ERP revenue-cycle control deficiencies and audit reliance after an interface failure

The customer master file lacks a unique customer identifier: 12 customers sharing one national ID creates a risk of duplicate or fictitious customers, credit-limit splitting, and revenue recorded for invalid parties. Sales representatives can change credit limits, which defeats segregation between sales and credit approval and allows orders to bypass the credit check. The 8,000 million shipment to a customer with a 500 million limit shows either an override or a failed automated control; the risk is uncollectible revenue and overstated sales. The interface failure created a gap between goods issue and the general ledger, and the 6,000 million manual spreadsheet posting lacks a visible reconciliation and approval trail. The risk is incomplete or duplicated revenue, cut-off errors, and unauthorized journal entries. Password-only security does not address access rights, change management, or logging. The auditor cannot treat the automated controls as effective without evidence that they operated throughout the period.

The auditor should not rely solely on the automated controls or reduce substantive testing to a low level. The deficiencies are significant enough that a control-reliance strategy is not supported unless the auditor tests the design and operating effectiveness of the revised controls, including IT general controls over access and change management. The auditor should use CAATs to compare the customer master file with the national ID registry or sales records, identify duplicate IDs and shared addresses, and list all credit-limit changes by sales representatives. The auditor should extract the order-to-cash file and test whether every shipped order passed the credit check, recalculating limits and flagging overrides.

For the interface, the auditor should reconcile goods-issue records to invoice and general-ledger postings for the three failed nights, inspect interface error logs, and test the manual spreadsheet posting to source documents and approvals. Substantive procedures should include expanded sales cut-off tests, accounts receivable confirmations, subsequent cash receipts, and tests of returns and credit notes. The auditor should also test whether the IT director's refusal to provide a control report prevents reliance on IT controls and document that limitation.

The manual posting is a high-risk journal entry. The auditor should trace the 6,000 million to the underlying goods issues, invoices, and customer orders; determine whether it duplicates amounts later posted by the interface; verify who prepared and approved it; and check whether the spreadsheet is controlled, versioned, and reconciled to the ledger. If the posting cannot be supported, it should be proposed for adjustment. The interface failure also requires a review of all transactions during the outage, not only the manual entry, because some invoices may be missing or duplicated.

The IT director's assertion that passwords make the system secure is not sufficient. Passwords are only one access control; the company also needs role-based access, segregation of duties, change management, logging, and monitoring. The refusal to provide a service organization control report limits the auditor's ability to rely on IT controls. The auditor should report the control deficiencies to those charged with governance, recommend a customer master-file clean-up, removal of credit-limit access from sales, a controlled interface reconciliation, and approval controls over manual entries. Until remediated, the auditor should expand substantive testing and consider whether the deficiencies constitute a material weakness.