The ERP Rollout and the Missing Controls
Sundarban Distributors Ltd is mid-way through an ERP implementation. To meet a go-live date, the project team migrated master data with 'temporary' access rules: the warehouse supervisor can both create purchase orders and approve goods receipt; the accounts payable clerk can create a new supplier and approve an invoice for that supplier; and the old system remains live in 'read-only' mode but is still used by two staff to post adjustments. The CFO has been told that 'segregation of duties will be fixed in phase 2'. In the first month post-go-live, three duplicate supplier payments were made, totalling Tk 2,300,000, and inventory records show a Tk 1,100,000 variance against physical count.
1. Identify the control failures and explain how they permitted the observed losses.
Read the worked answer
Control failures:
- No segregation of duties (SoD) in purchasing. The warehouse supervisor can create a PO and approve goods receipt. This allows a single person to create a purchase, receive it, and create the basis for payment with no independent check - a classic fraud and error enabler.
- No SoD in payables. The AP clerk can create a supplier and approve an invoice for that supplier. This permits fictitious suppliers, duplicate suppliers, and self-approved payments - directly explaining the three duplicate payments (Tk 2,300,000).
- Ghost system in use. The 'read-only' legacy system is still being posted to by two staff. Adjustments made outside the controlled environment bypass the new system's audit trail and reconciliation, which plausibly explains the Tk 1,100,000 inventory variance - postings in the old system are not reflected in the new one, so records diverge from physical reality.
- Deferred remediation. 'Phase 2' is not a control date; it is an aspiration. Controls deferred past go-live are controls absent at go-live.
Link to losses: the duplicate payments are the predictable output of the payables SoD gap; the inventory variance is the predictable output of dual-system posting without reconciliation. Neither is a surprise - both are the textbook consequences of the specific gaps.
2. Recommend an immediate remediation plan, distinguishing compensating controls from permanent fixes.
Read the worked answer
Immediate (compensating) controls - within days:
- Remove conflicting access now. Revoke the AP clerk's supplier-creation right and the supervisor's goods-receipt approval right. This is a configuration change, not a project - it does not require phase 2.
- 100% manual review of new suppliers and payments above a threshold by the financial controller until system SoD is in place.
- Freeze the legacy system. Disable posting rights for the two staff; require all adjustments to be routed through the new system with documented approval. Reconcile legacy-to-new balances immediately and investigate the Tk 1,100,000 variance to root cause.
- Recover the duplicate payments - contact suppliers, issue debit notes, and log the recovery.
Permanent fixes - within the quarter:
- Role-based access matrix designed from the process, not from the org chart, with SoD rules enforced in the ERP and tested before go-live of each phase.
- Automated duplicate-invoice detection (supplier + invoice number + amount + date matching) and three-way match (PO, GRN, invoice) enforced system-side.
- Periodic access reviews (quarterly) signed off by the CFO.
- Post-implementation review with an audit trail of every change.
Governance point for the board: the go-live decision traded control for speed, and the Tk 3,400,000 of observed losses is the price. The board should require that no further phase goes live until SoD testing is signed off by internal audit, and should minute that decision.