ERP Audit Consultant, USA

An ERP audit is not a financial statement audit

In American business, audit usually means the CPA firm's annual engagement, so the term needs a careful boundary here. Your outside CPA firm audits or reviews your financial statements and issues a report on them. If you are a public company, or preparing for a sale or an IPO, there may also be formal internal control requirements that your auditors and legal advisors define. None of that is what I do.

An ERP audit, in the sense I use it, is an operational review of the system itself. It covers questions such as:

• Does the configuration match how each entity, location and team really works today?
• Are tax, payroll and banking connections set up so that finance does not have to patch results by hand?
• Who can change what, and would anyone notice if they did?
• Which reports can be trusted as they come out of the system?

The findings can make conversations with your auditors easier, because you arrive knowing where the weak spots are. They are not an assurance opinion, they carry no sign-off and they should not be presented to lenders or investors as one. If a finding touches accounting treatment or tax, I say so and recommend that your CPA confirms it. My ERP health check service covers the method in general terms; what follows is how it plays out for a US business.

Sales tax, payroll and banking touchpoints

In a US system, the setup that most often drifts away from reality sits where the ERP meets tax, payroll and the bank. I do not decide your tax position. I document what the system does and turn anything doubtful into a specific question for your CPA or tax advisor.

• Sales tax. Whether customers in states where you now collect tax are coded correctly, how exemption certificates are stored and renewed, how shipping and service lines are treated, and whether the tax engine, if you use one, receives the right product codes. Marketplace orders and drop shipments get their own sample checks.
• Vendor tax data. Whether contractor records carry the details needed for year-end information reporting, and who can edit them.
• Payroll. How journals from your payroll provider land in the ledger, whether departments and projects are mapped, and whether accrued wages and benefits reconcile.
• Banking. ACH and check payment runs, positive pay files, bank feeds and reconciliation rules, including who can change a vendor's bank account before a payment run.

Each observation records the evidence, the likely cause and the person who should confirm it. Where the fix is configuration, it goes on the work list. Where it is a tax judgment, it goes to your advisor with the evidence already gathered.

Who can do what: access and segregation of duties

Access rights tend to grow quietly. A controller covers for someone on leave and keeps the extra permissions, a consultant account from the original project stays active, and a shared login appears because buying another license felt like a hassle. None of this looks serious until money moves in a way nobody approved.

The access review looks at combinations of permissions rather than single roles. The pairs that matter most are:

• Creating a vendor and approving payments to that vendor.
• Changing vendor bank details and releasing a payment run.
• Posting journal entries and approving or reversing them.
• Editing customer credit limits and releasing held orders.
• Adjusting inventory quantities and approving the resulting write-offs.

Smaller US finance teams often cannot split every duty between different people, and that is a normal situation. In that case I suggest compensating steps, such as a weekly review of vendor master changes or a report of manual journals above a threshold your controller sets, so the risk is visible even when the same person does several jobs. The output is a short matrix of who holds which risky combination, with a recommended change for each and an owner who agrees to make it.

Integrations, spreadsheets and reports nobody fully trusts

A typical US ERP sits in the middle of a crowd of other tools: an ecommerce store, a CRM, a shipping platform, a payroll provider, retailer EDI connections, a banking portal and often a BI tool. Each connection was set up for a reason, but few have a named owner, and failed syncs can sit unnoticed for weeks.

I list every integration with its direction, frequency, owner and error handling, then look at the logs or error queues for recent failures. Alongside that sits a spreadsheet inventory. Every workbook that finance or operations uses to finish a process is evidence of a gap, whether it is a commission calculation, a sales tax true-up or a cash forecast built from exports.

Reports get the same treatment. I take the reports leadership and lenders rely on, such as margin by customer, inventory valuation, borrowing base inputs and AR aging, and trace each figure back to the ledger. A report that needs manual adjustment every month is a finding, with the cause noted: a mapping error, missing data, a definition nobody agreed or a genuine product limitation. For deeper work on connections see ERP integration, and for rebuilding the management view see ERP management dashboards.

From findings to action, delivered remotely

The final report opens with a summary written for leadership: the overall state of the system, the risks that need attention soon and the improvements likely to pay back fastest. Detailed findings follow, each rated by impact and effort and labeled as a quick fix, partner work, a process change or a decision for leadership.

What happens next is your choice. Many findings can be closed by your own team. Others become a scoped piece of work for your current partner, and the report gives them a clear brief instead of an open-ended request. If the system is broadly sound but underused, the natural next step is ERP optimization. If the review shows that a recent go-live has left the business struggling, my ERP rescue consultant page for the USA explains how a recovery is run.

The audit is delivered remotely. Walkthroughs happen by video in hours that suit your main time zone, users can record tasks for later review, and I work from read-only access and exports wherever the platform allows. On-site time is possible by arrangement but rarely necessary. My only fee comes from you, never from a software publisher or VAR, so nothing in the report is there to sell additional licenses. Other ways I help American companies are listed under ERP consulting in the USA, with market context on the US hub.