ERP Audit
An independent review of a live system, whoever built it: licensing, access, master data and controls, with a findings register and a fix plan ranked by business risk.
Why It Matters
Almost every organisation we review is holding the wrong mix of user types, paying full rate for people who only read, and still counting leavers who were disabled in the directory but never in the ERP.
Segregation of duties fails in predictable ways. One role can create a supplier and approve a payment to it. A shared generic login sits behind a third of the postings, so the audit trail names a mailbox instead of a person.
Agree entities, modules and depth, sign the confidentiality terms, and get read access or a restored copy of the database.
Automated extracts and manual review across all six areas: users, roles, configuration, master data, customisations and logs.
Short sessions with finance, operations and IT, because the workaround people describe is usually the finding the data only hints at.
Every item written up with evidence, a severity, the business impact in plain language and an effort estimate, then validated with you.
A risk-ranked plan split into this month, this quarter and this year, presented to your leadership team with the executive summary.
Every finding with a severity, the area, the evidence behind it, the business impact and an effort estimate.
Ordered by business risk, not technical tidiness, and split into this month, this quarter and this year.
Two pages a finance director or managing director can read and act on without a translator.
Your current entitlement against actual usage, with the gaps and the over-provisioning both named.
Who can do what today, which combinations conflict, and a proposed role design that removes them.
A list of what exists, what is still used, what is undocumented and what is exposed at the next upgrade.
No design decisions to defend, so the report says what the system does rather than why it was reasonable.
A duties conflict on payments outranks an untidy naming convention, even when the naming convention annoys us more.
A report that finds forty problems in a healthy system is selling work. We mark the areas that need nothing.
Every finding is traceable to a user list, a config value, a log entry or a transaction we can show you.
We do not change your production system during an audit, and we will work in a restored copy if you prefer.
Six areas: your licensing and user position, security and segregation of duties, master data quality, configuration and the controls built on it, the inventory of customisations and integrations, and whether backup, recovery and the audit trail would survive being tested. We review the live system rather than the design documents, because the two stopped agreeing years ago.
A financial audit tests whether your numbers are right. An ERP audit tests whether the system that produces those numbers can be trusted to keep producing them. Your external auditor will ask who can post a journal, whether the approval limits are enforced and whether the change log is complete. We check those things first, in your own time, so the answers are ready before somebody else asks.
A focused audit on a single entity runs 2 to 4 weeks from access being granted to the findings presentation. A full review of a large multi-entity system, several currencies and a real integration estate runs 4 to 8 weeks. Most of that is analysis and interviews rather than waiting. We recommend re-auditing annually, or straight after a major upgrade, migration or acquisition.
Yes. We need read access to configuration, user and role tables, the change log and a representative sample of transactions, plus a copy or snapshot of the database where that is easier for you. Read only is enough for almost everything. We do not need to post transactions and we do not change settings during an audit. If your policy requires it, we work in a restored copy instead of production.
That is most of the work we do. It also makes the review more useful, because we have no build decisions to defend. We are not looking for fault with the original partner, and plenty of what looks wrong was a sensible choice at the time that nobody revisited. The report says what the system does today and what it costs you, not who is to blame.
A findings register where every item carries a severity, the business impact in plain language, the evidence behind it and an effort estimate. Alongside it, a remediation plan ranked by business risk rather than by technical tidiness, split into what to fix this month, this quarter and this year. On top of that, a two page executive summary a finance director can read without a translator. We also say clearly where the system is fine.
Related
The other services in this section, and related pages from TCB Infotech.
No commitment. A straight first look at where your system risk sits.
