts, adjusting stock, deleting accounts and opening or closing periods are critical permissions. These should go to a narrow group and every use should be logged.
04. The Audit Trail
Who changed which record, when and how must be answerable from the system. Trail logging must not be a switchable setting, and ordinary users must not be able to delete it.
05. No Shared Accounts
Shared single-user accounts make the audit trail useless. Person-level login should apply even on warehouse terminals.
06. Periodic Review
Review all users and permissions once a year. Accounts of departed staff, temporary permissions that became permanent, and conflicting roles surface in that review.