• Search in Protiviti.com

No Audio
⏸

Transforming the Enterprise: How to Guide an ERP Implementation to Success

Audit considerations

Typically, the company’s external and internal auditors will be concerned about aspects of the system implementation that could potentially result in significant disclosure errors due to data integrity issues. Data conversion, system testing (including key reports), and security/segregation of duties are primary focal points.
In particular, the auditor will seek to confirm that the business has tested the data conversion comprehensively. Given the potential severity of the impact of an unsuccessful conversion, most organisations attempt to meet auditor requirements in one or more mock conversion testing cycles prior to go-live. Evidence that will be of utmost interest include:

  • Formal sign-offs from management on the data conversion strategy and plan
  • Data conversion designs and attribute-mapping documents in sufficient detail
  • Validation procedures for each conversion object
  • Validation of the conversion results for completeness and accuracy in both the pre-production (UAT) and production environments

In general, the auditor will select a sample of transactional objects — and, potentially, master data objects — to perform detailed analysis of the data conversion validation and reconciliation. While it is generally preferred to check data populations completely, large data sets might require checksums or selective sampling. Assess these decisions diligently on a case-by-case basis. The business must maintain an audit trail of the reconciliation between the source system files, the conversion files resulting from any manipulation of the source files, and the target system files.

Stay engaged in system testing cycles prior to UAT

UAT represents the final and most important testing gate for a system implementation and is the ultimate expression of business ownership and readiness. However, the more the business is engaged in earlier system testing cycles, the more it’s proven to increase the effectiveness of the go-live solution and the readiness of users to adopt the solution with confidence. To that end, we recommend that the business embrace the following activities even in prior cycles such as system integration testing, and to a lesser extent with conference room pilot tests:

  1. Verify that the overall test plan is comprehensive and covers all business requirements (i.e., tying the testing schedule to a requirements traceability matrix)
  2. Achieve consensus among the process owners, the system integrator and the external auditor on documentation standards for testing
  3. Sample the testing documentation preemptively for each process, checking for quality (“Does the test scenario cover the business requirement comprehensively?”) and consistency of the recorded results with the supporting evidence (evidence must be retained)
  4. Ensure sign-off on test results by the appropriate stakeholders
Loading...