ERP Audit Consultant, Malaysia

Why a system that passed the MyInvois deadline still needs review

E-invoicing forced many Malaysian businesses to touch their systems at the same time. Some added a connector or middleware to an existing package such as AutoCount or SQL Account. Others moved to a new ERP faster than they would have chosen. Either route can work, but a deadline-driven change tends to leave loose ends: manual steps nobody documented, master data patched just enough to pass validation, and reports that were never rechecked after the change.

An ERP audit is the structured way to find those loose ends. Your company auditor's statutory work and any tax review are different exercises altogether. It is an examination of the software, its configuration and the way people use it, aimed at one question: does the system support the business as it runs today?

Common moments to commission it include the period after a rushed e-invoicing rollout, the arrival of a new finance director, plans to add a plant, branch or overseas entity, and the point where management stops trusting system reports. If your project never reached stable operation, the ERP rescue page for Malaysia covers that situation instead.

Reading the MyInvois trail and SST setup with your tax agent in mind

The Inland Revenue Board operates MyInvois, and its requirements have been refined during the phased rollout. I do not interpret those rules. I show your tax agent what the system actually does, with real documents, so they can confirm or correct it.

From the e-invoicing side, I typically examine:

• how many documents are rejected or cancelled, and why, grouped by cause such as missing buyer details or classification codes
• how consolidated e-invoices for retail customers are prepared and whether the underlying sales tie back to them
• where self-billed e-invoices are needed, for example for certain suppliers, and whether the purchase process produces them
• whether the validation reference returned for each document is stored against the invoice in the ERP
• whether credit and debit notes follow the same path as the original invoice

For SST, I check how sales tax and service tax codes sit on items, services and customer records, how exemptions are flagged, and whether returns are prepared from the ERP or rebuilt in a spreadsheet. Every point that needs a tax view goes into a separate advisor log, with sample transactions attached, so system fixes and tax decisions stay apart.

Payroll postings, factory costing and stock

Payroll in Malaysia usually runs in dedicated payroll software or with a provider that handles EPF, SOCSO, EIS and monthly tax deductions. The ERP receives a journal. I check that this journal lands in the right accounts, departments and entities, that statutory payables clear when paid, and that someone reconciles payroll to the ledger each month rather than at year end.

Manufacturing deserves its own attention, since electronics, electrical and industrial producers are a significant part of the Malaysian economy. In a factory, the questions are practical:

• Do bills of materials match what production actually consumes, or are variances written off each month?
• Are subcontracted processes recorded as subcontract orders, or as purchase invoices with no link to stock?
• Do lot or serial numbers flow from receipt through production to dispatch, so a customer audit trail can be produced from the system?
• Is stock valued consistently across warehouses, and can management explain a product cost from the ERP alone?

Where a group runs several entities or a regional hub alongside the Malaysian factory, I also review intercompany sales and transfer documents, because mismatches there often explain why group margins look wrong. For industry context, see my manufacturing ERP page.

Access rights, approvals and segregation of duties

Controls in a Malaysian ERP often reflect the size of the company when it went live, not its size today. A small finance team shared administrator rights, the factory used one login per shift, and the director approved everything by message. As the business grew, those shortcuts stayed.

I export users, roles and approval settings and test a sample of sensitive actions:

• can one person create a supplier, change its bank account and release a payment to it
• can sales staff alter prices or credit limits without approval
• who can cancel a validated e-invoice or post a back-dated entry
• which accounts belong to people who have left, or are shared across a team
• who can export customer or employee personal data, given your obligations under Malaysian data protection law

Each finding is described in terms of the risk it creates and the simplest practical fix, such as splitting a role, adding an approval step or retiring a shared account. Whether a finding has legal or regulatory consequences is for your company auditor or legal advisor to judge. The aim is a system that a new finance director or auditor can understand without relying on the person who set it up.

Connectors, spreadsheets, licenses and the findings report

Many Malaysian setups now involve more moving parts than before: an e-invoicing middleware, bank payment files, a marketplace or ecommerce connector, a CRM and sometimes a separate warehouse tool. I list each one, what it exchanges, how failures are noticed and who fixes them. A connector that fails silently is one of the most expensive issues an audit can find, because errors accumulate unseen.

I also build an inventory of spreadsheets running beside the ERP: production plans, commission calculations, debtor follow-up lists and the management pack. Each spreadsheet represents a requirement the system is not meeting, and together they show where trust in system figures has been lost.

On licenses, I compare paid users, modules and add-ons with real activity. Seats still assigned to former staff and modules bought for a phase that never started are exactly what this check is meant to catch.

In the report, findings are ordered by how much they hurt the business and how soon they need attention; each states its likely cause and recommends a fix, with an owner: your team, your implementer or your advisor. I present it online to directors and finance. The general ERP health check method sits behind this review, and my wider Malaysian work is outlined on the Malaysia hub and the Malaysian ERP consulting page.