Avoiding ERP Overreach

Three people in a factory looking at data on a tablet

Avoiding ERP Overreach:

Smarter ERP Choices for Small to Medium Manufacturers and Distributors

For small- to medium-sized manufacturers and distributors across APAC, ERP selection often goes wrong for one reason: overreach.

 

Businesses either choose systems that are too basic to support operational reality or invest in platforms that introduce unnecessary complexity, cost, and risk. In both cases, the ERP becomes a burden rather than a tool that supports growth.

 

The challenge is not simply choosing an ERP product. It is about choosing the right ERP tier for the business’s size, structure, and maturity and “Avoiding ERP overreach”.

 

Start with how your business actually operates

Most manufacturers and distributors operating in Australia, New Zealand, and Southeast Asia share a common core set of requirements. They need reliable control over inventory, purchasing, production, pricing, warehousing, and finance. They also need accurate costing, margin visibility, and reporting they can trust.

 

Where ERP decisions fall apart is when the chosen system does not reflect the real operational complexity of the business, or its internal capacity to support the system long‑term.

 

Entry‑level systems: fast to start, hard to scale

Accounting‑led platforms and entry‑level ERP systems often look attractive early on. They are quick to deploy and relatively inexpensive. However, they tend to struggle once the business introduces multi‑level bills of material, traceability, landed costs, multiple warehouses, or more advanced production planning.

 

Workarounds appear. Spreadsheets return. Data confidence drops.

 

Enterprise ERP: powerful but often unnecessary

At the other end of the spectrum are enterprise platforms designed for very large organisations. These systems assume high transaction volumes, complex organisational structures, and strong internal IT and governance teams.

 

For most small to medium manufacturers and distributors in APAC, this level of capability brings:

 

  • Longer implementation timelines
  • High licence and consulting costs
  • Significant process disruption
  • Ongoing internal overhead

This is where ERP overreach usually occurs.

ERP Charts on a laptop reviewed by a manager

Mid-tier ERP is not one-size-fits-all.

The term “mid‑tier ERP” hides an important distinction. In practice, the mid-tier splits into lower and upper mid-tier systems, and understanding the difference is critical.

 

Lower mid‑tier ERP

Lower mid‑tier ERP systems are designed for operational businesses, typically in the $5M–$50M revenue range. They focus on doing the fundamentals of manufacturing and distribution well, without enterprise‑level complexity.

 

These systems usually:

 

  • Provide manufacturing and distribution functionality out of the box
  • Support real‑world scenarios like BOMs, traceability, and landed cost
  • Rely on configuration rather than deep custom development
  • Implement quickly with contained cost and risk
  • Suit lean teams without dedicated ERP departments

For many growing APAC businesses, this tier delivers the best balance of control, scalability, and predictability.

 

Upper mid‑tier ERP

Upper mid‑tier ERP systems sit closer to enterprise platforms. They offer extensive configurability and broad functional coverage, but with increased cost and complexity.

 

They are generally better suited to:

 

  • Larger organisations
  • Multi‑entity or highly complex operations
  • Businesses with strong internal IT and governance capability

 

For smaller organisations, these systems can slow down decision‑making and reduce agility.

A Paper Chart titled ERP Decision guide

Business Profile

Lower Mid‑Tier ERP

Upper Mid‑Tier ERP

Typical revenue

$5M–$50M

$50M+

Operational focus

Manufacturing and distribution control

Enterprise‑wide integration

Complexity level

Moderate

High

Configuration vs customisation

Mostly configuration

Extensive configuration and customisation

Implementation time

Short to medium

Medium to long

Internal ERP resources required

Low

Medium to high

Cost and risk profile

Predictable and contained

Higher and ongoing

Best suited for

Lean, growing APAC businesses

Larger, complex organisations

Deployment still matters

Cloud ERP is often a strong fit in APAC due to predictable costs and reduced infrastructure management. However, private cloud or on-premises deployment can still make sense where shop-floor integration, performance requirements, or regulatory considerations apply.

 

There is no universal answer, only the answer that fits how your operation actually runs.

 

ERP success depends on fit, not features

ERP success is driven less by checklists and more by alignment. Industry experience, realistic scoping, disciplined implementation, and the right system tier matter more than brand names or feature depth.

 

Avoiding ERP overreach means choosing a system that fits today, scales sensibly, and supports better operational decisions without dragging the business down. For many small- to medium-sized manufacturers and distributors in APAC, especially those in the $5M–$50M range, lower-mid-tier ERP is often the smartest choice.

Cybersecurity – are you sorted?

Dark Cybersecurity

Cybersecurity is a hot topic right now. Businesses are facing attacks from sophisticated cybercriminals targeting money, data and identity.

97% of Australian businesses, about 2 million of them, are small businesses.

In late 2019 the Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC) surveyed small businesses (read the report here) and used the data to put together a Cybersecurity Guide for Small Business which you should get here and review against what you are doing currently.

ASCS receives one report of cybercrime every ten minutes and estimates $300 million in annual losses due to cybercrime in Australia.

As a minimum, ASCS suggests that a baseline of the following eight mitigation strategies be implemented to make it harder for cybercriminals to get into systems and wreak havoc.

Mitigation Strategies to Prevent Malware Delivery and Execution

Application control or whitelisting: to prevent the execution of unapproved/malicious programs, including .exe, DLL, scripts (e.g. Windows Script Host, PowerShell and HTA) and installers.

Why: All non-approved applications (including malicious code) are prevented from executing.

Patch applications: e.g. Flash, web browsers, Microsoft Office, Java and PDF viewers. Patch/mitigate computers with ‘extreme risk’ vulnerabilities within 48 hours. Use the latest version of the applications.

Why: Application security vulnerabilities can be used to execute malicious code on systems.

Configure Microsoft Office macro settings: in the Trust Centre to block macros from the internet and only allow vetted macros either in ‘trusted locations’ with limited write access or digitally signed with a trusted certificate.

Why: Microsoft Office macros can be used to deliver and execute malicious code on systems.

User application hardening: Configure web browsers to block Flash (ideally uninstall it), ads and Java on the internet. Disable unneeded features in Microsoft Office (e.g. OLE), web browsers and PDF viewers.

Why: Flash, ads and Java are popular ways to deliver and execute malicious code on systems.

Mitigation Strategies to Limit the Extent of Cyber Security Incidents

Restrict administrative privileges: to operating systems and applications based on user duties. Regularly revalidate the need for privileges. Don’t use privileged accounts for reading emails and web browsing.

Why: Admin accounts are the ‘keys to the kingdom. Adversaries use these accounts to gain full access to information and systems.

Patch operating systems: Patch/mitigate computers (including network devices) with ‘extreme risk’ vulnerabilities within 48 hours. Use the latest operating system version. Don’t use unsupported versions.

Why: Security vulnerabilities in operating systems can be used to further compromise systems.

Multi-factor authentication: including for VPNs, RDP, SSH and other remote access, and all users when they perform a privileged action or access an important (sensitive/high-availability) data repository.

Why: Stronger user authentication makes it harder for adversaries to access sensitive information and systems.

Mitigation Strategies to Recover Data and System Availability

Daily backups: important new/changed data, software and configuration settings, stored disconnected, retained for at least three months. Test restoration initially, annually and when IT infrastructure changes.

Why: To ensure information can be accessed following a cybersecurity incident (e.g. a ransomware incident).