ERP Audit Consultant, Spain

ERP audit or auditoría de cuentas? Drawing the line

Spanish finance teams know the statutory audit well, so the distinction matters. An auditoría de cuentas gives an opinion on the annual accounts. The work on this page does something different: it examines whether the ERP fits the way the company now operates, whether its controls work, and whether data reaches the tax agency, the banks and the advisors without being patched by hand. It gives no assurance on the accounts and no tax opinion.

Companies tend to ask for it when:

• SII submissions keep generating errors and nobody can say why.
• The gestoría spends more time correcting exports each quarter.
• A foreign parent has acquired the business and wants to know what it bought.
• The integrator's support contract is up for renewal and management wants an independent view first.

The method combines conversations with administration, sales, purchasing and warehouse staff, staff sharing their screens while they complete everyday tasks, and viewing access to settings and transaction history. Each draft finding is checked with the person responsible before it reaches the report. The wider method is described under ERP health check, while this page focuses on what Spanish rules and Spanish practice add to it.

Do the SII records match the ledger?

For companies within the scope of the SII, the invoice records sent to the tax agency should mirror the sales and purchase ledgers. In practice they drift. A credit note posted in the ledger but never submitted, a supplier invoice registered late, a record accepted with errors that nobody corrected, or a manual journal on a VAT account that the submission logic ignores: each leaves a small gap that someone has to explain later.

For selected periods I compare the submitted records and their statuses with the ledgers, and I group differences by cause:

• Master data: missing or invalid tax IDs, wrong country or territory on the customer or supplier.
• Document types: simplified invoices, corrective invoices or reverse charge cases mapped inconsistently.
• Process: purchase invoices entered after the submission window, or approvals that delay registration.
• System: submission jobs that fail silently or need manual restarts.

Entities in the Basque Country or Navarre, which have their own tax administrations, and companies dealing with the Canary Islands, which have their own indirect tax, get the same comparison against their own reporting channels and tax codes.

Every point that touches tax treatment is written as a question for your asesor fiscal. They rule on the treatment and on any regularization; the audit shows where the system creates the problem.

Invoice series, corrections and the invoicing software rules

Spain has introduced requirements for the software that issues invoices, aimed at keeping invoice records complete, traceable and protected from later changes. How they apply, and from when, is a question for your asesor fiscal, and the details have shifted over time. What an ERP audit can do is show how your system behaves today and where it depends on assumptions nobody has checked.

I look at:

• Invoice series: how many exist, who can create them, and whether numbering is continuous within each.
• Corrective invoices: whether they reference the original properly, including invoices issued before a system change.
• Editing and deletion: whether a posted invoice can still be changed, cancelled or removed, and by whom.
• Customizations and add-ons that alter how invoices are created, numbered or sent.
• Whether the vendor or integrator has stated in writing how the exact version and configuration you run addresses the rules.

That last point matters because the answer belongs to a specific product, version and setup, not to a brand. If you do not have a written answer, the report recommends asking for one and lists the questions to put. I do not judge whether a product meets the rules; that is for the vendor to state and your advisor to assess. My Spanish business analysis page shows how the same topics are written into requirements for a new system.

Remittances, the payroll file and the gestoría handoff

Banking is where many Spanish systems leak time. Customers paying by direct debit need valid mandates in the ERP; remittance files must be accepted by each bank; returned debits should come back with their charges and reopen the invoice automatically. I follow selected collection dates from mandate to bank response, and set the ERP's aged debtor list beside the one credit control actually works from. Supplier payment runs, whether by transfer or confirming, get the same treatment.

Then the handoff with the gestoría. I ask three plain questions: what does the advisor receive from the ERP, what do they re-key or adjust, and what comes back? If the official books are kept in the advisor's own software, the audit checks how closely the two ledgers agree and where the differences come from, such as accruals posted only on one side or a chart of accounts mapped loosely.

Payroll usually stays with a labor advisor or payroll provider. I review how their monthly file is imported, which accounts and cost centers it hits, and whether someone reconciles it to the payroll summary. Social security and withholding matters remain with them.

The aim is not to move work away from your advisors. It is to make the ERP produce data they can use without rebuilding it. Fixes often fall under ERP integration or simple configuration changes.

Access, online sales links and the findings report

User rights are reviewed against duties management agrees should be split: creating suppliers and changing their bank accounts, approving invoices and releasing payments, posting manual journals and closing periods. I also look for dormant users, staff who have left, shared warehouse logins and integrator accounts that were never closed. Personal data in HR and customer records is checked for role-based limits, with GDPR interpretation left to your data protection advisor.

Integrations come next: online stores, marketplaces, logistics operators and CRM. For each, I note which system owns the data, how errors surface and how often staff correct orders or stock by hand.

Licenses complete the picture. Paid users who never log in, modules included in the subscription but unused, and seats shared between people are listed for a factual conversation with the vendor.

The report contains a summary for management, ranked findings with evidence and causes, a separate question list for your asesor fiscal and gestoría, and a proposed order of fixes. It is presented remotely during the Spanish morning or early afternoon; a visit is possible by arrangement. If the system needs more than tuning, my ERP rescue service for Spain picks up from the audit, and ERP optimization covers lighter fixes. The Spain hub and my ERP consultant page for Spain describe the rest of my work there.