ERP & Systems Audit India: Where It Goes Wrong
The failures on ERP & Systems Audit India repeat, which means they are avoidable if you know what to watch. The questions below are the ones raised most often in practice; the full scope of the service is on the ERP & Systems Audit India page.
What access does the audit team need, and is there any risk to our live system?
The audit team requires read-only access to user administration tables, configuration settings, and transaction data extracts — no change or write access to your production environment is required or requested at any stage. Where direct system access is not feasible for security reasons, we work with your IT team to obtain the required data extracts on an agreed schedule instead.
In practice: We formalise the exact access request in writing before the engagement starts and route it through your IT department's standard access-provisioning process — we do not ask for credentials outside your normal controls.
Our ERP is heavily customised. Does that change the audit approach?
Yes. For heavily customised systems, we run a short discovery phase before finalising the detailed test plan — reviewing the specific customisations, custom workflows, and any bespoke reports or interfaces built on top of the standard ERP. Applying a generic, vendor-standard checklist to a heavily customised system typically produces findings that are either irrelevant (testing standard controls that were deliberately replaced) or that miss the actual risk (custom code or workflows that were never independently reviewed).
In practice: Custom-built approval workflows and bespoke reports can be more prone to control gaps because they were built for a specific business need and never subjected to the same scrutiny as standard, vendor-tested functionality.
How often should a Systems/ERP Audit be repeated?
Most organisations benefit from an annual cycle, aligned with the statutory audit calendar so findings can inform (and be informed by) the year's IFC testing. Organisations with lower risk profiles, simpler ERP landscapes, and a clean prior-cycle result sometimes move to a bi-annual (every two years) cycle, supplemented by targeted reviews after any major system change (upgrade, new module go-live, new entity onboarding). Any major ERP change — migration, upgrade, new interface — should trigger an interim scoped review rather than waiting for the next scheduled full cycle.
In practice: We recommend against extending the cycle beyond two years for any organisation with PE/VC investors, lending covenants, or IPO ambitions — the control drift that accumulates in the interim tends to be exactly what due diligence surfaces at the worst possible time.
Does PNPC audit ERPs for companies operating in both India and the UAE?
Yes. PNPC has operating offices in Chennai, Bangalore, Hyderabad, and Dubai. For groups running a single ERP instance across an Indian entity and a UAE entity — a common structure for cross-border businesses — we test the controls consistently across both entities' data and users within the same engagement, and factor in relevant differences such as UAE VAT/Corporate Tax reporting requirements alongside Indian GST requirements where the ERP handles both.
In practice: Groups with a shared ERP instance across jurisdictions often have inconsistent access policies applied per entity because the policy was designed with only the home jurisdiction in mind — we specifically check for this gap in cross-border engagements.
What qualifications does the team performing the audit hold?
PNPC's Systems/ERP Audit engagements are led by practising Chartered Accountants with specific information systems audit training and experience, supported by technical specialists with ERP-platform-specific configuration knowledge where the engagement requires it (for example, SAP Basis-level access review expertise for SAP engagements). The CA leadership ensures findings are interpreted through the lens of actual financial statement and governance risk, not purely technical IT risk in isolation.
In practice: We deliberately keep a Chartered Accountant as the engagement lead on every ERP audit, even when technical specialists perform detailed configuration testing — the translation from a technical finding to its financial reporting and governance implication is where the real value to the Board sits.
Why should we engage PNPC rather than a pure IT security firm or a generic 'compliance' vendor?
A pure IT security firm typically lacks the Chartered Accountant's grounding in financial statement risk, IFC requirements, and Companies Act governance obligations — they can tell you a password policy is weak but may not connect an SoD conflict to its financial reporting and fraud implications. A generic compliance vendor often runs a templated checklist regardless of your specific ERP configuration. PNPC combines practising CA judgment — the same judgment applied in statutory audit and IFC testing — with hands-on ERP-specific technical testing, and we are the same firm your Board can call on for the statutory audit, internal audit, and every other assurance need across the company's life.
In practice: Clients who come to us after a generic vendor's ERP or IT audit typically arrive with a report full of technical observations but no clear line drawn to financial reporting risk, materiality, or governance action — which is precisely the translation an Audit Committee needs and a pure IT vendor is not positioned to provide.
What does the PNPC engagement actually include, end to end?
Landscape mapping and risk assessment; audit charter and access provisioning coordination; full ITGC review including access provisioning/de-provisioning testing; comprehensive segregation-of-duties analysis; automated/application control testing including three-way match and approval workflows; interface and reconciliation testing across satellite systems including GST/e-invoicing; master data governance review; data analytics on full transaction populations where feasible; severity-rated findings report; management response collection; Audit Committee/Board presentation; and a follow-up validation cycle to confirm remediation was genuinely implemented.
In practice: Everything above is agreed in the written scope before fieldwork begins, at the fixed fee quoted — there are no surprise add-on charges for standard follow-up questions or the Audit Committee presentation itself.
How does an ERP audit interact with Internal Audit if we already have that function?
Where a client already has an internal audit function (in-house or outsourced, including PNPC's own Internal Audit service), the Systems/ERP Audit is typically either commissioned as a specific cycle within the broader internal audit plan, or run as a standalone deep-dive that feeds findings into the internal audit's overall risk register. We coordinate scope with the existing internal audit function to avoid duplicated testing and to ensure IT/ERP risk is properly represented in the annual risk assessment that drives the broader internal audit plan.
In practice: We frequently recommend that ERP/IT risk get its own dedicated audit hours within the annual internal audit plan rather than being treated as a minor sub-topic within a broader operational audit cycle — the technical depth required genuinely warrants a focused engagement.
Is this audit relevant for NBFCs, banks, or other RBI-regulated entities with additional IT governance requirements?
Yes, and it is often more directly relevant for such entities. RBI has issued specific IT governance, risk, and control guidelines for banks and NBFCs (including master directions on IT governance and cybersecurity), and core banking or lending management systems fall squarely within scope of the same ITGC, application control, and data integrity testing methodology used for any ERP. For regulated entities, we align the audit scope and reporting format to the specific regulatory guideline in force, in addition to the general Companies Act and IFC considerations relevant to any company.
In practice: RBI-regulated entities should confirm their specific applicable master direction and any mandated audit frequency with us at scoping stage — regulatory expectations for IT/systems audit in this sector are generally more prescriptive than for a typical unregulated company.
Where this sits in the wider engagement
ERP & Systems Audit India rarely arrives on its own. The statutory basis and the current requirements are set out on the ERP & Systems Audit India service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On ERP & Systems Audit India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.