The ERP must enforce both internal controls and external regulations. Standard controls are often not enough. The system must be proactively configured to your specific risk profile to ensure it can be audited.