The summary.
GRANT PERMISSIONS TO ROLES, NOT INDIVIDUALS
Individually granted permissions accumulate until nobody can review them. And shared accounts destroy accountability entirely.
Configure segregation rules so no one person can create a supplier and approve a payment.
CLOUD PROVIDERS BACK UP THEIR INFRASTRUCTURE, NOT YOUR MISTAKES
Data deleted or corrupted by your own users is a common loss their backup may not address. Export independently, regularly, and actually test restoration.
Document and rehearse a manual fallback — power and connectivity interruptions are routine here.
SMALL REGULAR UPGRADES ARE MANAGEABLE; DEFERRED ONES BECOME PROJECTS
Maintain a register of every customisation and integration, because they are what upgrades break.
SYSTEMS WITHOUT AN OWNER DECAY AND NOBODY DECIDES ABOUT THEM
Keep an inventory with contract dates — renewals occur automatically and notice periods get missed. Review licensing against actual usage annually.
NEVER ASSUME AN INTERNATIONAL PRODUCT HANDLES LOCAL STATUTORY REQUIREMENTS
Withholding tax especially. Demand a demonstration against your actual obligations before purchase.
