Enterprise resource planning (ERP) modernization is often pursued for practical reasons: better reporting, more efficient workflows, improved user experience, and stronger connectivity across finance, HR, procurement, and operations. For public sector entities, those benefits can be meaningful. But the same features that make modern ERP valuable also change the organization’s risk profile.
Cloud delivery, expanded integrations, centralized data, automated workflows, third-party support, and more frequent system change can move cyber and control risk into places the organization may not have governed before. As processes, access, data flows, configurations, and vendor responsibilities change, the control environment changes with them.
That means ERP modernization works better when it addresses both the transformation and the system being implemented. Organizations should define security requirements and stage gates during the project, while also preparing the operating model needed after go-live: clear ownership, updated risk and control matrices, system security plans, access governance, monitoring expectations, and targeted security assessments, including application, API, configuration, and penetration testing where exposure warrants it.
This article dives into the insights from and results of our four polling questions from our webinar, “Securing Modern ERP: Cyber Risk in ERP Transformation.” We found that attendees are most concerned with access controls, ownership, and sustaining governance after go-live.
What Does ERP Modernization Really Mean?
At its core, ERP modernization connects financial, human resources, procurement, and operational data. The modern ERP can provide greater visibility, reduce manual handoffs, and support more integrated workflows. Employees may gain self-service capabilities, while leaders receive more real-time information to guide decisions.
Those benefits also change where cyber and control risk reside. More users, including AI agents, may have access to the system, data may flow through more integrations and application programming interfaces, and system changes may occur more frequently. An increasing portion of the control environment may depend on system configuration, automated workflows, and third parties.
Polling during the webinar illustrates where participants see those risks.
The results suggest a useful reminder: A modern system does not eliminate control risk. It changes the form that risk takes. Security ought to be incorporated into design decisions rather than treated as a final checkpoint before go-live. Those design decisions should carry forward into the ERP operating model, including how access is governed, changes are approved, integrations are monitored, exceptions are reviewed, and evidence is retained.
That theme became even more specific when participants were asked which access or change-control issue would create the greatest concern in their organization.
Organizations can help address these concerns by designing roles around business responsibilities, applying least-privilege principles, evaluating segregation of duties, and establishing periodic access reviews. Temporary permissions created during implementation should be reviewed before go-live, and change approvals should leave evidence that can be monitored and tested after the system is in production.
Building Security & Controls Into the Modernization Path
A practical modernization path can do more than move the organization to a new platform. It should define how the future ERP environment will be secured, governed, monitored, and evidenced before the system becomes operational.
- Start with strategy, not software. Before choosing or configuring a platform, define what success looks like across operations, reporting, user experience, security, and control readiness. Strategic objectives should guide technology decisions, but those objectives should also clarify which risks need to be governed from the start.
- Engage your people early. The employees who use the system daily know where the current processes break, where workarounds exist, and where controls may be difficult to sustain. Bring process owners, IT, cybersecurity, finance, compliance, and internal audit into the design early so responsibilities are understood before go-live.
- Sequence the transition. A phased approach can help organizations build confidence and reduce disruption, but each phase should include defined security and control expectations. Access, integrations, data migration, change approvals, and evidence retention should be addressed as part of each milestone, not added after the system is live.
- Clean, structure, and prepare records. Data quality is more than a migration task. In a modern ERP environment, centralized data supports reporting, workflow, automation, and access decisions. Preparing data well can help reduce downstream risk tied to privacy, reporting accuracy, and control execution.
- Measure and adjust as you go. Modernization does not end at go-live. Track results against your original goals, but also monitor whether controls are operating as intended, exceptions are reviewed, issues are escalated, and ownership remains clear after the project team steps back.
When our webinar participants were asked about their greatest challenge in sustaining ERP controls after go-live, we saw the following:
Before go-live, organizations should identify who owns each significant risk and control, what evidence must be retained, who reviews exceptions, and how issues will be escalated. Technology can support this model, but it cannot replace clear accountability.
“The organizations that manage ERP risk most effectively don’t treat security as a final checkpoint. They design it into the transformation and sustain it in the operating model after go-live.”
The Path Forward: Securing the ERP Environment After Go-Live
Once a modern ERP system is live, the risk does not stop moving. Access changes, vendor updates continue, integrations evolve, new reports and workflows are added, and exceptions still need to be reviewed. The path forward is not simply to complete the implementation, but to sustain a secure ERP environment through clear ownership, current security documentation, updated risk and control matrices, ongoing monitoring, and targeted testing when the environment changes.
That ongoing focus was reflected in the final webinar polling question, which asked participants which investment would create the most value during the next 12 months.
Responses show demand for practical security and control infrastructure: risk and control matrices with named owners and evidence, security requirements built into change management, system security plans for the ERP environment, and independent assessment. Together, these elements can help organizations move from point-in-time review to a more sustainable model for securing the ERP environment.
How Forvis Mazars Can Help
ERP modernization can create significant opportunities for process improvement and organizational efficiency, but those opportunities depend on a secure and sustainable control environment. Organizations that assign ownership, create governance processes, update risk and control documentation, and build security requirements into implementation decisions are better positioned to manage risk and sustain controls long after go-live.
The experienced practitioners at Forvis Mazars work with public sector entities to support modernization efforts through risk assessment, control design, security planning, governance, security assessment, stakeholder engagement, and practical guidance tailored to each organization’s goals and circumstances. We remain focused on understanding your priorities and supporting efforts aligned with the communities you serve. Download our Public Sector Priorities report for additional insights on embracing change and preparing for what’s next, or reach out to a professional at Forvis Mazars today.