Building Controls into an ERP or HCM Go-Live (Not After It)

Large system implementations are judged on whether they go live on time and on budget. Far fewer are judged — until the next audit — on whether the new system is controlled. Yet a new ERP or HCM platform redefines who can do what, which data is trusted and how changes are made. Getting controls right during the project costs a fraction of fixing them afterwards.

1. Security roles designed with segregation of duties

Design roles around tasks, test them against an SoD ruleset before go-live, and document approved exceptions with compensating controls. Retro-fitting roles after thousands of users are live is painful.

2. Data migration with measurable reconciliation

Define, before the first mock load, what “correct” means: record counts, key-field checks, control totals (headcount, salaries, balances) and acceptable tolerance. Run multiple mock cycles, reconcile each against source systems with data owners, and keep the sign-offs. Migrated data becomes the system of record — and the basis of payroll and financial reporting.

3. Testing with entry and exit criteria

SIT, UAT and parallel runs need written entry and exit criteria, defect severity definitions and a clear go/no-go decision owned by the business. For payroll, parallel runs comparing old and new results line by line are the best assurance available.

4. Configuration and change control

Once configuration is baselined, every change should be requested, approved, tested and migrated by different people, with a log. This becomes your program-change ITGC after go-live.

5. Interface and integration controls

Every integration — to payroll, finance, time and attendance or benefits providers — needs completeness and accuracy checks: record counts, control totals, error queues and someone responsible for monitoring them daily.

6. Privacy by design

HR and finance systems process sensitive personal data. Apply GDPR principles: data minimisation, role-based access to sensitive fields, retention rules, and a data protection impact assessment where required.

7. Audit-ready evidence

Keep test results, approvals, reconciliations and cutover sign-offs in an organised repository. Auditors will ask for them — often a year later, after the project team has moved on.

The cutover and hypercare window

Plan cutover as a detailed runbook with owners, timings and rollback criteria. Run a command centre during go-live, and define hypercare exit criteria before handing over to support. Many control failures start in the first weeks after go-live, when workarounds are introduced under pressure.

Combining project delivery with a risk and compliance background is exactly what our IT project management practice offers. For project teams, the Leading Enterprise System Implementations course turns these lessons into a practical playbook.