First of all, it all depends when you need to control ERP user privileges in a company,
anyway there are some rules and some example can be your reference, i had used them in several company.

1. new user, create by the privilege by the department manager's request, after GM's approval.

2. rules to keep the privilege Just-Enough-for-Use.
resigned user, all privilege should be removed, the replaced new user need apply for again. this is a merchandise to eliminate unnecessary privilege for the new user.
all user's privileges are sent to their department manager for review periodically as a list.

3.while control the privilege, there should be someone perform the approval role, if there only purchasing privilege, purchasing department manager can give approval, when purchasing user need privilege from other department module such as production or financial, only the depended manager or GM can give approval.