What is the role of ERP security profiles and how should they be managed?

• A. Define roles and permissions; perform access reviews; enforce segregation of duties, ensure least privilege and audit of changes.
• B. Assign global read access to all users.
• C. Security profiles are optional and can be ignored.
• D. Roles should be assigned randomly.

Answer: (A)

ERP security profiles map job roles to specific permissions across modules and data, deciding who can do what in the system. They should be managed with least privilege in mind, giving each user only the access needed to perform their duties. Regular access reviews verify that permissions still match current roles, and segregation of duties rules prevent conflicting actions from being assigned to the same person, such as both initiating and approving a payment. An audit trail of permission changes provides accountability and supports compliance. This approach is essential because granting broad or random access, or treating security as optional, would weaken control and undermine security.