ERP Audit Consultant, India

Where an ERP audit sits beside your statutory and tax audits

The word audit carries a specific meaning in Indian business. Your statutory auditor signs off the financial statements, a tax auditor may report under the income tax law, and some companies also run an internal audit function. An ERP audit is none of these. It looks at the software, its configuration and the habits that have grown around it, and asks whether the system supports the business as it runs today.

That distinction matters for two reasons. First, my report carries no view on your accounts or tax position; those judgments stay with your chartered accountant and auditors. Second, the review is most useful when it feeds them. A finding such as "interstate stock transfers between two GSTINs are booked as journal entries rather than as tax invoices" is a system observation. Whether that treatment is correct is a question for your CA, and I write it up that way, with sample documents attached.

Typical triggers for the review include a new CFO who wants to know what was inherited, a promoter preparing for investors or a bank review, plans to add a plant or a new state registration, and a growing sense that people work around the ERP rather than in it. If the project never reached a stable go-live, the ERP rescue page for India describes a different engagement.

GST, e-invoicing and e-way bill setup: checks I hand to your CA

Indian indirect tax touches almost every ERP master and document. During the review I trace a sample of real transactions from each GSTIN and note how the system handled them. I do not decide whether the tax is right. I list what the system did, so your chartered accountant can confirm it quickly.

Points I typically examine include:

• whether each registration has its own document series and whether series were reused or reset mid-year
• how place of supply is derived for interstate sales, services and dispatches to a third-party address
• whether HSN or SAC codes and tax templates sit on item masters or are typed in at invoice level
• how failed or delayed IRN calls are logged, retried and reported, and whether cancelled e-invoices are reflected in the books
• whether e-way bills are generated from the ERP or separately on the portal, and how vehicle updates are recorded
• how input tax credit in the purchase register is matched against the supplier data your team downloads, and how much of that matching lives in Excel
• which TDS sections are assigned on vendor masters and whether deductions appear at the right stage

Each point becomes a line in a separate CA question log, so tax decisions and system fixes never get mixed up.

Branches, plants and multi-entity structures

An Indian group often runs more than one legal entity, several state registrations under each one and a mix of plants, depots and sales offices. Over time, these locations tend to use the ERP differently. One branch raises sales orders first while another invoices directly; one plant books production daily while another catches up at month end. Each habit looks harmless locally and causes trouble when figures are combined.

I review how the structure is modeled: companies, branches, cost centers, warehouses and the way stock transfers, job work and intercompany sales are recorded. I look for warning signs such as stock transfers that never get received at the other end, intercompany balances that do not agree, or a branch whose stock is adjusted every month to match a physical count.

Where your group plans to add a new entity, plant or state, this part of the review shows whether the current design can take it without duplicating masters or splitting reports. Findings here often point to multi-company design fixes rather than new software. The aim is a structure that a new finance head or auditor can understand from the system itself, without needing the person who set it up to explain the shortcuts.

Access control, segregation of duties and the edit trail

Access rights in many Indian ERPs grow informally. An accountant gets administrator rights during go-live and keeps them. A plant user shares a login with the night shift. A senior manager can create a vendor, raise a purchase order, approve it and release payment without a second person involved.

I export the user and role list, compare it with the people who actually work in each function and test a sample of sensitive actions. The checks usually cover:

• shared and dormant accounts, including former employees still active
• users who can both create and approve the same type of document
• who can edit or delete posted invoices, back-date entries or reopen closed periods
• who can change bank details on vendor masters, and whether that change is approved
• whether the system's change log or edit history is enabled and retained

Indian rules on accounting software and audit trails apply to many companies, and your statutory auditor will have a view on what your setup must show. I do not give a compliance opinion on those rules. I describe what the system records today, so your auditor and CA can tell you whether anything needs to change.

Payroll, integrations, side spreadsheets and license use

Few Indian ERPs run alone. Payroll often sits with a separate tool or provider, GST compliance passes through a connector, and sales may come from a CRM, a dealer app or an ecommerce channel. Data can slip through the gaps at any of those hand-offs.

I list every integration, what it sends, how often and what happens when it fails. For payroll, I check that salary, PF, ESI and professional tax journals reach the right ledgers and cost centers and that someone reconciles them each month. For bank feeds and dealer or channel orders, I check for duplicates and gaps.

I also build an inventory of side spreadsheets: the outstanding sheet the collections team trusts more than the ledger, the production plan kept outside the system, the MIS pack assembled from exports. Each one is a missed requirement, and the inventory tells you which reports leadership does not trust and why.

Finally, I compare paid user licenses and modules with actual logins and usage. Unused seats and modules are common after a rushed rollout. The findings report ranks everything by business impact, separates quick fixes from deeper redesign and marks which items your partner, your CA or your own team should own. For the method in general terms, see my ERP health check service, and for follow-up work the ERP optimization page.