ERP Audit Consultant, UK

How an ERP audit differs from your statutory audit

If your company is audited, your external auditors test balances and controls in order to give an opinion on the annual accounts. Their work is regulated, their conclusions are formal and their scope is set by auditing standards. An ERP audit has none of those features, and I am careful never to present it as if it did.

What it does offer is an operational view that statutory auditors seldom have time for. They may sample a handful of transactions and ask about IT controls; I spend the whole engagement inside the system, looking at:

• whether processes in the ERP match the way the business really trades;
• how VAT, payroll and bank data flow into the ledger;
• who holds which permissions, and whether leavers have been removed;
• where spreadsheets and manual journals fill gaps the system should cover;
• whether the figures in the board pack can be traced to source.

Timed before audit fieldwork, a review like this lets weaknesses be found and fixed internally rather than raised in a management letter. It is equally useful after a new finance director arrives and wants to understand what they have inherited. Either way, the findings are management information, not an assurance report. The general method sits under ERP health check; the UK specifics follow below.

VAT and the route to HMRC

For a VAT-registered business, the ERP is the start of a chain that ends with a return submitted to HMRC through compatible software. Making Tax Digital expects that chain to be digital, so a review of the setup naturally follows the data from invoice to submission. I do not give VAT advice; I describe what the system does and hand any doubtful treatment to your accountant with the evidence attached.

Typical checks include:

• Whether tax codes and defaults on customers, suppliers and items still reflect what you sell and buy, including zero-rated, exempt and outside-the-scope items.
• How reverse charge transactions are recorded, for example on services bought from abroad or, for construction businesses, under the domestic reverse charge where it applies.
• How import VAT is captured, especially if the business uses postponed accounting and needs the monthly statements reconciled.
• Whether the return is produced inside the ERP or rebuilt in a spreadsheet, and if so, whether the spreadsheet step keeps a digital link.
• Who can post VAT adjustments, and whether those journals are reviewed.

Patterns that may have affected past returns are flagged clearly. Whether anything needs correcting, and how, is for your accountant to decide.

Payroll, CIS and the connections around the ledger

UK payroll usually runs outside the ERP, in dedicated payroll software or with a bureau that reports to HMRC in real time. The ERP only receives a journal, and that hand-off is a common source of quiet errors: cost centers that no longer exist, pension liabilities that never clear, or salaries recharged between group companies by hand.

I check how the journal arrives, how it is mapped and whether the related balance sheet accounts reconcile month by month. For contractors and subcontractors working under the Construction Industry Scheme, I look at how supplier status and deductions are recorded and whether the figures your team prepares for monthly returns come from the system or a separate workbook. Your accountant confirms the CIS treatment itself.

Beyond payroll, the review maps every other connection: bank feeds, BACS payment files, card and ecommerce platforms, the CRM, a warehouse or delivery system and any reporting tool. For each one I record the owner, the direction of data, how errors are surfaced and what staff do when a sync fails. Alongside that sits an inventory of spreadsheets that finance and operations rely on. Each one points to a gap, and some point to a risk. Where integration work is needed, ERP integration explains how I approach it.

Access rights, UK GDPR and data quality

Payment diversion fraud, where someone changes a supplier's bank details shortly before a payment run, is a real concern for UK finance teams. The access review therefore starts with the combinations that matter most: who can edit supplier bank details, who can create a payment run, who can approve it and whether any one person can do all three. Dormant accounts, shared logins and former employees who still have access are listed by name for removal.

Personal data deserves the same attention. ERPs hold employee details, customer contacts and sometimes sensitive information in notes and attachments. Under UK GDPR, the business needs to know what it holds, why and for how long. I note where personal data sits in the system, who can export it and whether retention settings exist. Decisions on lawful basis and retention belong with your data protection lead or legal advisor.

Data quality closes the section. Duplicate customers and suppliers, items with missing costs, open orders that will never ship and control accounts that do not agree with their subledgers all erode trust in reports. The findings list each problem with an estimate of effort to fix, ranked against its effect on the numbers the board sees. Cleaning the data is often the cheapest improvement available, and it makes every later change safer.

What you receive and how the review runs

The report starts with a one-page summary for the leadership team, followed by findings grouped by area and rated for impact and effort. Each finding is labeled with the most likely owner: your own staff, your implementation partner, your accountant or the board. A readout session gives everyone the chance to challenge the conclusions before they are final.

From there, the next step depends on what the review finds. A sound system that people do not use well usually calls for ERP optimization. Where the root issue turns out to be an unfinished project or a go-live that never settled, my ERP rescue consultant page for the UK describes how a recovery is organized. If a replacement turns out to be the right answer, the findings feed directly into requirements.

Everything runs remotely within the UK working day, through video walkthroughs, read-only access and shared documents. On-site sessions are available by arrangement. Because I take nothing from software vendors or partners, the review has no reason to recommend extra modules or a new system unless the evidence calls for it. For broader advisory work, see ERP consulting in the UK or the UK overview.