Why ERP Authorization Controls Have Become a Boardroom Priority

Access management inside enterprise resource planning systems used to be a task buried deep in IT departments. That era is over. Regulatory frameworks like SOx and GDPR now hold organizations directly accountable for who can access, modify, or approve financial data within their ERP environment.

The shift is especially visible in companies running Microsoft Dynamics 365 Business Central. As more businesses migrate from legacy NAV versions to cloud-based deployments, the question of who holds which permissions has grown far more complex. Default permission sets in Business Central are notoriously broad, which means a fresh implementation can easily leave sensitive financial processes exposed to unauthorized changes.

Dutch software firm 2-Controlware, based in Breda, has spent over 17 years building authorization tools specifically for the Dynamics ecosystem. That narrow platform focus allows for deeper integration with Business Central’s permission model than most generic identity and access management tools can offer. The company’s product suite covers everything from conflict detection and function separation rules to field-level access controls.

The Compliance Pressure Behind Tighter Access Controls

SOx compliance requires publicly traded companies to demonstrate that financial reporting processes are free from unauthorized interference. For organizations using Business Central as their financial backbone, that means proving exactly which users can post journal entries, approve purchase orders, or modify vendor bank details. Auditors want evidence, not assumptions.

GDPR adds another layer for companies handling European personal data. Information stored within ERP modules must be accessible only to authorized personnel, and organizations need to document who accessed what and when. The combination of these two frameworks alone creates a substantial administrative burden, particularly when authorization structures were never designed with regulatory scrutiny in mind.

Where Most Organizations Get Authorization Wrong

A common mistake is copying permission sets from one user to another without reviewing what those permissions actually include. Over time, this creates a web of overlapping access rights that no single administrator fully understands. The problem compounds when employees change roles but retain their old permissions alongside the new ones.

Another frequent issue involves the absence of segregation of duties. In a well-controlled environment, the person who creates a vendor record should not be the same person who approves payments to that vendor. Business Central does not enforce this separation out of the box, which is why tools such as 2-Controlware’s Authorization Box exist to flag conflicting permission combinations before they become audit findings.

Organizations that delay addressing these gaps often discover them only during an external audit. At that point, remediation is both urgent and expensive. A single material weakness finding can trigger months of additional testing and significantly increase audit fees.

Segregation of Duties Is More Than a Checkbox Exercise

Segregation of duties, often abbreviated as SoD, sits at the heart of internal control frameworks. It prevents a single individual from controlling all stages of a critical process. In practice, implementing SoD within an ERP system requires mapping every business process to specific permission sets and then verifying that no user holds conflicting combinations.

Standard role-based access in Business Central may prevent a user from opening a certain page, but it might not restrict them from editing a specific field on a page they do have access to. This is where field-level security becomes relevant. 2-Controlware addresses this with a Field Security module that controls access at the field, filter, and action level, offering administrators finer granularity than Business Central provides natively.

Getting SoD right also requires input from finance and operations teams, not just IT. Process owners understand which task combinations carry real risk, while administrators hold the technical knowledge to translate those risks into permission rules. Without that collaboration, SoD matrices tend to be either too loose to be effective or so strict that users cannot do their jobs.

Why Continuous Monitoring Has Replaced Periodic Reviews

Setting up proper authorization structures is only half the work. Permissions drift over time as new users are onboarded, roles shift, and system updates change underlying objects. Without continuous monitoring, even a well-designed authorization model can deteriorate within months.

Continuous monitoring tools track changes to user permissions in real time and alert administrators when a new conflict arises. This approach replaces the traditional model of periodic manual reviews, which in many organizations happen quarterly or even less frequently. For companies subject to SOx or similar regulations, the ability to demonstrate ongoing oversight rather than point-in-time snapshots strengthens the overall control narrative presented to auditors.

IT managers and compliance officers working with Business Central in 2026 face a landscape where authorization management cannot be treated as a one-time implementation project. It requires dedicated tooling, clear ownership, and review cycles that keep pace with organizational change. Companies still relying on spreadsheet-based permission audits are likely discovering just how much has quietly drifted since their last thorough review.