Designing ERP Access Governance Before Go Live With Pathlock
Show notes
What happens when the pressure to complete an ERP transformation leaves access governance waiting until after go-live?
In this episode of Tech Talks Daily, I speak with Chris Radkowski, GRC Expert and Advisor at Pathlock, about the business consequences of access decisions.
Chris previously spent 17 years at SAP and brings experience across access control, governance and security. We discuss why ERP risk belongs in transformation planning, with examples that connect system availability to manufacturing, incoming deliveries and the processes that keep a business operating.
The conversation considers privileged access inside business applications. An identity does not need to administer a server to hold permissions that affect sensitive information, supplier records or financial transactions.
Chris explains why the combinations of entitlements assigned to a person deserve attention, and how that assessment becomes more complicated as processes extend across several systems. AI agents and automated workflows add to the challenge when they can carry out transactions quickly or operate through credentials associated with a user.
We also discuss the limits of scheduled access reviews. Chris describes the work involved in checking whether an inappropriate permission was used, including the manual effort that can arise when teams need to investigate historical transactions. He argues for combining access information with activity and transaction data, so teams can examine an unexpected pattern and initiate a review rather than waiting for the next certification cycle.
For leaders planning an ERP or AI transformation, Chris recommends considering role design, access assignment, certification and emergency access early in the program. We discuss how changes between SAP ECC and S/4HANA can affect the permissions and transactions on which existing controls depend.
Our conversation offers practical questions about who can act, what they actually do and how the organization responds when operations are under pressure.
Which access decisions would you want resolved before your next go-live, and where are the gaps today? Please share your thoughts with me.