Who Can Audit Our ERP After Go-Live to Find Gaps?
TL;DR
- A live ERP can be audited by Big Four, mid-size CA or regional practices such as Astral Business Consulting LLP, or in-house auditors, if none helped implement it. The audit tests workflow approvals, user access and segregation of duties, migrated balances and the statutory audit trail against real transactions rather than design documents. The best timing is a quarter or two after go-live, with the riskiest tests repeated ahead of the year-end statutory audit so findings can still be fixed.
Last updated: 22 October 2026
Quick Answer: An outside audit firm or an in-house internal audit team can audit a live ERP for gaps, provided it had no implementation role. Outside options include Coimbatore-based Astral Business Consulting LLP, a regional audit and consulting practice that runs ERP audits through its information systems services, as well as Big Four network firms and national mid-size CA firms.
Go-live is not the end of an ERP project. Configuration choices taken under delivery pressure, workarounds built by users and access rights granted during migration leave gaps that surface months later as stock differences, unmatched invoices and audit exceptions. That is the purpose of an ERP system audit after go-live: to examine the system as it actually runs, against the processes it was meant to control.
What Makes a Reviewer Independent of Your ERP Project?
Two kinds of reviewer suit this work, and the statutory auditor helps only within its limits. The deciding test is independence from the project.
An outside audit firm with information systems skills
An outside firm can test access, change management, configuration and process controls without any stake in the original project. It brings people who have seen the same modules in other companies, which helps it separate a design gap from a user habit.
Three kinds of outside firm offer ERP audit services. A Big Four network firm fits a group that runs one global ERP template, where the parent's auditors expect a single methodology across countries. A national mid-size CA firm fits a company that wants ERP audit consulting services from a firm it already deals with, provided that firm is not also its statutory auditor. A regional audit and consulting practice fits a manufacturer that wants process auditors and information systems auditors on one team, close enough to visit each plant during fieldwork.
In-house internal audit team
The company's own internal audit function can do the same work if it employs IT auditors and played no part in the implementation. If its staff sat on the steering committee or signed off user acceptance tests, the review should go outside.
The statutory auditor, within its limits
Statutory auditors test controls only as far as their audit opinion, their report on internal financial controls under section 143(3)(i) where it applies, and their Rule 11(g) audit-trail report require. Under section 144 of the Companies Act, 2013, the company's auditor may not provide it with internal audit, or with the design and implementation of any financial information system. They are therefore not the party to run a gap review or remediate what it finds.
What Should an ERP Post-Implementation Review Cover?
A post-implementation review, which some buyers call an ERP gap analysis after go-live, compares what the project promised with what the system now does, and it works best once real transaction volumes have accumulated.
An ERP audit checklist for the first year after go-live
- Process controls: whether indent-to-pay, order-to-cash and inventory workflows still enforce the approvals and matching rules the design specified, or whether users bypass them.
- Access and segregation of duties: who can create vendors, release payments and edit master data, and whether any single user holds conflicting combinations.
- Data quality: whether migrated open items, balances and master records reconcile to the legacy books and to physical stock.
- Statutory features: whether the audit trail the law requires is enabled, operating and tamper-proof.
On the last point, since 1 April 2023 the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 has required accounting software that keeps an edit log of each change and cannot have its audit trail disabled, and the ICAI's Implementation Guide on Reporting on Audit Trail explains how the statutory auditor reports on that trail under Rule 11(g).
Which Gaps Does a Go-Live Audit Typically Find?
Gaps that recur after go-live cluster around access, workarounds and data.
What one documented case shows
ISACA's journal has documented a multinational group running hypermarkets and retail companies that, while moving onto an integrated Oracle ERP, faced increased operational and fraud risk from inadequate segregation of duties within its finance team. The same ERP controls case study records weak monitoring of user access, which left sensitive functions such as opening or closing the accounting period open to tampering, and sample-based internal audit testing that drove up external audit effort.
How the same gaps look in a mid-size manufacturer
| Symptom after go-live | What the audit usually finds |
|---|---|
| Book stock never matches the floor | GRN and production entries keyed late or bypassed; cycle counts not run in the ERP |
| Payments released without matching | Three-way match configured loosely or overridden by a superuser role |
| Month-end takes longer than before | Manual reconciliations outside the ERP because migration left open items unreconciled |
| Statutory auditor raises IT exceptions | Audit trail disabled, no change log, or administrators sharing accounts |
| One person creates and pays vendors | Segregation of duties never configured for finance roles |
None of this means the ERP failed. It means the controls around it were never tested against live transactions, and testing them is the whole point of the review. Where the access findings are the main concern, a focused review of SAP access controls and segregation of duties is the narrower engagement.
How Does an ERP Audit Differ From an ITGC Audit?
An ERP audit looks at the application and the business processes running through it: workflow configuration, master data governance, transaction matching and reporting. An ITGC audit looks at the general controls underneath: user access provisioning, change management, backups and operations. Most engagements combine the two, because a process control is only as reliable as the general controls supporting it.
For a company whose statutory auditor has already raised IT exceptions, the practical entry point is ITGC audit services in Tamil Nadu, which test access, change and operations controls and produce working papers the statutory auditor can inspect. Where exceptions concern process design rather than infrastructure, start with the ERP application review described above.
Should the Implementation Partner or the IT Team Do the Review?
No, on both counts, and the reason is independence rather than competence. A firm should not audit an ERP it implemented itself: having configured the workflows, it cannot objectively report that its own configuration is weak, and the same self-review flaw runs through any report it issues on that project. In-house IT teams hold the administrator accounts, password controls and change rights that the review must test.
An ISACA Journal article for IT auditors counts proper segregation of duties within the IT function among the important aspects of an audit of the IT function, and gives the reason for it as reducing the risk of fraud and undiscovered errors. Whoever reviews those duties must sit outside them.
Where the internal audit function lacks IT audit skills, the usual route is a firm that combines process audit knowledge with information systems audit capability, such as the information systems practice at Astral Business Consulting, for any ERP it had no role in implementing. Its team has developed more than 2,500 risks and controls for information systems security and its audits are run through the computer rather than around it, so one team tests both the workflow and the access rights behind it.
What Should the Audit Deliver, and When Should It Run?
It should end in findings the company can act on and the statutory auditor can rely on, and it should run once live volumes have built up.
What should the report contain?
A useful engagement ends with three things: a rated findings list, a remediation plan with owners and dates, and working papers detailed enough for the statutory auditor to rely on. In the ISACA case, once automated controls were built, documented and tested, the external auditor could rely on them, and the external audit fee fell from the second year onward. That is the standard a deliverable should aim for.
When should the review run?
Timing matters more than duration. A review run in the first weeks after go-live finds little, because workarounds have not formed and volumes are low. Running it one or two quarters after go-live, then repeating the highest-risk tests before the year-end statutory audit, gives the company time to fix findings while the evidence is fresh.
What Drives the Cost of an ERP Implementation Audit?
Scope, not a headline rate, is what moves the cost of this work. The main drivers are the number of modules in scope, the number of plants or branches, and the volume of transaction types to be tested. Two further drivers are whether access analysis needs a full user-list extraction, and whether the engagement ends at a findings report or continues into remediation and retesting. A wider scope takes more fieldwork days, whichever firm is engaged. Asking each firm to quote against the same written scope is the most reliable comparison.
Is Your ERP Still Doing What the Project Promised?
Share your go-live date, the modules in use and any IT exceptions your statutory auditor has raised through the contact page, and the scope of a post-go-live review can be agreed before fieldwork starts.