ERP Migration, a Switched-Off Audit Trail and a Year-End Cut-Off Problem

SA 315 (Revised) requires the auditor to understand the entity's IT environment - applications, infrastructure, IT personnel and IT policies - and to identify risks arising from the use of IT. Here that understanding directly generates the risks:

• Revenue cut-off (significant risk). 8% of Q4 sales invoiced in the last five days with April dispatch dates is a quantifiable population pointing to premature recognition. Revenue recognition is anyway a presumed fraud risk under SA 240, so this is a significant risk at the assertion level (occurrence/cut-off).
• Management override through manual journals (significant risk). 4,200 manual entries in one quarter in a ₹180 crore company is abnormal volume; combined with a shared login, entries cannot be attributed.
• Vendor master manipulation. One login used by three people to both create and approve vendors removes segregation of duties - the classic route to fictitious vendors and undisclosed related-party purchases.
• Loss of audit trail. With the trail off from October to December, the entity cannot evidence who created, changed or deleted transactions in that window. This is also a breach of the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 and is reportable under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014.
• Migration and IT personnel risk. Two of four IT staff leaving mid-migration, and a late go-live, raise the risk of incomplete or inaccurate master and opening-balance data and of unmanaged programme changes.
• Inventory with job workers (significant risk). Existence is supported only by a plant accountant's spreadsheet; there is no system control and no third-party evidence (SA 501).

The vendor's "validation certificate" is not audit evidence about the controls as operated at this entity, and it certainly does not address the audit-trail gap or the shared login.

Because the audit trail is unavailable and segregation is absent, the relevant controls cannot be relied on for the affected assertions, so control risk is assessed high and the response is substantive and year-end weighted (change in timing), with extent increased through full-population rather than sample testing where the data permits.

• Revenue: three-way match of invoice, dispatch and customer acknowledgement on the full year; focused testing of the last five days of March (and the first days of April) against e-way bills, transporter documents, GSTR-1 for April and post-year-end credit notes and returns; review of the 8% population for pattern (same customers, same approver).
• Manual journals: extract the entire population using the ERP tables and filter for round amounts, postings after hours or on holidays, the shared purchase login, post-closing entries and unusual account combinations; obtain support for each selected item. Use CAATs, since the volume makes manual selection impossible.
• Vendor master: extract the master and the change log (if the old system retains one), and test for duplicate bank accounts, PAN/GSTIN, addresses matching employees or directors, vendors created and paid within days, and vendors with no purchase order history.
• Inventory at job workers: direct confirmation from each job worker (SA 501), reconciliation of the Excel sheet to the ERP and to dispatch/receipt records, and physical inspection or attendance at the job worker's premises for material quantities.
• Migration: consider using an IT specialist (SA 620) to test the completeness and accuracy of migrated balances and the state of the audit trail, and to extract the journal population.
• Interim reliance: drop it; extend procedures to 31 March 2026.

Report the audit-trail deficiency and the resulting internal control weaknesses in the auditor's report under section 143(3)(i) and Rule 11(g).

He is wrong on three counts.

First, SA 315 requires the auditor to obtain an understanding of the entity's system of internal control, including the design and implementation of controls relevant to the audit, irrespective of whether controls will be tested for operating effectiveness. That is why the walkthrough revealing the shared login and the audit-trail gap is part of risk assessment, not optional work.

Second, for a listed company, section 143(3)(i) requires the auditor to report on the adequacy and operating effectiveness of internal financial controls over financial reporting. That opinion cannot be formed without testing operating effectiveness; a purely substantive audit gives no basis for it. If the controls are as weak as they appear, the auditor must consider whether an adverse or qualified IFC comment is required and how that interacts with the audit opinion.

Third, even under a substantive approach, SA 330 requires substantive procedures for every material class of transactions, account balance and disclosure, and requires procedures relating to the financial statement closing process and to journal entries.

The auditor must therefore: document the understanding obtained and the assessment of control risk; document why controls were not tested and the resulting increase in substantive work; and communicate the deficiencies in internal control to those charged with governance under SA 265, in writing.