I Will Not Ask For Access To Your Live ERP
ERP and Operational Systems Consultant
You should not give a stranger access to your live ERP.
I am the stranger in that sentence, and I still think you should not do it.
This comes up in nearly every conversation about a systems audit, usually not out loud. It is the reason a founder who agreed the problem is real goes quiet a week later. So here is the answer in writing, before it has to be asked.
The concern is correct
It is not paranoia and it is not a procurement box to tick.
Your ERP is the system your business runs on. It holds your pricing, your margins, your customer terms, your supplier agreements. Read access to it is read access to the commercial shape of your entire company. Write access is worse, because a badly formed call against a live database does not politely fail. It succeeds at the wrong thing, quietly, and you find out at month end.
Anyone who waves that concern away has told you something useful about how they work.
An audit does not need it
Here is what mapping your workflow actually requires, and none of it is a login.
Conversations with the people who touch the systems. Your ops lead, your sales lead, whoever re-keys the orders. They know where the manual steps are. They have known for years. Nobody has asked them in a way that led anywhere.
A screen share. You drive. I watch an order move through your systems the way it moved this morning, and I ask why at each step. I see everything I need to see and I touch nothing.
Exports and documents you already produce. A sample order confirmation. A price list. A screenshot of the integration config. Whatever you are comfortable sending, redacted however you like.
Your integration's own documentation, if any exists. Usually none does, and that is itself a finding.
The output is a map of how work moves and where it leaks. You do not need production credentials to draw that map. You need the people who live in it to talk to you honestly for a few hours.
The four things I commit to
These are fixed. They do not move per client and they are not negotiated down on a call.
Read only, no live system access. No credentials to production. No write path to anything. If something genuinely cannot be understood without seeing a system, we look at it together on your screen, on your machine, with you driving.
One flow, not your whole business. The audit covers a single order to cash flow, start to finish. "Let me look at everything you run" is how an audit becomes a three month discovery project that ends in a document nobody reads. One flow, mapped properly, is worth more than five mapped shallowly.
A fixed fee and ten working days. Both agreed before anything starts. Not an estimate, not a range that drifts. If it takes me longer, that is mine to absorb.
The roadmap is yours either way. Ranked fixes, business impact and rough cost against each one. If you take it to your own developers and never speak to me again, the deliverable still did its job. And if you do build it with me, the audit fee comes off the first build invoice in full.
That last one matters more than it looks. It means the audit cannot function as a trick to lock you into a build. If the roadmap says your systems are fine, it says that, and I would rather tell you in week two than bill you for a year of the wrong work.
What you actually get
A ranked list. Each item carries what it is costing you now and roughly what it costs to fix, so you can prioritise against real numbers instead of a feeling that things are inefficient.
Some items on it will be things you can fix internally next week with no software at all. Those go on the list too. A roadmap that only contains work I could be paid to do is a sales document wearing a consultant's jacket.
Why I put this in writing
Because the alternative is that you think it and never say it, and the conversation quietly ends.
Most people will not tell a vendor that they do not trust them yet. They will say they need to check with the team, and then the thread goes cold. That is a rational way to handle a stranger asking about your core systems, and it costs both of us a conversation that might have been worth having.
So the boundary is stated up front, and it does not move.
I map how an order actually moves through your systems, find where the manual steps are costing you, and hand you a ranked 90-day roadmap with the business impact against each item. Ten working days, fixed fee, read only, and the roadmap is yours whether you build it with me or with your own team.