3 ms·

> Too easy for someone to use it to cook the books? Maybe it looks better in an audit if they can point to an external source for their accounting software. I

> Too easy for someone to use it to cook the books? Maybe it looks better in an audit if they can point to an external source for their accounting software. I think that is probably a big concern. I read a comment once by someone who said they worked in some kind of company that did financial audits, and it said that as soon as they got a whiff of some homegrown accounting system, the audits got way more expensive, because then they'd have to do a technical audit of the system in addition to the bean counter's audit. If the company ran SAP or some other common ERP system, they didn't have to do that, because it was battle-tested and assumed to be correct.

throwaway13337 6y ago
This is it right here. The magic of these horrible ERP systems is that auditors like them because they've dealt with them before. I've had a similar conversation about such with the owner of a company who wanted to go public on the horizon. Switching to SAP or Oracle is for this reason and this reason alone. It's such a shame that they are so awful and yet this somewhat tiny thing is the deciding factor. I'm sure many companies have fucked up their entire internal systems and, potentially, lost out on moving forward simply because they went with these beasts. Tech turnover has got to be huge when you move to something like this. It's probably not worth it in the end, really. Let the auditors bitch.
- heymijo 6y ago
  Does SAP use its own system?
  - analog31 6y ago
    Excel. ;-)
  - thatsnotmepls 6y ago
    It does.
  - vishnugupta 6y ago
    It’s turtles all the way down.
Naga 6y ago
I'm an external auditor, this is definitely true. Large ERPs have special audits done over their technical systems that we can rely on and not really think too much about whether the system works or not, since another auditor has already signed off that it does.
JaggerFoo 6y ago
I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions. So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided. Cheers
- deleted 6y ago
  [deleted]
- tablespoon 6y ago
  > I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions. > So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided. I'm no expert, but I don't think typical auditors are there to find things like that.
- bsder 6y ago
  > So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided. Oracle/SAP is NOT about whether the system is actually correct. Oracle/SAP IS about whether the system not being correct is the legal liability of someone else.
- Naga 6y ago
  I'm an auditor, and what you're saying is probably fair, but probably not a big deal. I have a lot of clients who either use Excel for their bookkeeping or provide us their full GL in Excel, so we always have the risk of changes being made, but we're not too concerned since our regular audit procedures would uncover it. We're required to obtain an understanding of the control environment (so the ERP system in this case), and if we want to rely on its outputs we have to do dedicated testing over it. You're right though that if you do alter one transaction it's probably not going to come up in the audit samples. There's a bit of a gradient though between how much you alter and how much the auditors care, because auditors deal with things on a materiality basis. The more you manipulate the finances, the more material it becomes and the more we care, but also the more likely it will be uncovered. If you're changing a few trivial transactions we more certainly will never uncover it unless you're really unlucky, but then the effects of those trivial transactions is trivial anyways so it's not really a problem.

throwaway13337 6y ago

This is it right here. The magic of these horrible ERP systems is that auditors like them because they've dealt with them before. I've had a similar conversation about such with the owner of a company who wanted to go public on the horizon. Switching to SAP or Oracle is for this reason and this reason alone. It's such a shame that they are so awful and yet this somewhat tiny thing is the deciding factor. I'm sure many companies have fucked up their entire internal systems and, potentially, lost out on moving forward simply because they went with these beasts. Tech turnover has got to be huge when you move to something like this. It's probably not worth it in the end, really. Let the auditors bitch.

heymijo 6y ago
Does SAP use its own system?
- analog31 6y ago
  Excel. ;-)
- thatsnotmepls 6y ago
  It does.
- vishnugupta 6y ago
  It’s turtles all the way down.

Naga 6y ago

I'm an external auditor, this is definitely true. Large ERPs have special audits done over their technical systems that we can rely on and not really think too much about whether the system works or not, since another auditor has already signed off that it does.

JaggerFoo 6y ago

I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions. So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided. Cheers

deleted 6y ago
[deleted]
tablespoon 6y ago
> I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions. > So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided. I'm no expert, but I don't think typical auditors are there to find things like that.
bsder 6y ago
> So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided. Oracle/SAP is NOT about whether the system is actually correct. Oracle/SAP IS about whether the system not being correct is the legal liability of someone else.
Naga 6y ago
I'm an auditor, and what you're saying is probably fair, but probably not a big deal. I have a lot of clients who either use Excel for their bookkeeping or provide us their full GL in Excel, so we always have the risk of changes being made, but we're not too concerned since our regular audit procedures would uncover it. We're required to obtain an understanding of the control environment (so the ERP system in this case), and if we want to rely on its outputs we have to do dedicated testing over it. You're right though that if you do alter one transaction it's probably not going to come up in the audit samples. There's a bit of a gradient though between how much you alter and how much the auditors care, because auditors deal with things on a materiality basis. The more you manipulate the finances, the more material it becomes and the more we care, but also the more likely it will be uncovered. If you're changing a few trivial transactions we more certainly will never uncover it unless you're really unlucky, but then the effects of those trivial transactions is trivial anyways so it's not really a problem.