Enterprise Resource Planning (ERP) systems are sold on the promise of integrated, automated controls. In practice, an ERP system only enforces the controls it is configured to enforce — and configuration drift, rushed implementations, and "we will fix it later" workarounds create real exposure. These are the gaps that appear most consistently in our ERP audits.
1. Excessive or Stale User Access
The most common finding, by far. Access reviews are rarely performed after go-live, so accounts accumulate permissions over time as staff change roles, and former employees frequently retain active logins months — sometimes years — after leaving.
2. Segregation of Duties Conflicts
ERP systems are powerful enough to let one user create a purchase order, approve it, receive the goods, and process the payment — all within the same login. Most platforms include built-in segregation-of-duties rule sets, but they are frequently left unconfigured or disabled because they slow down a small finance team.
3. Workflow Approvals Set Too Low
Approval thresholds configured years ago are rarely revisited as the organisation grows. We regularly find approval limits that made sense at a smaller transaction volume but now let significant payments through with minimal oversight.
4. Audit Trail Settings Disabled or Ignored
Most ERP platforms log every change by default — but logging is only useful if someone reviews it. We frequently find audit trails that are technically active but have never once been queried.
5. Master Data Without Change Controls
Vendor bank details, employee payroll information, and customer credit terms are high-fraud-risk master data. Changes to these fields should require a second approver and generate an alert — a control that is often missing entirely.
6. Interfaces Between Systems
Where an ERP integrates with a separate payroll, banking, or e-billing system, the interface itself is a control point. We test whether data passed between systems is reconciled, and whether failed transfers are flagged rather than silently dropped.
The system is rarely the problem. The configuration choices made — or never revisited — usually are.
What an ERP Audit Delivers
A configuration-level review against your organisation's actual control intentions, not a generic vendor checklist — with findings rated by risk and a realistic remediation plan your IT and finance teams can act on together.
Running SAGE, SAP, Oracle, or another platform? Talk to our IT & Systems Audit team about a configuration review.
