Digital Transformation projects can make or break an organization.
Digital transformation initiatives are among the most consequential programs management will ever lead. Done well, they modernize operations and unlock value. Done poorly, they introduce security gaps, compliance failures, and long-term operational risk that often surface after go-live—when remediation is most expensive.
In last month’s article, we explored the significant headwinds management faces during ERP implementations, from vendor selection to resourcing and governance. This month’s topic builds directly on those themes, prompted by a real-world example currently unfolding with a client.
The organization in question is beginning a digital transformation journey, migrating from Oracle E-Business Suite (EBS) to Oracle Fusion Cloud ERP. They selected a system integrator (SI) and engaged a separate firm to address security and internal controls.
This scenario highlights a familiar pattern in the ERP ecosystem: the “land and expand” strategy.
System integrators are rarely incentivized to fully disclose the true scope required for a secure, compliant, and sustainable implementation during the bid process. Doing so would often make them the most expensive bidder—and losing on price is the fastest way to lose a deal.
As a result, selection teams—particularly those under cost pressure—frequently choose the lowest bidder. What is overlooked is the distinction between lowest initial cost and lowest total cost of ownership. The most critical analysis management must perform is not price alone, but a clear understanding of what is and is not included in scope.
The details left out of scope are where risk accumulates.
This leads directly to this month’s focus which is near and dear to our hearts: security and controls, and specifically the need for fully customized roles in modern ERP systems.
In Oracle Fusion Cloud, role design is not a cosmetic decision—it is foundational to:
Any system integrator with meaningful Oracle experience understands that fully customized roles are necessary. However, this reality is often softened—or omitted entirely—during the bidding phase because role customization adds time, cost, and complexity.
For a deeper explanation, we recommend reviewing this article: Why Fully Customized Roles Are Critical in ERP Implementations
In the case referenced here, the organization first asked their system integrator to address role design. They then engaged a second firm to take on the work. Today, they are dissatisfied with the outcome and are now seeking a third provider.
This is not uncommon.
Role design complexity varies significantly by ERP platform. Some security models are relatively straightforward. Others—Oracle Fusion Cloud included—are exceptionally complex. Treating role design as a commodity service often leads to rework, audit findings, and operational disruption.
At ERP Risk Advisors, we are deliberate about where we engage. We do not claim a universal center of excellence across every ERP platform. We are transparent about where we have deep expertise—and where we do not. We do not pursue a land-and-expand strategy. Our objective is long-term client success, not incremental scope recovery.
This is not an accusation that software vendors or system integrators are inherently dishonest. However, management should enter the discovery process with a clear-eyed understanding of incentives. Meaning they may omit some things you need to know… And not knowing what scope is necessary to have a complete and secure implementation could make the difference between keeping your job and you getting fired for negligence or incompetence.
I will add that I can only speak with excellence in the space related to security and controls. Although I have nearly 10 years experience as a system integrator, that experience is dated a bit.
However, as Solomon said in Ecclesiastes 1:9, “What has been will be again, what has been done will be done again; there is nothing new under the sun.” Ecclesiastes 1:9
For a deeper, fuller perspective, here is a summary of the most common challenges facing management that I presented in our article:
In case you missed January’s article which covers these core challenges throughout ERP Implementation, I encourage you to check it out here.
ERP Risk Advisors is one of less than 10 firms in the world that has a mature Center of Excellence related to role design and segregation of duties. While our expertise is platform-specific, it continues to grow with each engagement.
If you are planning, implementing, or already live on an ERP platform—and want to strengthen your security, compliance, and internal controls—we invite you to contact us at support@erpra.net. We offer a complimentary one-hour consultation to discuss your challenges and potential paths forward.
Digital transformation does not fail because of technology. It fails when risk is underestimated, scope is misunderstood, and controls are treated as an afterthought.