Abstract

The objective of this study was to analyze the best practices that have to be adopted in implementing ERP. The study further sought to address security challenges faced in ERP implementation. The researcher used content analysis approach of a number of publications on the subject area of ERP implementation. This research makes use of secondary sources like books, academic journals and other online sources that speak about the best practices to be adapted for implementation of Enterprise resource planning systems for conducting the study. The findings showed that before an organization dives in implementing ERP, the following practices for successful implementation have to be considered: developing a plan with clear goals and objectives, gaining internal support and commitment, selecting the right software, allocating sufficient resources and training and change management. The study also established that integrating user management, internal controls, data and information management and reporting, compliance, and protection against internal and external threats associated with a single solution is a big challenge. The paper concludes that even though ERP is important to organisations, its implementation is challenging and organisations must prepare adequately to get it right.

1. Introduction

Enterprise resource planning (ERP) is a system of integrated applications used by organisations to manage the efficient and effective use of organizations resources such as raw materials, funds, technology tools, human resources etc ¹. According to ¹ enterprise resource planning is an industry-driven system and is universally accepted by businesses and organizational across different industries as a practical solution to achieve an integrated enterprise information system solution. The ERP has become a tool for competitive advantage for organizations in today’s business environment. Enterprise resource planning systems have been very valuable in recent times and play a critical supporting role in most of the major industries including manufacturing, construction, pharmaceuticals, airlines, telecommunications, transport, education and research, government among others ^{2, 3}.

A study by ⁴ noted that ERP provides a complete visibility into all important organizations processes across various functional areas, better company visibility hence enabling better collaboration, unified and single reporting system for real-time statistical analysis across all departments, automatic and coherent workflow from one department/function to another, ensures a smooth transition and quicker completion of processes. Some ERP vendors have extended their ERP systems to provide business intelligence functionalities that can give overall insights on business processes and identify potential areas of problems/improvements ².

Since ERP is a modular software system, it is possible to implement either a few modules or many modules based on the requirements of an organization. If more modules are implemented, the integration between various departments may be better. ERP database system is implemented on the backend to store all the information required by the ERP system, this enables centralized storage/back-up of all enterprise data. It has also been observed that ERP systems are more secure because centralized security policies can be applied to them. All the transactions happening via the ERP systems can be tracked and monitored.

Organizations are feeling immense pressure from customers, suppliers and shareholders to continuously improve in production and management efficiency. Competing in a dynamic environment and meeting global challenges requires high levels of agility. Successful companies must be able to respond quickly and cost-effectively to change. In an effort to implement ERP or any other software application that integrates all the individual department functions into a single software application, organizations must be cautious of the challenges that accompany such process.

Many organisations have failed in their quest to implement ERP systems. For instance, a report from ⁵ estimates failure rates to be as high as 90 percent. Researchers ⁶ and ⁷ estimate 75 percent of ERP implementations are usually unsuccessful. In their study ⁸ reported that 50 percent of all ERP implementations result to failure. As stated by ⁹ 25 percent of the ERP implementations fail and that 80 percent are delivered over time or over budget. According to literature from the above mentioned researchers, some of the reasons for ERP failure include high cost of ERP Software, poor planning, customization, configuration, testing, and implementation.

Other indirect costs due to ERP implementation include the cost of new IT infrastructure, cost of upgrading the WAN links, etc. The time consumed in ERP deployment has also been mentioned as a failure factor. Some projects may take 1-3 years or more to get completed and fully functional ¹⁰. Too little customization may not integrate the ERP system with the business process and too much customization may slow down the project and make it difficult to upgrade. Migration of existing data to the new ERP systems is difficult or sometimes impossible to achieve. Integrating ERP systems with other stand alone software systems is equally difficult. Consequently, these activities may consume a lot of time, money and resources.

The cost payback may not be realized immediately after the ERP implementation and it is quite difficult to measure the same ¹¹. Another impediment to successful implementation of ERP projects is lack of participation. Exhaustive user training and simple user interface might be critical. However, ERP systems are generally difficult to learn and use. According to ¹² users perceived usefulness, perceive ease of use of the technology, and the users’ level of intrinsic involvement all affect their intention to use the technology.

This area of ERP has received considerable attention from researchers, however, most research efforts have concentrated on critical factors for implementation of ERP systems or the benefits of ERP systems. Majority of these studies are at organizational level. Little attention has been given to the best practices that have to be adopted in implementing ERP. The objective of this study is to analyze the best practices in successful implementation of ERP. This study further sought to address security challenges faced in ERP implementation.

2. Theoretical Constructs

This section identifies key factors of ERP implementation based on a critical review of both scholarly and managerial literature. These constructs include strategic initiatives, executive commitment, human resources, project management, information technology, business process, training, project support and communications, software selection and support. Successful integration of the internal functions of the business does not necessarily guarantee business success. End-to-end processes that transfer information from module to module will not in themselves improve cost effectiveness and efficiency. The ability to use the information to drive the business is the key to successful integration. Performance measurements must be developed to measure the impact of the ERP system on the business ¹³.

Top management is often advised to look beyond the technical aspects of the project to the organizational requirements for a successful implementation. It is consistently identified as the most important success factor in ERP system implementations. The most recurring theme in management literature concerning the failure of ERP systems is the inability of firms to take into account the new organizational, interdepartmental, and personnel aspects of work organizations. Unintended consequences include the emotional fallout when employees are suddenly given much greater responsibilities. Managers sometimes neglect to assess not only the skill development needed by employees but also the organizational changes required of them.

3. Methodology

This research is a synthesis of previous studies. The researcher used content analysis approach of a number of publications on the subject area of ERP implementations. The study is qualitative in nature. According to ¹⁴ a qualitative study makes use of textual or descriptive information for findings answers to the research questions. It does not involve any statistical analysis or numerical data collection. This research makes use of secondary sources like books, academic journals and other online sources that speak about the best practices to be adapted for implementation of Enterprise resource planning systems for conducting the study. The secondary data collected is to be subject to simple textual interpretation technique. The researcher in the course of conducting the research managed to stay ethical by applying the data collected exclusively for academic purposes.

4. Best Practice Models for ERP Implementation

This section presents the best practice of ERP implementation required in making the appropriate decision. Best practices of ERP implementations presented in this section include; developing a plan with clear goals and objectives, gaining internal support and commitment, Selection of the right software, allocation of sufficient resources and change management.

According to ¹⁵ early and careful planning is paramount for a successful ERP implementation. Lack of a clear plan for ERP implementation will most likely result in costly delays. Recent studies suggest that an organization should begin the initiative by having each department or business process define deliverables and goals they want to achieve before developing an organizational strategy based objectives to be achieved. Organizations must define (Key Performance Indicators) KPIs; business processes have to be studied keenly before thinking of acquiring the ERP system. The ERP project team must analyzes the business strategy, the mission of each department and processes of business in the first stage.

The project plan must be well mapped out for performing all activities including: the definition of requirements, analysis, measures for key performance, vendor selection and evaluation ¹⁵. A good plan must be scheduled based on the time of accounting activities namely: data migration, data conversion and testing and implementation phases. Organizations that plan beforehand enhance their cost and time efficiency and therefore save a lot of resources.

ERP System is a powerful technology that can streamline business processes, improve overall visibility, reduce costs, and completely change the way an organization conducts its business. ERP solutions comprise of several complex front and back office systems that require integration in order to create a seamless experience for users ¹⁶.

An organization decision to implement, upgrade, or integrate an ERP system is dependent on numerous factors that include organizations strategy of growth and its existing information technologies strategies. The decision to implement an ERP system is further mainly triggered by need to evaluate the existing organizational information technology polices, business portfolio, models for cost reduction, and also elimination of obsolete packages, custom-developed extensions, dependencies on third party software ¹⁷.

Implementing an ERP system requires support and collaboration among all departments and processes within an organization. Lack of internal support has led to many failures amongst organizations that sought to implement ERP systems. The disappointing results have been observed not only due to technical aspects in the implementation like inadequate definition of functional requirements or inability in choosing the right ERP system but also the due to the organizational aspects like, lack of commitment from top management and lack of involvement and resistant to change by the end users ¹⁸.

Ensuring that executives and users of ERP system understand why the organization is implementing the system is a key aspect to ERP success. Not having full commitment may cause unnecessary setbacks, costing the business precious time and money. Reference ¹⁸ Suggests that, in selecting the best-in-class implementation of ERP, it must be determined properly how the implementation can be managed. A focused and committed project manager is needed for a successful ERP implementation.

ERP system has a life cycle beginning with a company’s decision to go for it to finally being launched and then subsequently selecting an ERP package. According to ¹⁹ the ERP project team must obtain cost estimations and overall implementation plan from the ERP service providers. Due to the influx of ERP vendors in the software market, focus on selecting ERP system that best suits the organizations unique objectives is fundamental. In addition to the software, project team must be sure to also consider references, vendor training, and on-going support offerings. In most cases, a consultant team will also recommend the modules that are best suited to the company’s operations like manufacturing, sales and marketing, financial, human resources, logistics, information and communications technology etc.

A study by ²⁰ proposes ERP selection framework based on nominal group technique. The framework consists of the following steps: First is forming a project team and collecting all possible information about ERP vendors and systems. This is followed by identification of the ERP system features. Step three is constructing a structure of objectives to develop the fundamental-objective hierarchy and means-objective network. Step four is extracting the attributes for evaluating ERP systems from the structure of objectives. Step five is filtering out unqualified vendors by asking specific questions, which are formulated according to the system requirements. Step six is evaluating the ERP systems using the AHP method and finally discussing the results and making the final decision. These are the basic steps to be followed by organisations when selecting the right ERP software.

ERP system implementation is an investment that requires a significant financial resource. Organisations therefore must allocate the necessary financial resources for the software as well as quality training. Dedicate an ERP implementation project manager to oversee the planning, implementation and management of the ERP system, and be sure that this person understands the business and command management respect and all ERP team members.

Change management is a carefully planned approach used to institute change within an organization. It is critical to providing structure for the human personnel transition and acceptance of the ERP system. One of the common mistakes organizations make is the assumption that change management is simply user training.

Change management is necessary in organizations to prepare users for new systems, reduce resistance towards the system and influence user attitudes towards change ²¹. Study by ²² reflects on ERP implementation failures that occur due to employees’ resistance to change. Many organizations ignore that ERP implementation are not one-off events. However, it is a radical change of technical infrastructure, business processes, organizational structure, the roles and skills of organizational human resources and knowledge management activities. Reference ²⁰ asserts that implementation of ERP not only affects the business and system process, it also affect those people who will find it tough to change processes, roles and behaviors that they have learned or worked over for many years.

The ERP implementation team must ensure that employees understand their new job roles and processes during that particular time period, so that they can be able to adopt and internalize these new developments. If this is not followed, there will be organizational resistance. It is statistically estimated that approximately one half of all ERP projects fail to achieve organizational objectives due to underestimating the efforts involved in change management ⁸. These are the main best practices commonly discussed in literature on ERP systems implementation.

5. ERP Security Challenges

Besides the benefits there are numerous challenges of ERP system implementation among organisations posing threat on security integrity, availability and confidentiality of information ²³. ERP security is complicated due to the number of functional and technical components that have to be taken into account when defining an ERP security and controls program. Integrating user management, internal controls, data and information management and reporting, compliance, and protection against internal and external threats associated into a single solution is a big challenge. This section discusses four security challenges of ERP system implementation.

EPR system is an integration of many applications that plan, manage and streamline resources and processes within and across the functional units of the organization ¹⁷. The fact that an ERP system can allow a single user to play many roles in the organization such as management of user rights and privileges exposes the system to security threats. The complexity of ERP systems affects its security. According to ¹⁸ complexity due to implementation of different predefined configurations and ad hoc customizations has been made more challenging by lack of sufficient information from vendors.

A potential risk area during the ERP implementation process is lack of commitment from the functional areas of the business ⁶. Organizations that implement ERP system must ensure that application is used within an organization only and no outsider is allowed. If ERP systems are not connected to outside world or internet then there no security issues will land in the system. However, this is a general miss -conception that comes in much organizations’ mind. Because these systems are used by people, in one way or another, the system is usually exposed to outsiders who may want to exploit organisations data.

Lack of adequate preparation and the scant attention that is paid to ERP security may lead to ERP failure ²⁴. Most organizations fail in their ERP security efforts because they implement systems with a plan that leaves controls design and implementation until the end of the process. However, ERP projects are invariably over budget and behind schedule, so strict internal controls are often glossed over to keep costs down and make up time. Organizations system administrators often find it difficult and experience problems with ERP security constraints which creates a problem in security of ERP system. One of reasons for lack of attention towards ERP security by stakeholders is the view that an ERP implementation is an IT project. On the contrary ERP implementations should be viewed as an organization-wide project that requires active participation from all members of the organization.

Not all organizations are having the same versions of ERP software running their businesses. ²⁵ Argues that that in order achieve competitive advantage, business organizations must customize ERP systems according to their requirements. ERP customization can be done by system developers as per the organizations preferences and so there are no standard counter-measures or preventive mechanisms. Inflexibility and inability of ERP to support all specific customization and configuration ends, limited code base, difficulties in upgrading software and keeping customizations compatible with future ERP releases may pose a security threat.

Reference ¹⁸ posits that ERP customizations have been observed to cause instability issues and performance problems because there is no a clear framework to determine the level of configuration and customization ability of ERP systems. Further, there is scarcity of empirical case studies evaluating customizability of specific ERP solutions.

Insufficient knowledge and lack experience by ERP implementation and support team is a major security issue. An organization requires experienced and expert manpower that can justify the importance of ERP security to organizational people and try to take some preventive plans against the threats. But, because of less concerns about the security constraints due to lack of internal experts many organisations don’t consider security issues important aspect in ERP system.

Lack of focus on system and organizational internal controls and compliance requirements during the ERP implementation, organizations can easily end up deploying a system that later requires additional documentation and rework at significant cost. It is the responsibility of the IT security officer to ensure that the ERP system adheres to international security standards like King-II, CobiT, ITIL, ISO etc. Organizations must also put in additional security efforts such as security policies and administration in organization.

ERP updating is usually overlooked by many organizations and this poses a security threat. Most of the ERP system user sets the day-to-day working environment on the ERP system and having the habitual of the same working style every day. Updating single patch in the ERP system can change their customize setup into default setup and that may disturb their regular work. This common fear and many people don’t update their ERP systems regularly and this creates the best platform for the hackers to attack on the ERP systems. While all software manufactures strive to continuous improvement of their software, they should allow for real-time updating of the software.

Many potential ERP users in organization would rather deal with an old than adapt to a new system ²⁶. The only way to ensure user involvement is by providing a consistent user experience and communication among active and passive users throughout the ERP implementation phase. Users of ERP system are less bother about the system security and they might consider the issue lightly. Keeping this same mindset the message is forwarded to all other user of the ERP systems and this creates the lack of interest in the ERP user’s team in regards to ERP security.

6. Discussion

According to the literature review, it has been discussed that ERP systems completely change the shape of organizations. When ERP system is implemented all the functional area of an organization are affected. It has been observed that before an organization dives in implementing ERP, the following practices for successful implementation have to be considered: developing a plan with clear goals and objectives, gaining internal support and commitment, selecting the right software, allocating sufficient resources and training and change management.

Early and careful planning is paramount for a successful ERP implementation. Failure to have a clear plan in place before ERP implementation will most likely result in costly delays. It is also important to begin the initiative by having clear departmental objectives and measurable objectives.

Organizations must define key performance indicators (KPI) and the subsets of this best practice are studying business processes and strategy to acquire an ERP, analyzing application, demonstrating, negotiating and planning. A good ERP project plan must be well mapped out for performing the ERP implementation activities. Reviewing literature helps organizations in describing the various organizational factors that raise the need of implementing and deploying ERP systems within organization.

Literature has also underscored that implementing an ERP system requires support and collaboration among all departments and processes within an organization to avoid failures. Selection of ERP system must be guided by the organizational objectives. It is advisable consider references, vendor training, and on-going support offerings. It has also been noted that ERP system implementation is an investment that requires a hue budget. The management should allocate the necessary financial resources for the system as well as offer quality user training.

Change management is mandatory and it is one of the most important activities during ERP system implementation. This entails managing organizational elements such a people, culture, politics and conflicts, structure, standard operating procedures, controls and risks. However, this is a process that is continuous.

It has to be noted that organizations do not have to learn from the other organizations experiences, the above mentioned practices should taken into consideration for successful implementation of ERP in an organization. However, the practices must be in-line with the organizations objectives.

7. Conclusion

The main goal of this paper was to discuss the best practice models for ERP implementation and security challenges. Current research state on ERP implementation reveals that Successful implementation and security of ERP systems is not all about technology but holistic process that involve all the elements of an organization. A number of authors have addressed the factors for implementation of ERP systems but few have attempted on highlighting the best practices for implementation. Thorough planning, top management support and user involvement, resource allocation, selection of the right ERP software and change management have been found to be the best practices for ERP implementation.

The Paper highlights the important issues in the regards of ERP security that affect successful ERP implementation and deployment in organizations. The ERP security plays a vital role in the organization and taking best practices for implementation and security measures can solve the problem of ERP security. The paper underscores the list of some key security issues which include Complexity of ERP System, ERP is within organization, Lack of attention towards the ERP security, ERP Customization, Lack of Experienced and Expert Man Power, Security Policies and Administration, Lack of Interest in Updating ERP System and Miss-Communications among the Users of ERP system.

This research should assist organizations management gain deep understanding of the ERP implementation best practices and the security challenges. It should also assist researchers in this area of study. For example, a Case study research would serve to reinforce and validate the discussions and conclusions of this study.

Acknowledgements

Regards to my colleagues at the department of management science at Kenyatta University, Kenya, they are always supportive and collaborative in research by providing materials where possible.

References