In this video we will talk about how to properly security Audit Policy configurations. The ability to maintain Audit Policies can be found in three seeded roles as of...
Why ERP Implementations Fail: UNBIASED (6 of 6)
“The definition of insanity is doing the same things over and over again but expecting different results”, attributed to Albert Einstein. I am writing this six-part article series about Why Implementations Fail – to help you avoid a failed or a ‘less than optimal’ implementation. In part 1, 2, 3, 4, and 5 we have covered the following topics:
- Software is often released before it is mature
- System integrators rarely propose a complete ERP implementation
- System integrators do not understand the complex compliance and cyber security requirements for today’s modern systems
- Compliance and cyber security requirements are often misunderstood by software engineers
- SaaS application software providers tend to be greedy with system storage because it affects their margins
If you missed any of the first five articles, I encourage you to read them before starting this article as they lay the foundation for key concepts we will discuss next.
The Six Biases in ERP Implementations
To achieve a successful ERP implementation, you must overcome these six common biases:
- Software is often released before it is mature
- System integrators rarely propose a complete ERP implementation
- System integrators often do not understand the complex compliance and cyber security requirements for today’s modern systems
- Compliance and cyber security requirements are often misunderstood by software engineers
- SaaS application software providers tend to be greedy with system storage because it affects their margins
- Auditors are often not trained in the specifics of the ERP system they are auditing.
We have come to the sixth and final article in this series focusing on the lack of training for auditors on the specific design and risks of each ERP system.
Having an audit of a your ERP system pre-go-live by an independent party is essential for management to gain an understanding if their system has been implemented correctly and is ready to ‘go live’. We highly recommend that the “go-live-ready” audit, be done by a risk advisory firm that is NOT the same firm as the System Integrator. Our argument on why, in this article titled “Don’t Let the Fox Watch the Hen House: Why your Risk Advisory Firm Should NOT be your SI Firm”
There is an assumption by many within management that auditors will ‘identify’ any ‘showstoppers’ that could lead to a SOX compliance deficiency or a cybersecurity risk. Not all applications are alike. As we have identified in other articles in this series there may be differences such as:
- Software functionality and design
- Configuration of the software by the SI such as workflow design
- Role design
- Completeness of logging
- How workflow processes can be bypassed
- Ways to secure integration accounts
- How Users / Identities are configured and secured via MFA
- How often patches / releases are applied and how complete the documentation is on new features and changes to existing features (read me files and other documentation)
ERP Risk Advisors has ERP specific training for auditors (see our course catalog in the Learning section on our website). We are not aware of any other ERP specific training provided in the public domain.
We know that most audit firms fail to identify critical nuances in ERP systems such as the SQL injection risk at the application tier for Oracle E-Business Suite as we have written about here. As of the writing of this article (November 2025) we know of only one of the big 4 firms that are auditing this risk and we would estimate that over 90% of the organizations running Oracle E-Business Suite have not identified and addressed this risk.
As we have been emphasizing in each of these “Why Implementations Fail” articles – buyer beware – you cannot count on the software providers or their preferred implementation partners to be honest with you about these gaps during the courting and contract phase. You may also not be able to fully rely on the work of the auditors you hire to do an independent assessment if they aren’t experts in the risks and necessary controls for the specific ERP system you are implementing.
Schedule a Consultation
If you want to avoid the pitfalls that derail ERP implementations, we’re here to help.
📩 Contact us at sales@erpra.net to schedule a consultation with one of our ERP risk experts.
