Apples to Apples: Managing Cross-Application Risk Under the Covers

Executive Summary

Modern enterprise application landscapes have shifted dramatically from monolithic, single-ERP environments to complex, hybrid multi-cloud ecosystems where critical processes run across disparate Line of Business (LOB) applications. Managing access risk within these decentralized environments renders traditional, ERP-centric Governance, Risk, and Compliance (GRC) tools obsolete, leading to unmonitored cross-system vulnerabilities and severe audit friction. To overcome these operational blind spots, organizations must modernize access governance by adopting automated, fine-grained cross-application monitoring and business-owned controls.

These findings were derived from the webinar: Managing Enterprise Access Risk in a Multi-Application World, featuring subject matter expert Susan Stapleton, Vice President of Customer Advisory at Pathlock. The session provided an executive analysis on transitioning from legacy, siloed GRC practices to automated continuous controls monitoring (CCM), unified user access reviews (UAR), fine-grained cross-system Segregation of Duties (SoD) risk analysis, and business privileged access management (Business PAM) across modern multi-cloud architectures.

For senior executive leadership and the board, failing to address cross-application access risk creates significant exposure to material weaknesses, financial loss, regulatory non-compliance, and operational disruption. Unmonitored superuser access and manual mitigation controls consume exorbitant business resources while leaving cross-system SoD conflicts undetected. Board oversight must mandate unified access governance, continuous transaction monitoring, and clear business accountability to safeguard enterprise resilience.

Critical Takeaways:

• Breakdown of the ERP Monolith: Critical financial and operational processes (such as procurement, HR, and supply chain) have migrated to specialized cloud applications, rendering traditional single-system GRC models ineffective at managing true enterprise risk.
• Imperative of Fine-Grained Cross-System Rule Sets: Standard out-of-the-box risk frameworks fail to catch cross-application SoD violations; organizations must map fine-grained authorizations across disparate systems (e.g., Ariba, SAP, Workday) to eliminate false positives and catch actual conflict transactions.
• Centralization and Contextualization of Access Reviews: Fragmented, manual user access reviews generate extreme reviewer fatigue and rubber-stamping; unifying access data into a single, contextual interface empowers business owners to execute accurate, auditable access certifications efficiently.
• Automation of Privileged Access and Continuous Controls: Relying on manual spreadsheets and periodic sample testing for privileged access and mitigation creates immense resource strain; automated continuous controls monitoring (CCM) and business-focused Privileged Access Management (Business PAM) provide complete closed-loop audit assurance.

1. The Shift to Multi-Cloud Architectures and the Fall of ERP-Centric GRC

Historically, core business operations were executed within a single, on-premises ERP system, allowing security teams to manage access risk within a unified authorization framework. Today, enterprise applications are distributed across multiple cloud platforms—such as Workday for HR, Salesforce for sales, and Ariba or Coupa for procurement. This fragmentation creates organizational and technical silos, where application-specific managers govern access independently without visibility into how permissions interact across the broader IT ecosystem. Consequently, traditional ERP-centric GRC solutions fail to deliver comprehensive risk visibility, forcing internal audit and compliance teams to rely on resource-intensive manual workarounds.

When organizations undergo digital transformations, GRC frameworks must evolve in parallel. Operating in application-specific silos exposes companies to unmonitored cross-system risk and unexpected audit findings. Security and compliance leadership must unify control monitoring, user access reviews, and provisioned access under an enterprise-wide GRC architecture that encompasses both the core ERP and all financially relevant line-of-business applications.

"Using one application to manage access, process, and IT general controls is a must, and being able to automate all of the control processes with CCM, plus things like emergency access, user reviews, SoD reports, and compliant provisioning." — Susan Stapleton, Vice President, Customer Advisory, Pathlock

To evaluate where organizations currently stand in their cloud transition, participants were polled on their ERP transformation status:
"I've talked to a few customers where they just needed to get the transformation completed and live, right? It's a huge, very costly process, and they're like, 'We'll take care of our audit issues after the fact.'" — Susan Stapleton, Vice President, Customer Advisory, Pathlock


2. Fine-Grained Authorization Mapping for Cross-System Segregation of Duties

Segregation of Duties (SoD) risk mapping becomes exponentially complex when business processes span multiple systems. For example, in a modernized procure-to-pay (P2P) process, a purchase order may be created in Ariba, goods received in a Manhattan Warehouse Management System, and vendor payments executed out of SAP S/4HANA. Standard, single-system rule sets fail to detect conflicts spanning these platforms. Over half of an organization's P2P SoD risks may become invisible if risk analysis remains restricted to the core ERP.

To achieve accurate cross-system SoD enforcement without generating floodgates of false positives, GRC platforms must evaluate authorizations at a fine-grained level across normalized user identities. Risk rule sets cannot remain generic or static; organizations must tailor risk severity rankings and permission models to reflect their specific business processes, configurations, and industry risk profiles.

"If I say a user can create a purchase order in Ariba and receive the goods into Manhattan and pay the vendor out of SAP, I need to be able to be looking at all of those users' authorizations at a very fine-grained level." — Susan Stapleton, Vice President, Customer Advisory, Pathlock

Understanding which applications fall under regulatory scrutiny is crucial for defining an appropriate multi-system risk management strategy:
"And you can't keep operating in an organizational silo that says, 'My team handles the ERP, Oracle ERP, SAP ERP, and whatever else happens outside of that's not really in my purview.' That just cannot be the case going forward." — Susan Stapleton, Vice President, Customer Advisory, Pathlock


3. Eliminating Review Fatigue through Unified Access Governance

User Access Reviews (UAR) represent a foundational compliance requirement under SOX, NIST, ISO, and GDPR frameworks, designed to ensure that system access aligns strictly with current job responsibilities. However, traditional UAR processes are notoriously inefficient, relying on disconnected spreadsheets, disparate identity systems, and technical role descriptions that hold little meaning for business managers. Confronted with thousands of line items and tight deadlines, managers frequently resort to rubber-stamping approvals, neutralizing the control's security value.

"User access reviews. This is a control that's often seen as a compliance checkbox activity. But it is really foundational control for both security and governance... It's becoming so difficult that again, it's that check-the-box activity." — Susan Stapleton, Vice President, Customer Advisory, Pathlock

Modern access governance requires shifting from application-specific certifications to a centralized, unified review framework. By presenting reviewers with a single interface enriched with business context—such as plain-English role descriptions, actual transaction usage history, last login timestamps, and peer group analyses—organizations eliminate review fatigue. This approach converts access recertification from a compliance check-the-box exercise into a meaningful risk reduction mechanism.

"Instead of reviewing access separately for each system, maybe you have SAP or Oracle, you have Workday, you have Salesforce. We really have to present this data to our business reviewer in a single, centralized interface for them to get meaningful information." — Susan Stapleton, Vice President, Customer Advisory, Pathlock


4. Business-Focused Privileged Access Management (Business PAM) and Emergency Access

Privileged access in cloud systems—such as the Customer Administrator role in Ariba or Proxy IDs in SuccessFactors—grants unbridled administrative capabilities across critical business functions. Unmonitored emergency access constitutes a primary driver of financial material weaknesses during external audits. Furthermore, native cloud audit logs are often consolidated into massive, unformatted data streams that make distinguishing administrative actions from routine day-to-day operations nearly impossible.

Organizations must implement automated "break-the-glass" emergency access management tailored specifically for line-of-business applications. Privileged Access Management must be owned directly by business application leaders who understand the operational necessity of elevated access. Automated Business PAM workflows restrict administrative rights, capture precise before-and-after transaction value logs upon session termination, and highlight high-risk field changes to ensure full audit transparency.

"Auditors expect you to be able to know what they did do and what users did not do, even sometimes more importantly in those cloud applications." — Susan Stapleton, Vice President, Customer Advisory, Pathlock

The extent to which enterprises have formalized emergency access governance in cloud environments reveals substantial reliance on manual workflows:
"And in the case where everything that happens in that cloud solution gets pushed into one log, it's hard to figure out what's being done by an emergency access versus just day-to-day activity." — Susan Stapleton, Vice President, Customer Advisory, Pathlock


5. Automated Continuous Controls Monitoring (CCM) and Risk Quantification

Manual SoD mitigation processes place an unsustainable administrative burden on business teams. Traditional approaches require compliance coordinators to manually run usage reports, verify transaction histories across tabbed spreadsheets, locate compensatory manual controls, and upload evidence period after period. This resource-intensive exercise frequently fails to prevent actual fraud or policy breaches, as manual sampling occurs long after transactions have taken place.

"The process to develop, validate, and then manually test controls period over period, it is resource intensive, it is very costly. And it's really another reason business users don't want to own compliance tasks." — Susan Stapleton, Vice President, Customer Advisory, Pathlock

Continuous Controls Monitoring (CCM) transforms risk mitigation by constantly analyzing transaction data, master data updates, and configuration shifts across all integrated enterprise applications. Rather than testing static permissions or small sample sizes, automated CCM identifies true policy exceptions—such as a single user creating a vendor and processing an invoice to that same vendor—and immediately alerts control owners. By evaluating exact exposure dollars associated with unmitigated risks, leadership can quantify financial exposure and maintain a closed-loop audit trail.

"Automating these access governance capabilities is absolutely going to reduce the cost of compliance. There is no way we can hire enough people to do these things if we have to start doing them across many applications." — Susan Stapleton, Vice President, Customer Advisory, Pathlock


Strategic Roadmap

• Establish Fine-Grained, Cross-System Risk Rule Sets: Conduct a comprehensive inventory of all financial and operational business processes that span core ERP and LOB cloud applications (e.g., procurement, supply chain, HR). Tailor baseline SoD rule sets to reflect multi-application process flows down to fine-grained permission levels, aligning risk severity classifications directly with internal risk management frameworks before initiating remediation.
• Empower Business Owners via Unified Access Certification: Shift ownership of access reviews and privileged access approvals from IT and security teams to line-of-business process owners. Implement a centralized access governance interface that presents reviewers with intuitive context—including plain-English role descriptions, user activity logs, peer analysis, and last login dates—to streamline certifications and eliminate review fatigue.
• Automate Control Monitoring and Business PAM: Eliminate manual spreadsheet testing by deploying Continuous Controls Monitoring (CCM) to continuously evaluate actual transaction execution and master data modifications. Implement automated "break-the-glass" Business PAM for LOB cloud applications that automatically captures before-and-after log changes, quantifies financial risk exposure, and preserves centralized, closed-loop audit evidence.

For a deeper dive into the subjects covered above, visit the on-demand webinar: Managing Enterprise Access Risk in a Multi-Application World.