ERP & Systems Audit India: Who Needs It and Who Does Not
Whether ERP & Systems Audit India applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the ERP & Systems Audit India page.
What exactly is a Systems, ERP & Application Audit — in plain terms?
It is an independent check of whether the controls built into your ERP or core business application — who can do what, what approvals are required, how data moves between systems — actually work the way management believes they do. It goes beyond financial statement audit to test the system itself: user access, approval workflows, automated checks like three-way matching, and whether data flowing between your ERP and other systems (banking, payroll, GST tools) is complete and accurate.
In practice: Most managements have a mental model of their ERP's controls based on how it was designed at go-live. Years of employee turnover, ad-hoc access grants, and configuration changes almost always create a gap between that mental model and reality. The audit closes that gap.
Is a Systems/ERP Audit legally mandatory in India?
There is no standalone statute that mandates a periodic ERP audit by name. However, it is closely linked to obligations that are mandatory: the Board's certification of Internal Financial Controls over Financial Reporting under Section 134(5)(e) of the Companies Act 2013 (for listed companies), the statutory auditor's IFC opinion under Section 143(3)(i) for applicable companies, and, for certain regulated entities (banks, NBFCs, listed companies), specific regulator expectations around IT governance. In practice, an ERP audit is the mechanism by which the underlying application controls supporting IFC certification are actually tested at a level of technical depth the standard statutory audit procedures may not reach.
In practice: It is easy to commission a first ERP audit only after a statutory auditor's management letter flags an access-control or IFC gap. Commissioning it proactively — rather than reactively after a qualification — is both cheaper and better governance.
Who receives the audit report, and is it shared with our statutory auditor?
The report and the Audit Committee/Board presentation are addressed to your organisation — typically the Audit Committee, CFO, and CISO/IT Head. Sharing the report with your statutory auditor is your decision; many clients choose to share it (with the engagement CA's involvement) because it strengthens the statutory auditor's own IFC evidence base and can reduce duplicated testing, but PNPC does not share it with any third party without your explicit consent.
In practice: Where PNPC also performs the statutory audit for a client, we maintain appropriate independence safeguards between the two engagements consistent with ICAI's independence requirements; for clients where we do not perform the statutory audit, coordination with your existing auditor (with your consent) is usually a straightforward, valuable step.
Does this engagement double as a cybersecurity audit or penetration test?
No. A Systems/ERP Audit tests application-layer controls — access, configuration, workflows, interfaces, data integrity. It does not test network perimeter security, external attack surface, or infrastructure vulnerabilities, which require a dedicated VAPT (Vulnerability Assessment and Penetration Testing) engagement using different tools and methodology. The two engagements are complementary — an organisation with strong ERP application controls can still be exposed at the infrastructure layer, and vice versa.
In practice: We can scope both engagements together where useful, but we keep the deliverables and methodologies distinct — conflating them tends to produce a report that does neither job well.
What is master data governance, and why does it matter for an ERP audit?
Master data — vendor records, customer records, chart of accounts, tax codes — is the foundational reference data that every transaction in the ERP draws upon. Poor master data governance (duplicate vendor records, dormant-but-active vendors, uncontrolled changes to bank account details on a vendor master) is a common vector for both genuine error and deliberate fraud, such as redirecting a payment to a fraudulently altered bank account. We test who can create or modify master data, whether changes require independent approval, and whether the master data itself contains anomalies like duplicate PANs or bank accounts shared across supposedly unrelated vendors.
In practice: Vendor bank account changes are a specific high-risk test point — we look for whether a maker-checker control exists on bank detail changes, since this is one of the most common fraud patterns we encounter in ERP environments without this specific control.
What happens if the audit finds a Critical severity issue mid-engagement?
We do not wait for the final report to communicate a Critical finding — such as active, unrevoked payment-approval access for an employee who left the organisation months ago, or an unauthorised configuration change that bypasses an approval workflow. Critical findings are escalated to management (and, depending on severity, the Audit Committee Chair) immediately upon confirmation, so remediation can begin before the final report is even drafted.
In practice: An active exposure — for example, live system access for a terminated employee — warrants same-day escalation rather than waiting for the scheduled reporting milestone. Speed matters more than report formality in these cases.
What if we don't have a formal Audit Committee — can we still commission this audit?
Yes. While the ideal reporting line for ERP audit findings is a formally constituted Audit Committee (mandatory for listed companies and certain classes of public companies under Section 177 of the Companies Act), many private companies without a mandatory Audit Committee still commission ERP audits and receive findings directly through the Board or a designated senior management sponsor (typically the CFO). The value of the audit itself is not diminished by the absence of a formal committee structure, though we do recommend at least a Board-level briefing for any Critical or High findings.
In practice: For companies without an Audit Committee, we specifically recommend documenting Board-level awareness of Critical/High findings in the minutes — this creates the same governance trail an Audit Committee structure would provide automatically.
Where this sits in the wider engagement
ERP & Systems Audit India rarely arrives on its own. The statutory basis and the current requirements are set out on the ERP & Systems Audit India service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On ERP & Systems Audit India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.