Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Enterprise Resource Management

ERP Security, Controls and Governance for CS Professional

Updated 11 October 2026 · Fact-checked

ERP security and governance means protecting an ERP system's data and processes through access controls, segregation of duties, audit trails, data security and compliance checks, under clear board-level oversight. In an exam answer, name the risk, apply the matching control, link it to law, and state the company secretary's role.

Understand ERP Security, Controls and Governance

An ERP system keeps finance, purchase, sales, HR and inventory in one database. One system means one point of failure. If a user can see or change data they should not, the whole company's records are at risk.

So ERP security rests on three goals: confidentiality (only the right people see data), integrity (data is accurate and cannot be changed without trace) and availability (the system works when the business needs it).

Access controls deliver these goals. Each user gets a unique ID and a role. The role decides which screens and transactions the user can run. The rule is least privilege: give only the access needed for the job. Add strong passwords, multi-factor authentication and quick removal of access when someone leaves or changes role.

Segregation of duties (SoD) means no single person controls a whole transaction from start to finish. The person who creates a vendor should not approve payments to that vendor. The person who raises a purchase order should not receive the goods or release the payment. This lowers the chance of fraud and of undetected error.

Governance sits above these controls. The board and management set policy, assign ownership, approve change management, and review audit reports. ERP audit tests whether controls exist and work, using audit trails, logs, user access reviews and testing of configuration. The company secretary supports this by tracking compliance with the Companies Act, 2013, the IT Act, 2000 and data protection duties, by keeping records of policies and board approvals, and by reporting control gaps to the board.

Key rules to remember

Security goals (CIA): Confidentiality + Integrity + Availability; Use these three words to frame any ERP security answer.
Least privilege: User access = minimum rights needed for the assigned role; Review rights when roles change and remove them on exit.
Segregation of duties: Initiate ≠ Authorise ≠ Record ≠ Custody; Where staff are few and separation is not possible, use compensating controls such as supervisory review.
Control types: Preventive + Detective + Corrective; Classify each control you name. Example: access rights are preventive, log review is detective, restoring from backup is corrective.
Control layers: General controls + Application controls; General controls cover access, change, operations and backup. Application controls cover input, processing and output within a module.

How to solve ERP Security, Controls and Governance questions

Exam questions are case-based. Use the same structure each time so you cover the provision, the facts and the conclusion.

1Read the facts and identify the failure: weak access, SoD conflict, poor change control, data leak, audit gap or non-compliance.
2Name the risk in CIA terms: what is exposed, altered or unavailable.
3State the relevant control principle, such as least privilege, SoD, audit trail or backup.
4Apply it to the facts. Say who had what access and why that was a problem.
5Recommend specific controls: role redesign, approval workflow, MFA, log review, periodic access review, change approval.
6Link to law and governance: the Companies Act, 2013 on records and internal controls, the IT Act, 2000 and data protection duties, only where you are sure of the provision.
7State the company secretary's role: policy, board reporting, compliance monitoring, record keeping.
8Close with a one-line conclusion answering the question asked.

Quickest way: Risk-Control-Role in three lines

When to use it: Use it when time is short or the question asks for a short note.

Line 1: name the risk and the CIA goal affected.
Line 2: give two or three matching controls, labelled preventive, detective or corrective.
Line 3: state the company secretary's or board's role in oversight and compliance.
If marks allow, add a one-sentence example from the facts.

Common mistakes in ERP Security, Controls and Governance

Treating ERP security as only a technical IT matter.
Students focus on passwords and firewalls and forget governance.
Fix: Always add policy, board oversight, audit and the company secretary's compliance role.
Confusing segregation of duties with least privilege.
Both limit access, so they sound alike.
Fix: Least privilege limits what one user can do. SoD splits one process across different people. Define each in one line.
Giving a list of controls without linking to the facts.
Students memorise lists and skip analysis.
Fix: Point to the exact conflict in the case, then name the control that fixes it.
Ignoring compensating controls.
Textbooks stress ideal separation, but small firms lack staff.
Fix: Where separation is impractical, suggest supervisory review, exception reports and log monitoring.
Quoting section numbers or rules from memory without certainty.
Students want to look precise.
Fix: Name the Act and the principle in plain words. Give a section only when you are sure.
Forgetting removal of access for leavers and transferred staff.
Students think only about granting access.
Fix: Cover the full user lifecycle: grant, review, change and revoke.

Worked examples

Example 1

At Kaveri Textiles Ltd, the accounts executive creates new vendors in the ERP, raises purchase orders to them and also releases their payments. A payment of ₹4,75,000 was later found to be made to a fictitious vendor. Identify the control failure and advise the company.

Show the solution

Failure: there is no segregation of duties. One user holds vendor creation, ordering and payment rights.
Risk: integrity and confidentiality of financial data are compromised, and fraud was possible and went undetected.
Principle breached: SoD (initiate, authorise and record by different people) and least privilege.
Recommendation: split roles so that vendor master creation, purchase order approval, goods receipt and payment release sit with different users.
Add an approval workflow with value limits, and a periodic review of vendor master changes by someone independent.
Add a detective control: exception reports on new vendors paid soon after creation, and log review.
Company secretary's role: report the lapse to the audit committee or board, ensure the access policy is updated and recorded, and check that internal control disclosures remain accurate.

Answer: The company failed to segregate incompatible duties. It should redesign ERP roles, add approval workflows, review vendor master changes independently, monitor logs, and report the matter to the board through the company secretary.

Example 2

Explain the role of a company secretary in ensuring security and governance when a listed company implements a new ERP system.

Show the solution

Before go-live: help the board approve an IT and information security policy, with clear ownership and reporting lines.
Check that the ERP design supports statutory requirements such as maintaining books and registers, and that data protection duties are considered.
During implementation: ensure vendor contracts include confidentiality, data security, audit rights and exit terms, and that approvals are minuted.
Support role design: review that access rights follow least privilege and that SoD matrices are approved by process owners.
After go-live: monitor compliance through periodic access reviews, audit reports and incident logs, and report gaps to the board or audit committee.
Keep records: policies, approvals, audit reports and corrective actions are documented and available for regulators and auditors.

Answer: The company secretary acts as a governance and compliance link. The role covers policy approval, contract and legal review, role-design checks, ongoing compliance monitoring, board reporting and record keeping.

Exam tips

Structure every answer as risk, control, law and governance, then conclusion. It matches the case-based format.
Label each control as preventive, detective or corrective. It shows depth quickly.
Always mention the company secretary's role when the question names the profession or the board.
Use the facts given. Name the user, the access and the amount involved rather than writing generic notes.
In short notes, define the term first, then give three or four points and one example.

Practice questions from Enterprise Resource Management

ERP Security, Controls and Governance: frequently asked questions

What is segregation of duties in an ERP system?

It means splitting a business process among different users so no one person can initiate, approve, record and hold assets for the same transaction. In an ERP it is enforced through role design and workflow approvals. It reduces fraud and undetected error.

What is the difference between general controls and application controls?

General controls cover the whole IT environment: access, change management, operations and backup. Application controls work inside a specific module and cover input, processing and output. Both are needed for reliable ERP data.

What is the role of a company secretary in ERP implementation?

The company secretary supports policy approval, reviews contracts for security and compliance terms, checks that statutory records can be maintained in the system, and reports control and compliance gaps to the board. The role is governance and compliance rather than technical configuration.

How does ERP audit work?

An auditor reviews access rights, SoD conflicts, change records, audit trails and backups, and tests whether controls operate as designed. Findings go to management and the board or audit committee with recommendations for correction.