Why ERP Authorisation Has Become a Boardroom Priority
For years, managing user permissions inside enterprise resource planning systems sat firmly on the IT department's to-do list. Finance directors rarely asked about it. Board members almost never did. That has changed, and the shift is driven by something more tangible than abstract security concerns.
Regulatory frameworks such as SOx, the GDPR, and sector-specific compliance mandates now place direct accountability on senior management for how data access is governed. When an auditor discovers that a single user can both create a vendor and approve a payment, a classic segregation-of-duties conflict, it is no longer treated as a minor configuration issue. It can trigger material findings in an audit report.
Organisations running Microsoft Dynamics 365 Business Central are particularly affected because the platform's native permission system is flexible but notoriously granular. Without dedicated tooling, maintaining clean authorisation structures across dozens of roles and hundreds of users becomes unsustainable. Breda-based firm 2-Controlware has spent over seventeen years building the solutions that address this gap, but the underlying problem is organisational, not purely technical.
Compliance pressure that reaches the finance department
Audit firms across Europe have tightened their expectations around logical access controls in recent years. Where a conversation about ERP permissions might once have ended with a spreadsheet export, auditors now expect continuous monitoring and documented evidence of role design. The bar has moved.
For companies subject to SOx requirements, often subsidiaries of US-listed parent organisations, the stakes are especially high. A segregation-of-duties violation that goes undetected can escalate from an IT observation to a control deficiency reported to the group auditor. Financial controllers who have lived through such an escalation tend to remember it vividly.
The GDPR adds another dimension entirely. Under the regulation, access to personal data must be limited to those who genuinely need it for their role. In an ERP system that holds employee records, customer details, and supplier contacts, overly broad permissions can constitute a data protection risk. The Dutch supervisory authority Autoriteit Persoonsgegevens has repeatedly stated that technical measures, including access restrictions, form part of the accountability obligation.
Where permission structures tend to break down
Most organisations do not start with poor authorisation designs. The problems accumulate over time. A new employee joins, receives a copy of a colleague's permission set, and inherits access rights that were never intended for the role. Multiply that pattern across three years and fifty new hires, and the permission landscape becomes opaque.
Another common pattern involves temporary escalations. A user needs access to a specific function for a month-end close or a migration project. The permissions are granted quickly and never revoked. In Business Central, where permission sets can be assigned at multiple levels, these residual rights are difficult to spot without automated conflict detection.
Auditors call this "excessive access." It is not malicious, not even intentional, but structurally risky. Solutions for conflict detection and continuous monitoring exist precisely to surface these issues before an external audit does. Yet many organisations only invest in such tooling after their first painful finding, rather than before it.
Structuring authorisation as a continuous process
The most effective approach treats authorisation management not as a one-time cleanup but as an ongoing discipline. That means defining organisational roles before touching the ERP system, mapping those roles to specific permission sets, and establishing rules for segregation of duties that reflect actual business risk.
Continuous monitoring is the element most organisations still lack. A quarterly review of user access might satisfy a lenient auditor, but it leaves a wide window for conflicts to emerge undetected. Automated monitoring, where the system flags a new conflict the moment it is introduced, closes that gap substantially. Products like 2-Controlware's Authorization Box are built around this principle of real-time visibility.
Field-level security adds further precision. Standard permissions in Business Central operate at the object level: a user can or cannot access a table or a page. Compliance sometimes demands finer control. Restricting which fields a user can see or edit, or enforcing validation rules on data entry, brings authorisation closer to the actual business process rather than the underlying technical architecture.
A shift in ownership, not just in tooling
Perhaps the most significant change is not technological at all. It is the question of who owns authorisation policy within a company. In organisations where IT still bears sole responsibility, authorisation tends to be reactive. Permissions are granted on request, revoked on complaint, and reviewed only under audit pressure.
Where finance and compliance teams share that ownership, the dynamic shifts noticeably. Role definitions are based on risk assessments. Changes follow a documented approval workflow. The ERP system's permission structure becomes a reflection of business governance, not just a technical configuration. For Dynamics 365 Business Central environments handling sensitive financial or personal data, that distinction matters more than most boardrooms in 2026 currently realise.
