Your ERP is recording risk. It isn't controlling it. There's a vast difference.
In every system audit I’ve done across automotive, construction, electrical, and liquor manufacturing units, I find the same illusion:
The ERP is “implemented.”
Reports are generated daily.
Dashboards are colourful.
And yet:
- The same user creates the vendor and approves the payment.
- The same user creates POs and approves purchase vouchers.
- Inventory adjustments happen without a second-level authorization.
- Master data changes leave no audit trail.
- Credit limits are overridden by anyone with admin rights.
- ERP controls are drastically underutilised.
Recording is not the same as controlling. Visibility is not the same as governance.
A real ERP or system audit asks just one question: “If I wanted to commit fraud here, how easy would it be, and would the system catch me?”
If the answer is “fairly easy” and “probably not,” your ERP is a very expensive logbook.
Boards, when was your last independent ERP control review?
Discuss this on LinkedIn
Disclaimer: This article is prepared for general information purposes and should not be construed as professional advice. Views expressed are those of the author. Readers are advised to consult a qualified professional before acting on anything in this article. DRP & Co. LLP does not accept any liability for actions taken based on this article.