ERP Audit Consultant, Germany

Not a Wirtschaftsprüfer audit, and not a tax field audit

German companies know several kinds of audit already. The Wirtschaftsprüfer audits the annual financial statements where that is required. The tax office may carry out a field audit and look at the bookkeeping and its data. The Steuerberater reviews and often prepares the returns. An ERP audit is none of these. It is a structured, independent review of whether the system, as set up and as people actually operate it, still suits the business, and whether its outputs can be trusted.

Why commission one? Perhaps a new managing director or CFO wants to know what they have taken over. The system house that implemented the ERP is no longer involved. A group parent wants assurance before rolling the same setup out to other entities. Or the finance team simply spends too much time on corrections, exports and side calculations.

I work from evidence: walkthroughs with key users, configuration and role exports, samples of real postings and documents, and the outputs your advisor receives. Each finding states the cause, the business effect and a recommended action. Wherever a point touches GoBD interpretation, tax, labor law or data protection, it is written as a question for the competent advisor, never as a ruling from me. Behind all of this sits the method from my ERP health check.

Procedure documentation, posting locks and archiving

German bookkeeping principles, often summarized as GoBD, expect records to be complete, traceable and protected from silent change, and they expect a description of how the system and its surrounding procedures work. Whether your setup meets those expectations is for your Steuerberater or auditor to judge. What an audit can do is test whether the system behaves the way your documentation says it does.

I start with the procedure documentation, if one exists, and compare it with reality. Typical gaps are interfaces added after the document was written, new document types, changed approval steps, or archiving routines that moved to a different tool. Each difference is listed so the document can be updated, by your team or your advisor.

Then I look at the system itself: when postings are locked, who can still change or delete entries before that point, how corrections are recorded, and whether reversal is used rather than overwriting. I check that incoming and outgoing documents remain linked to the postings they support and can be retrieved later, including where a separate archive or document management system is involved. I also note any user with rights wide enough to bypass these controls. The result is a set of findings your advisor can review with evidence attached, rather than a general reassurance that the system is compliant, which nobody outside your advisor should give.

The DATEV handoff, tax keys and incoming e-invoices

For many German companies the most important output of the ERP is the export the Steuerberater imports into DATEV. If that export needs manual correction every month, the cost is hidden in the advisor's invoice and in the finance team's time. I ask for a recent export and, with the advisor's help, a list of the corrections made after import. Each correction is traced to its cause: an account mapped incorrectly, a tax key missing or wrong, cost centers not transferred, or postings summarized in a way the advisor has to unpick.

The same review covers the advance VAT return. I lay out tax keys and codes with sample postings and the lines they reach, so the advisor can confirm or correct the setup quickly.

Incoming e-invoices are the third part. With German business-to-business invoicing shifting to structured formats, more suppliers now send XRechnung or ZUGFeRD files. I follow a sample from arrival to posting: where they land, whether the structured data is read or the invoice is retyped from a visual copy, how they are matched to orders and receipts, and whether the original file is kept with the record. Which obligations apply to you, and when, is for your advisor to confirm. Fixes that need interface work are described on my ERP integration page.

Roles, the works council agreement and deletion rules

Access rights are reviewed in two directions. First, against the duties a German company would normally keep apart: maintaining supplier bank details and releasing SEPA payment runs, approving purchase orders and posting invoices, posting manual journals and closing periods. Conflicts, dormant users and shared logins are listed with a remedy for each.

Second, if the ERP falls under a works council agreement, against what that agreement and the material given to the council describe. Over time, new reports, dashboards and logging features may have been switched on without anyone checking whether they fall within what was agreed. I record the differences factually. Whether any of them need to be discussed with the Betriebsrat is for HR and management to decide with their legal advisors.

Data protection forms the third strand. German companies often have a deletion concept that must be balanced against retention duties under commercial and tax law. I document what personal data the ERP holds about employees, customers and suppliers, who can see it, and whether any deletion or blocking routine actually runs. The data protection officer and legal advisors judge what should change. Payroll usually runs outside the ERP with the advisor or a provider, so I check only how payroll journals arrive, which accounts and cost centers they hit and who can read salary data.

When the BWA and the ERP disagree

A telling sign in German companies is a management team that reads the Steuerberater's BWA instead of the ERP's reports, because the two never quite match. I take the key figures management uses, such as revenue by segment, gross margin, stock value and overdue receivables, and reconcile a sample between the ERP, the advisor's evaluation and any spreadsheets in between. The differences usually come from timing, accruals posted only by the advisor, missing cost prices or definitions nobody wrote down.

I also catalog the spreadsheets finance and operations maintain every month and classify why each exists. Some are sensible. Many exist because a report or configuration was never finished, and those become candidates for ERP optimization.

License usage closes the review: users who have left, full licenses for occasional viewers and modules that were licensed for a rollout stage that was later dropped. Management receives a brief verdict on the system's overall condition, then each finding with its priority and suggested remedy; open points for the Steuerberater, auditor, data protection officer and HR sit in their own annex. The readout happens online, and a visit can be arranged. Should the review uncover an implementation that is still failing, read about ERP rescue in Germany. For everything else I do for German firms, start from ERP consulting in Germany or the Germany hub.