Find Out What Your ERP Is Actually Doing
An independent review of a live system, whoever built it. We check your licensing position, who can do what, whether the master data supports the reports you sign, and which controls are genuinely enforced rather than politely worked around. You get a findings register with severity and evidence, and a fix plan ranked by business risk.
50+ ERP and software projects. Zero failed projects since 2021.
The expensive findings are rarely the technical ones
In most audits the item that costs real money is a licensing position nobody has checked, and the item that carries real risk is access nobody remembered to remove.
Check your licence position before a vendor does
Almost every organisation we review is holding the wrong mix of user types, paying full rate for people who only read, and still counting leavers who were disabled in the directory but never in the ERP. The quieter exposure is indirect or digital access, where a web shop, a portal or a reporting tool reads ERP data on behalf of people who have no named licence. None of that is hard to fix while you are the one asking. It is much harder to fix during a vendor audit, with a deadline and a number already on the table. If your real problem is response times rather than governance, our ERP performance optimisation service is the better starting point.
- User type mix compared against what people actually do in the system.
- Leaver and dormant account sweep, with dates.
- Indirect and digital access mapped per connected system.
The classic finding: one person who can pay themselves
Segregation of duties fails in predictable ways. One role can create a supplier and approve a payment to it. A shared generic login sits behind a third of the postings, so the audit trail names a mailbox instead of a person. Developers still hold production access from a go-live three years ago. A privileged role was granted for one busy month-end in 2021 and never withdrawn. Each of these was a reasonable decision at the time. Together they are the reason the answer to who could do this is usually more people than anyone expected.
- Role conflict matrix run across create, approve and pay.
- Generic and shared logins traced to the postings behind them.
- Privileged grants listed with the date they were given and by whom.
The six areas an ERP audit covers
The same six every time, so the report is comparable year on year and nothing convenient gets skipped.
Five stages from access to a plan you can act on
What you receive at the end
Findings register
Every finding with a severity, the area, the evidence behind it, the business impact and an effort estimate.
Risk-ranked remediation plan
Ordered by business risk, not technical tidiness, and split into this month, this quarter and this year.
Executive summary
Two pages a finance director or managing director can read and act on without a translator.
Licence position statement
Your current entitlement against actual usage, with the gaps and the over-provisioning both named.
Role and conflict matrix
Who can do what today, which combinations conflict, and a proposed role design that removes them.
Customisation and interface inventory
A list of what exists, what is still used, what is undocumented and what is exposed at the next upgrade.
What an audit gives you that a status meeting does not
Already know which ERP you want reviewed?
If you are on one platform and want the review shaped around its own roles, settings and upgrade path, start on that page instead.
Why teams ask TCB Infotech to audit the system
ERP audit questions
What does an ERP audit actually cover?
How is this different from a financial audit?
How long does an ERP audit take?
Do you need system access, and at what level?
Will you audit a system somebody else implemented?
What does the deliverable look like?
Get An Honest Read On Your ERP
Book a free consultation. Tell us what you have inherited or what you suspect, and we will tell you which of the six areas is worth reviewing first, how long a proper audit would take on your system, and what the findings register would give you.
Book a Free Consultation →No commitment. A straight first look at where your system risk sits.
What Is Inside an ERP Audit
An audit is only useful if the findings are evidenced, scored honestly and handed over in a form somebody can act on. Here is how we gather the evidence, how a finding earns its severity, and exactly what is in the report at the end.
From raw system evidence to a plan with owners
We read the system, then we ask the people
The first pass is extraction: user and role tables, permission rules, configuration values, the change log, master data counts and the customisation and interface list. That tells us what the system is set up to allow. The second pass is short interviews with finance, operations and IT, because the workaround somebody mentions in passing is usually the finding the data only hinted at. A control that exists in configuration and is bypassed every month is still a gap.
- Read access or a restored copy, never changes to production.
- Configuration compared against what the documentation claims.
- Interviews used to test whether controls are actually followed.
Severity is business risk, not technical untidiness
Each finding gets a severity, a business impact written in plain language, the evidence that supports it and an effort estimate. High means money, exposure or an audit failure is genuinely in play. Medium means it will cost you at renewal, at close or at the next upgrade. Low means fix it when you are nearby. That ordering is deliberate, because a duties conflict on supplier payments outranks an inconsistent item naming convention, however much the naming convention offends us.
- Severity assigned against business consequence, with the reason stated.
- Effort estimated so you can see the cheap wins first.
- Findings validated with your team before the report is final.
A plan your team can start on this week
The remediation plan splits into this month, this quarter and this year, with an owner suggested for each item and the dependencies between them noted. We present it to your leadership team alongside a two page executive summary, and we answer the uncomfortable questions in the room. Where an area is in good shape we say so and move on, because a report that manufactures forty problems in a healthy system is selling work rather than describing it.
- Findings split into this month, this quarter and this year.
- Owners suggested and dependencies between fixes made explicit.
- Areas that need nothing are marked as such, in writing.
Everything the audit hands over
Findings register
Each item with severity, area, evidence, business impact and effort, in a sheet your team can work through.
Remediation plan
Ranked by business risk, phased across the month, the quarter and the year, with suggested owners.
Executive summary
Two pages for the board or the finance director, written without acronyms and without padding.
Licence position statement
Entitlement against real usage, dormant accounts listed, and indirect access exposure named per system.
Role and conflict matrix
Current access mapped, conflicting combinations flagged, and a cleaner role design proposed against it.
Configuration baseline
A written record of what the live system is set to today, so the next drift is visible instead of invisible.