ERP Audit, South Africa

How an ERP audit differs from your audit or review

In South Africa, the word audit already has a defined meaning for most companies. Depending on the company's profile, its annual financial statements are either audited by a registered auditor or independently reviewed, and SARS may examine tax matters separately. An ERP audit is none of those things.

It looks at the system: how it is configured, how data moves through it, who can do what, and whether the way people use it supports the business as it runs today. It does not express an opinion on your financial statements or your tax affairs. Where a finding touches tax or financial reporting, I write it up as a question for your accountant or auditor, with evidence attached, and leave the conclusion to them.

Good moments to commission the review include the period after a move from Sage, Pastel or another desktop package, the arrival of a new financial director, plans to add branches or another entity, rising license costs, or a feeling that the business has drifted back to spreadsheets. If the implementation itself is stuck or the go-live went badly, the ERP rescue page for South Africa describes the more urgent engagement.

VAT configuration and the path to each SARS return

The quality of a VAT return depends on how every invoice, supplier bill and import was captured in the months before it. During the audit, I follow that path for a sample of real transactions and document what the system did. Your accountant or registered tax practitioner then confirms whether the treatment is right.

The trace normally covers:

• how standard, zero-rated and exempt supplies are coded on items, services and customers, and how often staff override the default
• how export sales are recorded and whether the supporting documents your accountant needs are linked to them
• how import VAT from customs documents is captured, separately from the supplier invoice and clearing agent charges
• how credit notes, debit notes and adjustments flow into the return period
• whether finance prepares the return straight from system reports or reworks it offline first, and why figures differ

Each point goes into a separate question log for your accountant, so tax judgments are never mixed up with configuration fixes. When the answers come back, I can translate them into specific setup changes for your implementer or internal team. Readers wanting the general approach can find it under ERP health check.

Payroll journals, supplier data and personal information

South African companies frequently run payroll through a dedicated provider or package, which calculates PAYE, UIF, SDL and other deductions. The ERP receives the outcome. The review confirms which accounts, cost centers and entities those postings reach, whether the deduction liabilities are settled cleanly, and whether finance agrees payroll totals to the books monthly instead of finding gaps when the year closes.

Supplier data deserves its own attention. Where a company tracks its B-BBEE position, procurement reporting depends on reliable supplier classifications, valid supporting documents with their expiry recorded, and trustworthy spend figures. The audit looks only at data quality: how many active suppliers have complete, current records, who updates them, and whether spend reports draw from the ERP or from a separate list. Scorecard strategy stays with your specialist advisors and verification agency.

Personal information comes under POPIA. I note who can view, edit and export employee, customer and supplier personal details, whether former employees still have access, and whether exports are controlled. Your information officer or legal advisor decides whether any of this amounts to a compliance issue; the audit gives them a clear factual picture to work from.

Outages, connectivity and integration risk

Scheduled power cuts and uneven connectivity turn resilience into a practical ERP question in South Africa. A cloud ERP may be fine while the internet works; the issues appear at the edges, when a warehouse loses power mid-dispatch or a branch drops offline during invoicing.

I ask each site how it works during an interruption and then look for traces in the system: documents captured twice, stock movements posted after the goods have left, gaps in numbering, and integrations that failed during the outage and never retried. I also review backup arrangements for any locally hosted components and for critical spreadsheets that live outside the system.

Integrations get a full inventory: bank feeds and payment files, payroll imports, point-of-sale, ecommerce, logistics and BI tools. Each entry records the data carried, the schedule, the owner and the way a breakdown would currently come to light. A connection that fails silently is especially costly, because errors accumulate unseen until a report looks wrong.

Findings in this area tend to lead to modest fixes, such as clearer offline procedures, retry and alert settings, or a decision to move one function to an app that handles disconnected work better. On their own, they seldom justify a new system.

Spreadsheets, license costs and the findings report

Part of the review is a register of the workbooks kept outside the ERP: the debtors list collections actually works from, the stock planning file, the commission calculation, the branch profitability model, the board pack. Every workbook on that register points to a need the ERP is failing to cover. Taken together, they show where the leadership team no longer relies on system figures, and why.

License costs deserve a hard look in South Africa because ERP and add-on subscriptions are often priced in dollars, so the rand cost moves with the exchange rate. I compare paid users, editions and add-ons with real activity, and flag seats for former staff, premium tiers bought for a single feature and overlapping apps that do the same job.

Findings are sorted by the harm they do and how soon they need fixing. For every item it records what is happening, the business consequence, the probable cause and a practical remedy, along with a proposed owner: your team, your implementer, your accountant or another advisor. I take leadership through it in an online session and leave a sequenced action plan. The ERP optimization page describes follow-on work, and the South Africa overview and ERP consultant page for South Africa cover my wider work there.