ERP Audit Consultant, Singapore

An ERP audit beside your external auditor, not instead of one

Singapore companies are used to audits in the accounting sense: the external auditor's work on the financial statements, and for many groups an internal audit or a review requested by a parent or investor. An ERP audit has a different subject. It examines the software, how it is set up and how people use it, and asks whether the system is fit for the business you run now.

That makes it complementary. Your external auditor tests balances and controls for the purpose of an opinion on the accounts. I look at why the system produces the balances it does, where people intervene manually and which configuration choices create recurring effort at period end. My report expresses no view on the financial statements or on your tax position, and should never be read as doing so.

Common reasons to commission the review include a new regional CFO who needs to understand the inherited setup, a planned expansion into another Southeast Asian market, a parent company pushing its own template, or year-end closes that take far more effort than they should. If the system never stabilized after go-live, the ERP rescue page for Singapore describes the more urgent engagement.

Multi-entity and intercompany: where group numbers go wrong

Singapore headquarters frequently control entities across the region, every one with its own currency, tax regime and often its own local accountant. The ERP may hold all of them, some of them, or none beyond Singapore. The audit starts by drawing that landscape as it really is, including the entities kept in a separate local package.

I then follow typical group transactions end to end. Take a management fee that Singapore bills to a subsidiary: it should create a matching receivable and payable, in the right currencies, with the right tax treatment on each side. A shared software subscription recharged across entities should be allocated the same way every month. In practice, one side is often posted late, at a different rate or not at all, and someone fixes the difference before consolidation.

Findings in this area usually fall into three groups: master data that differs between entities, such as charts of accounts or intercompany partner codes; process timing, where one entity closes before the other has posted; and design gaps, where the ERP could automate the mirror entry but nobody switched it on. Each one is listed with its effect on group reporting. For design options, see my notes on multi-currency ERP setups.

GST, InvoiceNow and payroll postings: questions for your advisors

GST in Singapore is administered by IRAS, and InvoiceNow, which runs on the Peppol network, is becoming part of how invoices are exchanged. I do not interpret GST rules for you. What I do is show your tax advisor exactly what the system is doing, with examples, so their review is fast and specific.

Areas I typically document include:

• how tax codes are assigned to items, services and customers, and whether staff override them at invoice level
• how imported services and overseas supplier invoices are handled, where reverse charge or similar rules may apply to you
• which documents are sent and received through InvoiceNow, through which access point, and what happens to rejections
• whether credit notes and amendments follow the same electronic path as the original invoice
• how GST reporting is produced: directly from the ERP or reworked in a spreadsheet first

Payroll gets a similar check. Many Singapore companies run payroll in a separate tool or with a provider that calculates CPF contributions. I confirm that payroll journals arrive in the right accounts and cost centers for each entity, and that someone reconciles them. Every tax or payroll question goes into a separate advisor log, never mixed with configuration fixes.

Connected apps, access rights and personal data

Singapore businesses tend to adopt cloud tools quickly. Sales runs in one app, expenses in another, payroll in a third, and a BI tool pulls from all of them. Each connection was set up by someone who may since have moved on. The audit builds a single inventory: what connects to the ERP, which direction data flows, how often, under whose credentials and what alert fires when it fails.

I pay particular attention to silent failures. An expired authorization, a renamed field or a changed API version can stop a sync without warning, and the first sign is a report that looks slightly wrong weeks later. For each connection, I note how failure would be detected today.

Access rights get the same treatment. I export users and roles, compare them with the current organization chart and test sensitive permissions such as editing supplier bank details, approving one's own purchases, reopening closed periods and viewing salary data. Because personal data in employee and customer records falls under the PDPA, I also note who can export that data and from where. Whether any finding creates a compliance obligation is for your data protection officer or legal advisor to decide; I describe the exposure clearly so they can.

Licenses, reports and the prioritized findings report

Subscription ERPs and their surrounding apps are often licensed per user, per entity and per edition. After a period of growth, it is common to find paid seats for people who have left, premium editions bought for one feature nobody uses, or a separate license for a tool whose job the ERP could now do. I compare what you pay for with what each entity actually uses, so the next renewal is a decision rather than a default.

Reporting is the other half of trust. I ask leadership and each finance team which reports they rely on, then check where those figures come from. Board packs assembled from exports, cash forecasts kept offline and entity results adjusted by hand before consolidation all point to configuration or data issues that can be fixed at the source.

The final report ranks every finding by business impact and urgency. Each one states what is happening, why it matters, its likely cause and a recommended action, with a suggested owner: your team, your implementer or an advisor. I walk leadership through it in a single remote session and leave a sequenced plan behind. The general method is on my ERP health check page, and follow-on work is covered under ERP optimization. The Singapore overview and ERP consultant page for Singapore describe my wider work there.