Governance, Cybersecurity, Ethics and Regulatory Compliance

Introduction

Digital materials management is no longer limited to purchasing, inventory control and warehouse administration. Enterprise resource planning (ERP) systems connect suppliers, buyers, finance departments, warehouses, production units, logistics providers and customers through shared data and integrated workflows. This integration creates efficiency, but it also creates concentration of risk. A single inaccurate master-data record, compromised user account, manipulated purchase order or unavailable ERP service can disrupt operations across the enterprise.

Governance provides the structures through which digital materials activities are directed, controlled and monitored. Cybersecurity protects systems, data and operations from unauthorised access, alteration, disclosure and disruption. Ethics guides decisions where legal compliance alone is insufficient. Regulatory compliance ensures that the organisation meets applicable requirements concerning privacy, financial reporting, procurement, trade, health and safety, environmental performance and records.

For materials managers, these subjects are operational rather than merely legal or technical. A materials manager may approve a supplier, maintain item classifications, release stock, authorise an emergency purchase or rely on an algorithmic recommendation. Each action can affect cost, service, safety, sustainability and organisational reputation.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain governance principles for ERP-enabled materials management.
2. Design access controls and segregation-of-duties arrangements.
3. Evaluate cybersecurity threats to procurement, inventory and supply-chain data.
4. Construct reliable audit trails and control-monitoring procedures.
5. Apply privacy, data-ethics and algorithmic-accountability principles.
6. Analyse procurement integrity risks and relevant compliance obligations.
7. Design integrated environmental and regulatory reporting controls.
8. Recommend a risk-based governance architecture and assess its limitations.

1. Governance as an Operating System for Control

Governance is the allocation of authority, accountability and oversight. It answers five questions:

• Who may perform an activity?
• What evidence must support the activity?
• Which person or role is accountable for the result?
• How is performance and compliance monitored?
• What happens when a control fails?

A useful distinction is between governance, management and assurance. Governance establishes direction and boundaries; management executes processes within those boundaries; assurance independently evaluates whether controls work. In an ERP environment, these layers should be connected but not concentrated in one individual or department.

A governance framework normally includes a board or executive sponsor, a risk or audit committee, process owners, information-security leadership, data owners, internal audit and operational users. The framework should specify decision rights for master data, supplier onboarding, purchasing thresholds, emergency transactions, system changes and regulatory reporting.

The three lines model

The first line consists of operational managers who own risks and operate controls. The second line includes risk, compliance, privacy and information-security functions that provide guidance and monitoring. The third line is internal audit, which offers independent assurance. External auditors, regulators and certification bodies provide additional external scrutiny but do not replace management responsibility.

Governance should be proportionate to risk. A low-value stationery purchase does not require the same approval chain as a hazardous chemical, a strategic contract or a supplier handling personal data. However, proportionality must not become an excuse for undocumented exceptions.

2. Internal Control in ERP-Enabled Materials Management

Internal control is a coordinated system of policies, procedures, people and technology designed to provide reasonable—not absolute—assurance regarding operations, reporting and compliance. The principal control objectives in materials management are:

Controls may be preventive, detective or corrective. A system rule preventing a buyer from approving their own purchase is preventive. A report identifying unusual price changes is detective. Reversing an unauthorised goods issue and investigating its cause is corrective.

Risk assessment

Risk assessment begins by identifying assets, threats, vulnerabilities, consequences and existing controls. A simple prioritisation model is:

Likelihood and impact must be defined on stated ordinal scales, such as 1 to 5. The resulting score is a prioritisation aid, not a probability and not a monetary loss estimate. It should not be treated as mathematically precise unless the scales have been empirically calibrated. A more financially oriented model is:

Probability is expressed between 0 and 1, and loss is measured in a consistent monetary unit. The model assumes that the estimated probability and consequence are sufficiently reliable and that the event definition is clear. Correlated events, indirect effects and uncertainty may make a single expected value misleading.

3. Identity, Access and Segregation of Duties

Identity and access management establishes who a user is and what that user may do. Strong governance applies least privilege: a user receives only the access necessary for assigned duties, for only as long as necessary. Access should be based on verified identity, job role, location, legal restrictions and business need.

Important controls include:

• unique user IDs rather than shared accounts;
• multi-factor authentication for privileged, remote and high-risk access;
• role-based access with documented role owners;
• joiner, mover and leaver procedures;
• periodic access recertification;
• privileged-access management and session logging;
• time-limited emergency access;
• automatic inactivity time-outs where appropriate; and
• prompt removal of access after termination or transfer.

Segregation of duties

Segregation of duties (SoD) prevents one person from controlling incompatible stages of a transaction. In procurement, the following combination is high risk: creating a supplier, creating a purchase order, approving the order, recording receipt and approving payment. Operational realities may make complete separation difficult in small organisations, so compensating controls—such as independent review, spend analytics and bank-account verification—are required.

A practical SoD matrix identifies incompatible activities and maps them to roles. Conflicts should be classified as prohibited, permitted with approval, or permitted with monitoring. SoD analysis must include both formal permissions and actual combinations of access. A user may have individually reasonable permissions that become dangerous when combined.

4. Audit Trails, Records and Evidence

An audit trail is a chronological, attributable record of events, decisions and changes. A useful ERP audit trail records the user or service identity, date and time, originating system, transaction type, old and new values, approval evidence, reason for change and relevant document links. Time must be synchronised sufficiently for event reconstruction.

Audit trails should be protected against unauthorised alteration. Access to logs should be separated from the ability to modify operational records. Retention periods should reflect legal requirements, contractual obligations, tax and financial reporting rules, investigation needs and the organisation’s records policy. Retaining everything indefinitely can create privacy and discovery risks; deleting too early can destroy evidence.

Auditability is not the same as surveillance. Monitoring should have a defined purpose, proportional scope, transparent governance and access restrictions. Alerts should be investigated according to documented criteria rather than used for arbitrary employee monitoring.

5. Cybersecurity of Materials and ERP Processes

The confidentiality–integrity–availability model is a foundation for cybersecurity. Confidentiality limits access to sensitive information. Integrity protects records from unauthorised or erroneous alteration. Availability ensures that authorised users can access systems and data when required.

Principal threat scenarios

Materials environments face phishing and credential theft, ransomware, malware, insider misuse, supplier compromise, exposed application programming interfaces, insecure mobile devices, unpatched servers, fraudulent supplier-bank changes and manipulation of inventory or pricing data. Operational technology in warehouses and automated storage systems may introduce additional risks, particularly where legacy devices cannot be easily patched.

Cybersecurity controls should include:

1. Asset and data inventory: identify ERP instances, interfaces, devices, data owners and critical dependencies.
2. Secure configuration and patching: remove default credentials, minimise services and apply tested security updates.
3. Network and application protection: segment critical systems, restrict interfaces and validate input.
4. Resilience: perform tested backups, maintain recovery priorities and exercise business-continuity plans.
5. Human controls: provide role-specific training, phishing resistance and clear incident-reporting channels.
6. Detection and response: monitor privileged activity, unusual transactions and failed authentication; maintain an incident-response plan.
7. Third-party security: assess supplier controls, contractual duties, breach notification and access termination.

Cybersecurity risk is also a supply-chain risk. A supplier may access portals, exchange electronic documents or connect through an integration. Contracts should define security requirements, audit rights, data ownership, subprocessor controls, incident notification and exit assistance. Paper compliance certificates should not be accepted as the sole evidence of effective security.

Incident response

An incident process commonly includes preparation, detection and analysis, containment, eradication, recovery and post-incident learning. Materials managers should know how to isolate suspicious transactions, preserve evidence, continue essential receiving and issuing activities safely, and communicate with information-security and legal teams. Paying attention only to system restoration may leave the underlying fraud or access weakness unresolved.

6. Privacy and Data Ethics

ERP systems may contain employee identifiers, contact details, signatures, location data, supplier-bank information and records of individual performance. Privacy governance requires a defined purpose, lawful processing basis where applicable, data minimisation, accuracy, security, retention control and respect for individual rights. Requirements differ by jurisdiction, so organisations must obtain legal advice on applicable privacy regimes rather than assuming that one global rule applies everywhere.

Privacy by design incorporates protection into process and system design. For example, a supplier portal may display only the bank details needed for verification, while sensitive identity documents are stored in a restricted repository. Test environments should use masked or synthetic data. Data exports should be logged, encrypted and limited to a justified purpose.

Data ethics goes beyond legal compliance. Ethical questions include whether a supplier-risk model unfairly excludes small enterprises, whether employee productivity data is collected without meaningful transparency, and whether sustainability claims are supported by evidence. Ethical governance requires proportionality, explainability, contestability and attention to affected stakeholders.

7. Algorithmic Accountability and Artificial Intelligence

AI may support demand forecasting, supplier-risk scoring, invoice anomaly detection, inventory optimisation and contract analysis. Its use creates risks of biased training data, spurious correlations, automation bias, model drift, confidentiality leakage and unexplained decisions.

A responsible model lifecycle includes:

• documenting the purpose and decision boundary;
• identifying data sources, quality limitations and legal restrictions;
• testing accuracy and error rates across relevant groups or supplier categories;
• assessing false positives and false negatives;
• maintaining model and data version control;
• requiring human review for consequential decisions;
• logging recommendations, overrides and outcomes;
• monitoring drift after deployment; and
• providing a route for challenge and correction.

A model should recommend rather than silently decide when its output can materially affect a supplier’s livelihood, access to contracts, employee discipline, safety or regulatory reporting. Human review must be substantive: the reviewer needs authority, time, information and competence to disagree with the system.

Algorithmic accountability is not achieved merely by explaining the mathematical model. An explanation should also identify the data used, the decision-maker, the applicable policy, uncertainty and the available appeal route.

8. Procurement Integrity and Conflicts of Interest

Procurement integrity requires fair competition, objective evaluation, transparent documentation and protection against improper influence. Risks include bribery, collusion, bid leakage, gifts, undisclosed relationships, fictitious suppliers, split purchases designed to avoid approval thresholds and conflicts involving former employees.

Core practices include:

• written specifications based on legitimate requirements;
• controlled communication with bidders;
• evaluation criteria disclosed in advance;
• independent evaluation panels for material purchases;
• conflict-of-interest declarations;
• due diligence and beneficial-ownership checks where appropriate;
• supplier-bank verification through an independent channel;
• documented exceptions and emergency purchases;
• rotation or review of high-risk duties; and
• protected whistleblowing channels.

A low price is not evidence of integrity. Total value should consider quality, lifecycle cost, delivery resilience, safety, human rights and environmental performance. Anti-bribery laws may apply to conduct outside the organisation’s home jurisdiction, and intermediaries cannot automatically shield the organisation from liability.

9. Environmental and Regulatory Reporting

Environmental reporting depends on reliable boundaries, definitions, evidence and calculation methods. Materials records may support reporting of energy, waste, packaging, hazardous substances, emissions, recycled content and supplier-related impacts. A report is credible only if its data lineage can be traced from source transaction to disclosed figure.

Organisations should establish:

1. a regulatory obligations register;
2. named owners for each obligation;
3. definitions and measurement boundaries;
4. source-system controls and validation checks;
5. evidence-retention requirements;
6. review and approval procedures; and
7. change monitoring for new or amended rules.

For emissions or resource metrics, unit consistency is essential. If activity data is multiplied by an emission factor, the units must cancel correctly. For example:

If activity is 2,000 kg of material and the factor is 1.4 kg CO₂e per kg, emissions are 2,800 kg CO₂e, assuming the factor is applicable to that material, process, geography and reporting boundary. The calculation does not prove completeness, and a factor may need review when supplier-specific or legally prescribed data is available.

Green claims require substantiation. A claim such as “recycled,” “carbon neutral” or “sustainable” should specify the basis, scope, evidence and limitations. Procurement teams should avoid transferring unverified supplier claims directly into corporate reports.

10. A Control Architecture for Digital Materials Management

An integrated architecture aligns policy, people, process, technology and evidence. The following sequence is useful:

1. Define critical processes: sourcing, supplier onboarding, ordering, receiving, inventory adjustment, payment and reporting.
2. Classify information and transactions: public, internal, confidential or restricted; routine or high consequence.
3. Identify risks and obligations: cyber, fraud, privacy, safety, environmental and regulatory.
4. Design controls: preventive, detective and corrective controls with named owners.
5. Configure ERP controls: workflow approvals, validation rules, role restrictions, logging and exception reports.
6. Test effectiveness: inspect evidence, sample transactions, simulate failure and conduct access reviews.
7. Monitor and improve: analyse control indicators, incidents, overrides and audit findings.

Useful indicators include the percentage of leavers removed within the required period, unresolved SoD conflicts, privileged-account use, supplier-bank changes independently verified, aged audit exceptions, failed recovery tests and the proportion of environmental data supported by primary evidence. Indicators should drive action rather than become targets that encourage gaming.

Illustrative Case: Northstar Components Ltd.

Background

Northstar Components Ltd. is a medium-sized manufacturer using an ERP system for procurement, inventory and accounts payable. The organisation operates in three countries and purchases metals, electronic components and maintenance services.

Problem

An internal audit discovered that one procurement manager could create suppliers, approve purchase orders and authorise changes to supplier bank details. The same manager had used a shared emergency account during a system outage. In addition, sustainability reports relied on spreadsheet information received from suppliers without documented evidence. A machine-learning tool also classified some small suppliers as “high risk” because they lacked historical transaction data.

Analysis

The case contains four connected risks. First, excessive access created a fraud opportunity. Second, the shared account weakened attribution and auditability. Third, sustainability reporting lacked data lineage. Fourth, the algorithm penalised new suppliers for absence of data—a potential fairness and competition problem.

A risk assessment rated the access conflict as high because likelihood and impact were both substantial. The sustainability issue was material because inaccurate disclosures could create regulatory and reputational consequences. The algorithmic issue was strategically important because it could reduce supplier diversity while appearing objective.

Approach and solution

Northstar introduced separate roles for supplier creation, purchase approval and bank-detail maintenance. Bank changes required independent callback verification using a previously validated contact. Emergency access became time-limited, individually assigned and subject to next-day review. Shared accounts were eliminated.

The company created a supplier-data dictionary, defined evidence requirements for environmental claims and linked reportable metrics to controlled ERP and document repositories. Supplier attestations were accepted only with risk-based verification.

The risk model was redesigned to distinguish “unknown” from “high risk.” It displayed confidence, used additional non-discriminatory evidence and required human review before exclusion from a tender. Model decisions and overrides were logged.

Outcome

The controls reduced unauthorised access exposure and improved the traceability of supplier and environmental records. The model produced more balanced results, although Northstar retained manual review because data remained incomplete. The organisation also recognised that control design is iterative: new interfaces, acquisitions and regulations require repeated assessment.

Learning points

1. ERP integration increases both efficiency and systemic exposure.
2. A control is ineffective if emergency practices routinely bypass it.
3. Auditability requires attributable actions and reliable data lineage.
4. “No data” should not automatically mean “high risk.”
5. Privacy, cybersecurity, procurement and sustainability controls should be designed together.

Challenges and Limitations

Governance can become bureaucratic when every transaction receives excessive approval. Excessive controls encourage workarounds and weaken respect for policy. Conversely, poorly designed automation can create a false sense of security. Role-based access may not capture unusual combinations of duties, and audit logs are useless if no one reviews them.

Risk scoring is dependent on assumptions and may conceal uncertainty. Compliance checklists can encourage minimum-conformance behaviour rather than ethical conduct. External certifications provide useful assurance but do not guarantee that controls operate continuously or fit the organisation’s particular risks. AI systems can improve detection while reproducing bias or generating confident errors.

Effective governance therefore requires professional judgement, independent challenge, continuous learning and a culture in which employees can report concerns without retaliation.

Best-Practice Implementation Roadmap

A postgraduate materials manager can implement the following staged programme:

Stage 1: Establish accountability. Appoint process, data, system, privacy and control owners. Approve a governance charter.

Stage 2: Map risk and obligations. Document processes, interfaces, critical suppliers, personal data, regulatory duties and environmental claims.

Stage 3: Stabilise basic controls. Remove shared accounts, review privileged access, reconcile master data and enforce approval thresholds.

Stage 4: Strengthen resilience. Test backups, incident response, supplier continuity and manual fallback procedures.

Stage 5: Improve intelligence responsibly. Introduce analytics or AI with documented purpose, validation, human oversight and appeal mechanisms.

Stage 6: Assure and improve. Conduct independent testing, report control performance to executives and close findings through accountable action plans.

Chapter Summary

Governance, cybersecurity, ethics and compliance are integrated dimensions of digital materials management. Governance defines authority, accountability and oversight; internal controls protect authorisation, accuracy, completeness, validity and accountability. Identity management, least privilege and segregation of duties reduce the risk that one person can create and conceal an improper transaction. Audit trails provide evidence, but they must be attributable, protected and reviewed.

Cybersecurity requires protection of confidentiality, integrity and availability across ERP systems, interfaces, devices and suppliers. Privacy and data ethics require purposeful, proportionate and secure use of information. AI and analytics must be explainable, monitored and subject to meaningful human accountability. Procurement integrity depends on fair processes, conflict management, due diligence and transparent exceptions. Environmental and regulatory reporting requires clear boundaries, consistent units, evidence and data lineage.

The central managerial lesson is that controls must be risk-based, usable and continuously tested. Compliance is not a static checklist; it is an organisational capability supported by responsible technology, professional judgement and a culture of integrity.

Key Terms

Algorithmic accountability: Responsibility for the purpose, operation, effects and reviewability of an algorithmic system.

Audit trail: Chronological, attributable evidence of transactions, decisions and changes.

Availability: The property that authorised users can access systems and data when required.

Confidentiality: Protection of information from unauthorised disclosure.

Data lineage: Traceable movement and transformation of data from source to report or decision.

Data minimisation: Collecting and processing only data necessary for a defined purpose.

Environmental claim: A statement about environmental performance, impact or attributes that requires substantiation.

Expected loss: Probability of an event multiplied by the loss if the event occurs.

Identity and access management: Policies and technologies governing identification, authentication and authorisation.

Integrity: Protection of data and processes from unauthorised or improper alteration.

Least privilege: Granting only the minimum access necessary for an authorised task.

Materiality: The significance of information or an error to decisions made by users of that information.

Multi-factor authentication: Authentication using two or more independent factors.

Procurement integrity: Fairness, transparency, objectivity and resistance to improper influence in purchasing.

Segregation of duties: Separation of incompatible responsibilities among people or roles.

SoD conflict: A combination of permissions that allows incompatible activities to be performed by one user.

Three-way match: Comparison of purchase order, goods receipt and supplier invoice.

Third-party risk: Risk arising from suppliers, service providers or other external parties.

Review Questions

Short Answer Questions

1. What is the difference between governance and management in an ERP environment?
2. Explain the principle of least privilege.
3. What information should an ERP audit trail normally record?
4. Define segregation of duties and give one procurement example.
5. Why must environmental claims have data lineage and supporting evidence?

Long Answer Questions

1. Discuss how confidentiality, integrity and availability apply to digital materials management.
2. Explain how an organisation should design access governance for supplier onboarding and purchase approval.
3. Analyse the relationship between privacy, data ethics and employee or supplier monitoring.
4. Describe a responsible lifecycle for using AI in supplier-risk assessment.
5. Evaluate the strengths and limitations of compliance checklists, certifications and internal audit.

Analytical / Application Questions

1. A buyer can create suppliers, approve purchase orders and change bank details, while a shared emergency account is used during outages. Design a control-remediation plan and identify compensating controls for unavoidable exceptions.
2. An organisation reports 2,000 kg of material consumption using an emission factor of 1.4 kg CO₂e per kg. Calculate the reported emissions and explain at least three reasons why the result may still be unreliable.
3. An AI tool labels new small suppliers as high risk because they have little historical data. Assess the ethical and procurement-integrity issues and propose a revised decision process.

Multiple Choice Questions with Answers

Question 1

Which control most directly prevents one employee from creating a supplier and approving payment to that supplier?

A. Data encryption

B. Segregation of duties

C. Network segmentation

D. Backup retention

Correct Answer: B. Segregation of duties

Question 2

In the confidentiality–integrity–availability model, integrity primarily concerns:

A. Preventing unauthorised alteration of data

B. Ensuring systems are accessible to every employee

C. Reducing the cost of storage

D. Publishing all supplier information

Correct Answer: A. Preventing unauthorised alteration of data

Question 3

Which is the strongest example of least privilege?

A. Giving all buyers administrator access

B. Using one shared account for convenience

C. Granting a receiver access only to authorised receipt functions

D. Allowing former employees access for six months

Correct Answer: C. Granting a receiver access only to authorised receipt functions

Question 4

A three-way match normally compares a purchase order with:

A. A budget and a tax return

B. A goods receipt and an invoice

C. A supplier brochure and a contract

D. A forecast and a stock count

Correct Answer: B. A goods receipt and an invoice

Question 5

If likelihood is scored as 4 and impact as 5 on an ordinal risk matrix, the risk score is:

A. 1

B. 9

C. 20

D. 45

Correct Answer: C. 20

Question 6

Which practice best supports algorithmic accountability?

A. Allowing the model to make all supplier exclusions without review

B. Deleting model outputs after each decision

C. Logging recommendations, overrides and outcomes

D. Using only historical suppliers as training data

Correct Answer: C. Logging recommendations, overrides and outcomes

Question 7

Which action is most appropriate when a supplier requests a bank-detail change?

A. Accepting an emailed request without verification

B. Independent callback verification using a trusted contact

C. Allowing the supplier to edit payment records directly

D. Disabling all audit logging

Correct Answer: B. Independent callback verification using a trusted contact

Question 8

In the equation Emissions = Activity data × Emission factor, 2,000 kg of activity multiplied by 1.4 kg CO₂e per kg gives:

A. 280 kg CO₂e

B. 1,428.6 kg CO₂e

C. 2,800 kg CO₂e

D. 3,400 kg CO₂e

Correct Answer: C. 2,800 kg CO₂e

Question 9

Which statement best describes a preventive control?

A. A report identifying unusual price changes after posting

B. A rule blocking a user from approving their own purchase

C. An investigation after a fraudulent payment

D. A post-incident lessons-learned workshop

Correct Answer: B. A rule blocking a user from approving their own purchase

Question 10

Why is treating missing supplier data as automatically indicating high risk problematic?

A. It guarantees perfect competition

B. It may confuse lack of evidence with evidence of high risk

C. It eliminates the need for human review

D. It makes audit trails unnecessary

Correct Answer: B. It may confuse lack of evidence with evidence of high risk