When an ERP goes live, someone asks "who should be able to do what?" and the usual answer is "give everyone access, we trust each other". That works until a price is changed after an invoice goes out, a supplier's bank details are edited the day before a payment, or a customer disputes a delivery nobody can trace. Access control and audit trails are not about distrust. They protect honest people from suspicion and the business from errors. Here is how to design them without making daily work miserable.
Four principles
- Least privilege. Each person gets the access needed for their job and no more.
- Segregation of duties. The person who creates a payment is not the one who approves it; the person who receives goods is not the one who pays the supplier.
- Approval limits. Higher values need higher authority, with a deputy named for absence.
- Traceability. Every important change records who, when, what and, where useful, why.
Roles in a typical UAE company
| Role | Typically can | Typically cannot |
|---|---|---|
| Owner or director | View everything, approve high-value items, see margins | Edit posted entries (use reversal) |
| General manager | Approve orders, discounts and purchases up to a limit; see branch reports | Change system settings or user rights |
| Salesperson | Create quotations and orders, see own customers | See cost prices or other people's customers; change posted invoices |
| Storekeeper | Receive, issue and transfer stock; run counts | See prices or approve payments |
| Accountant | Post invoices, bills and payments; reconcile banks; run VAT reports | Create users or change approval limits |
| Purchasing officer | Raise purchase orders and compare quotes | Approve their own orders or pay suppliers |
| HR officer | Maintain employee files, leave and payroll inputs | See customer or supplier finances |
| System administrator | Manage users, roles and backups | Post accounting entries, ideally |
Adapt this to your company. A five-person business may combine roles, but even then keep one control: the person who approves payments should not be the person who prepares them.
Controls worth switching on
- Posted documents are locked. Corrections happen through credit notes and reversals, not edits. See quotation, proforma and tax invoice.
- Period locks: closed months cannot be changed without a specific permission.
- Master-data changes are tracked, especially supplier bank details, customer credit limits, prices and tax settings.
- Branch and company access: users see only the branches and legal entities they work in. See software for free zone companies.
- Sensitive screens: payroll, cost and margin reports restricted to named people.
- Strong sign-in: unique accounts for every person, strong passwords and multi-factor authentication for finance and admin roles.
What the audit trail should record
- The user, date and time, and the screen or action.
- The old and new values for changes to important fields.
- Approvals and rejections, with the approver's name.
- Logins, failed logins and changes to permissions.
- Exports of large or sensitive data.
The log must itself be protected: ordinary users cannot edit or delete it, and it is backed up with the rest of the system. Decide how long you keep it, in line with your record-keeping obligations and privacy policy. See UAE data protection for software buyers.
Approval workflows without the bottleneck
- Route approvals to a phone notification so managers can act quickly.
- Show the approver everything they need on one screen: value, supplier or customer, budget and previous orders.
- Name a deputy and set automatic escalation after a number of hours.
- Review approval times monthly. A control that delays every order by two days will be bypassed.
Test your design
Before go-live, log in as each role and try to do what they should not: edit a posted invoice, view a payroll report, approve your own purchase. Make this part of user acceptance testing. See the UAT checklist.
Review regularly
People change roles and leave. Every quarter, list active users, remove accounts for leavers, check that permissions still match jobs and sample the audit log for unusual activity. We build role and audit controls into our ERP and CRM systems, and configure them to your structure; see user adoption and training for how to roll them out smoothly.