ERP & Systems Audit India: The Process, Start to Finish
The mechanics of ERP & Systems Audit India are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the ERP & Systems Audit India page.
How is this different from the IT controls testing already done as part of the statutory audit?
The statutory auditor's IFC testing is scoped to controls material to the specific financial statement assertions and line items being audited — it is a subset, not a comprehensive review of the ERP. A dedicated Systems/ERP Audit goes deeper: full segregation-of-duties analysis across the user base, complete access recertification testing, interface reconciliation across all satellite systems, and master data integrity review — regardless of whether a specific control is deemed 'material' for the current year's financial statement opinion.
In practice: Deep SoD analysis in a dedicated ERP audit can surface conflicts that statutory audit sampling does not necessarily touch, because the sample size and materiality threshold in a financial statement audit are not designed to catch every access conflict.
Which ERP systems does PNPC have experience auditing?
PNPC's IT-audit-trained team has experience across the ERP systems most commonly used by Indian mid-market and enterprise clients, including SAP (ECC and S/4HANA), Oracle (E-Business Suite and Fusion), Microsoft Dynamics 365, NetSuite, Tally Prime with add-on modules, and Zoho Books/Zoho One implementations. The audit methodology — ITGC, SoD, application controls, interface testing, data analytics — is consistent across platforms, but the specific configuration tables, role structures, and known risk areas we test are tailored to each application's architecture.
In practice: For less common or heavily customised ERPs, we scope a short discovery phase first to understand the specific configuration architecture before finalising the detailed test plan — a generic checklist applied to a customised system produces low-value findings.
How long does a typical ERP audit take?
For a mid-sized single-ERP organisation with a handful of modules and locations in scope, the first-cycle timeline from kickoff to Audit Committee presentation depends on the landscape and is confirmed at scoping. Multi-entity groups, multiple ERPs, heavy customisation, or a larger number of interfaced satellite systems extend this. Subsequent annual cycles are typically faster once baseline documentation, the risk assessment, and the SoD matrix already exist from the prior cycle.
In practice: We agree a realistic timeline at scoping stage based on your specific landscape rather than quoting a generic duration — the number of interfaces and the state of your existing documentation are the two biggest timeline drivers.
What does a finding actually look like, and how is severity decided?
Each finding documents the specific control gap identified (for example, '14 users hold both vendor-master-creation and payment-approval access'), the risk it creates, and a practical, system-configurable recommendation. Severity is rated Critical, High, Medium, or Low based on the combination of likelihood and potential financial or reputational impact — a Critical finding typically indicates an active exposure (for example, unrevoked access for an exited employee with payment authority), while a Low finding might be a documentation gap with no immediate transactional risk.
In practice: ' Every recommendation specifies the exact configuration or process change needed, so your IT team can act on it without needing to reinterpret the finding.
What is IT General Controls (ITGC) testing, specifically?
ITGC covers the foundational controls that support every application control riding on top of the system: user access provisioning and de-provisioning, periodic access recertification, change management for any configuration or code change to the system, and IT operations controls such as backup and disaster recovery. If ITGC is weak — for example, exited employees are not promptly de-provisioned, or configuration changes are made without approval — then even a well-designed application control (like a three-way match) cannot be relied upon, because the environment around it is not controlled.
In practice: We test ITGC first, before application controls, because a weak ITGC environment can undermine confidence in every other finding in the audit — it is the foundation the rest of the testing sits on.
What is three-way match, and why does the audit test it specifically?
Three-way match is an automated control that verifies a vendor invoice against both the purchase order and the goods receipt note before allowing payment — ensuring the organisation only pays for what was ordered and actually received, at the agreed price. It is one of the most common automated controls configured in ERPs to prevent overpayment, duplicate payment, and payment for goods never received. We specifically test whether the configured tolerance limits (the permitted variance between PO, GRN, and invoice amounts) are reasonable and whether the control can be bypassed through manual override, and if so, by whom and how often.
In practice: A surprisingly common finding: three-way match is configured correctly on paper but a wide tolerance limit (allowing, say, a 25% variance) effectively neutralises the control's protective value. We flag tolerance-limit configuration as a specific test point.
How does PNPC test data flowing between the ERP and GST filing or e-invoicing systems?
We reconcile the transaction data extracted from the ERP (or the e-invoicing/e-way bill utility feeding off it) against the actual GSTR-1 and GSTR-3B returns filed for the corresponding period, checking for completeness (all applicable transactions captured), accuracy (correct HSN/SAC codes and tax rates applied by the system configuration), and timeliness. Where the ERP auto-generates e-invoices or e-way bills, we also test whether the interface between the ERP and the government's Invoice Registration Portal (IRP) or e-way bill portal is functioning without silent data loss or duplication.
In practice: GST interface gaps are a particularly common finding in organisations that added e-invoicing capability as a bolt-on to an older ERP rather than a natively integrated feature — the reconciliation step is often the only way to catch data that silently failed to transmit.
How does this engagement support our IPO or fundraise due diligence?
Institutional investors and IPO due diligence teams routinely examine the maturity of financial systems and controls as part of their assessment — an unaudited ERP with unknown access risk and unreconciled interfaces is a red flag that can trigger valuation adjustments, specific indemnities, or deal delays. A completed ERP audit with a clean or well-remediated findings history is concrete, independently-verified evidence of control maturity that can be included directly in the data room.
In practice: We package the audit report, management responses, and remediation evidence specifically for data-room readiness when a client tells us a fundraise or listing is on the horizon — the presentation format for an investor audience is different from an internal governance audience.
Do you audit cloud-based/SaaS ERPs differently from on-premise systems?
The core methodology — ITGC, SoD, application controls, interfaces, data integrity — is the same, but the specific testing approach differs. , NetSuite, cloud SAP S/4HANA, Dynamics 365 Business Central), infrastructure-level controls like physical data centre security and underlying network security are the vendor's responsibility under the shared-responsibility model, so we focus our testing on the controls your organisation configures within the application — access, workflow, and configuration — rather than duplicating vendor-level infrastructure assurance (which is typically covered by the vendor's own SOC 2 or ISO 27001 certification, which we review as supporting evidence).
In practice: We request and review the SaaS vendor's SOC 2 Type II report (or equivalent) as part of the engagement — it tells us what the vendor is responsible for and lets us focus our own testing precisely on what your organisation configures and controls.
Where this sits in the wider engagement
ERP & Systems Audit India rarely arrives on its own. The statutory basis and the current requirements are set out on the ERP & Systems Audit India service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On ERP & Systems Audit India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.