ERP ERP Security, Access Control & Role-Based Permissions 3

Question 1

What is the primary purpose of an ERP system audit trail?

Accepted Answer

To provide a chronological record of user actions for accountability and investigation

Answer

To improve system performance by identifying and logging slow database queries

Answer

To automatically correct data entry errors made by users in real time

Answer

To generate financial statements for external auditors on demand

Question 2

Which US regulation most directly impacts access control and audit trail requirements in ERP systems used by publicly traded companies?

Accepted Answer

SOX (Sarbanes-Oxley Act)

Answer

HIPAA (Health Insurance Portability and Accountability Act)

Answer

GDPR (General Data Protection Regulation)

Answer

PCI-DSS (Payment Card Industry Data Security Standard)

Question 3

In ERP security governance, what does the acronym 'GRC' stand for?

Accepted Answer

Governance, Risk, and Compliance

Answer

Global Resource Coordination

Answer

General Role Configuration

Answer

Group Resource Control

Question 4

What is a 'User Access Review' (UAR) in ERP governance?

Accepted Answer

A periodic process where managers certify that their employees' access rights remain appropriate

Answer

A usability test where users evaluate the ERP interface and workflow design

Answer

An automated system that removes inactive user accounts from the directory

Answer

A security scan that identifies vulnerabilities in user password strength and history

Question 5

What is a 'compensating control' in the context of an ERP SoD conflict?

Accepted Answer

An alternative control that mitigates risk when an SoD conflict cannot be immediately eliminated

Answer

Additional pay given to employees who hold security-sensitive dual roles

Answer

A software patch that automatically resolves detected role conflicts in the system

Answer

A backup system that activates when the primary access control mechanism fails

Question 6

What is the recommended course of action when an ERP security audit identifies an SoD conflict for a specific user?

Accepted Answer

Document the conflict, assess the risk, assign a compensating control, and then remediate

Answer

Immediately lock the user account permanently until the conflict is fully resolved

Answer

Delete the conflicting roles from the entire system without further analysis

Answer

Notify external auditors first and wait for their specific guidance before acting

Question 7

Which capability is most critical in an ERP GRC solution for proactively managing Segregation of Duties risks?

Accepted Answer

Real-time SoD conflict detection with preventive role assignment controls

Answer

Automated payroll and employee benefits processing integration

Answer

Multi-currency financial consolidation and consolidated reporting

Answer

Employee performance goal tracking and appraisal dashboards