Loading

ERP Roles

An ERP role says what part of the ERP a security group's members may use: Finance, Purchasing, Projects and so on. Roles are how back-office staff who are not architects get into the ERP, and granting one also gives the group the Admin Panel menu entries for the screens that role uses.

Where to find it

Architect Panel → ERP - Setup:

  • ERP Setup — the ERP roles tab: security groups against roles and document permissions

Admin Panel → ERP - Setup:

  • ERP Setup — the same tab for holders of ERP: Administration

Two grants, both required

A role says what someone may do. Company access says where: read, write or post, company by company. Neither implies the other, so a Finance role with no company access opens nothing, and company access with no role opens no ERP screen. Members also need Admin Panel access through their security group. Architects hold every role and can use every company.

The twelve roles

On a standard installation each role opens these Admin Panel entries. Every role also opens the Approvals Inbox under Processes.

  • ERP: Finance: ledger, journals, periods, VAT, bank and reconciliation, statements. Opens Ledger & Finance, Bank Feeds & Reconciliation, ERP Analytics, Purchasing and Invoice Match Queue.
  • ERP: Receivables: customers, sales invoices, credit notes, receipts and credit control. Opens Receivables.
  • ERP: Payables: supplier invoices, payments and the match queue. Opens Purchasing and Invoice Match Queue.
  • ERP: Purchasing: requisitions, orders, goods receipts and PunchOut. Opens Purchasing.
  • ERP: Sales: quotes, orders, deliveries and pricing. Opens Sales and Pricing.
  • ERP: Inventory: items, stock, counts, inspections and structures. Opens Items, Stock, Structures, Production and Purchasing (for goods receipts).
  • ERP: Projects: projects, budgets, billing and approving time. Opens Projects & Time and My Time & Expenses.
  • ERP: Time & Expenses: logging your own time and expenses. Opens My Time & Expenses.
  • ERP: Fixed Assets: the asset register, maintenance and depreciation. Opens Fixed Assets.
  • ERP: Approvals: the shared pool of approval requests that name nobody. Opens Purchasing.
  • ERP: Reporting: read-only statements and analytics. Opens ERP Analytics and, read-only, Ledger & Finance, Projects & Time, Items, Stock, Structures, Production, Fixed Assets and Pricing.
  • ERP: Administration: ERP configuration. Opens every entry in the ERP - Setup section: ERP Setup, Record Numbering, Approval Matrices, ERP Documents, EDI and PunchOut.

The matrix also has columns for document permissions such as Approve purchase requisitions, Issue purchase orders and Approve supplier invoices. These allow a document move; they add no menu entries.

Granting a role

  1. Open ERP Setup and choose ERP roles.
  2. Find the security group's row and tick the role's column. The change is saved at once, and the message says how many menu entries were added for the group.
  3. Open What each role opens under the matrix to see the menu entries each role gives on your installation.
  4. Make sure the group also has company access on the Company access tab.

Removing a role takes away the menu entries that no other role of the group still needs. A menu entry is only ever added for a screen that admits the role, so nobody is offered a door that refuses them.

Add missing menu entries

Beside the button the tab says how many groups are missing menu entries. Add missing menu entries gives every group the entries its current roles open, and gives every admin group the Approvals Inbox. It never removes anything. Press it after creating a new security group, after installing a new ERP screen, or for groups that held roles before roles added menu entries.

What goes wrong

  • "Your account does not have the ERP role this needs": the screen names the role. Add the person's group to it here, and check its company access.
  • "You cannot change the roles of a security group you belong to": ask another ERP administrator. This stops an administrator promoting or locking out themselves.
  • The group is not listed: in an organisation's own tenant only its own security groups are listed. Platform groups such as All Users are managed from the platform.

Worked example

A finance team of three needs the ledger and the bank, and its manager also approves purchase invoices. The ERP administrator ticks Finance for the Finance group and Finance, Payables and Approve supplier invoices for the Finance Managers group. Both groups get Post access to the company. The next time the clerks open the Admin Panel, a Finance section shows Ledger & Finance and Bank Feeds & Reconciliation.

Recommendations

  • Grant roles to groups named for a job, such as Finance or Buyers, never to individuals.
  • Use Reporting for read-only users such as directors and auditors rather than giving them Finance.
  • Press Add missing menu entries whenever the tab reports a gap.
  • Review the matrix quarterly alongside your other security group reviews.