Internal controls & audit trail

1. Why internal controls matter

Internal controls are essential for:

• Fraud prevention: Stopping unauthorized or malicious actions.
• Error detection: Catching mistakes before they cause damage.
• Compliance: Meeting SOX, GDPR, and other regulations.
• Data integrity: Ensuring data is accurate and reliable.
• Audit readiness: Being able to demonstrate controls to auditors.

2. Segregation of duties (SoD)

SoD ensures that no single user has conflicting access that could enable fraud. Examples of conflicting duties:

• Create vendor + Approve payment
• Create purchase order + Receive goods
• Post journal entry + Approve journal
• Create sales order + Approve credit

ERP systems have SoD tools to detect and prevent conflicts. See internal controls and finance module.

3. Access controls

Access controls determine who can see and do what in the ERP. Key principles:

• Principle of least privilege: Users have minimum access needed.
• Role‑based access control (RBAC): Permissions based on job function.
• Multi‑factor authentication (MFA): Required for sensitive access.
• Regular access reviews: Quarterly recertification of user access.

See cybersecurity for more.

4. Approval workflows

Automated workflows enforce approval limits and hierarchies:

• Purchase orders above $10,000 require manager approval.
• New vendors must be approved by procurement.
• Journal entries over $50,000 need finance director approval.
• Credit memos above $1,000 require sales manager approval.

See workflow automation.

5. Audit trail fundamentals

An audit trail is a chronological record of system activities. It answers: who did what, when, and from where?

Audit trails must be:

• Immutable: Cannot be altered or deleted.
• Complete: Capture all relevant events.
• Secure: Access restricted to auditors.
• Retained: Per legal requirements (e.g., SOX: 7 years).

6. What to log

Category	Examples
Logins	Successful and failed login attempts, logouts.
Master data changes	Create/update/delete of customers, vendors, products, accounts.
Financial transactions	Invoices, payments, journal entries (especially above threshold).
Configuration changes	Changes to system settings, approval rules, security roles.
User access changes	New users, role changes, permission grants.
Data exports	Large data extracts (for privacy monitoring).

7. Monitoring & review

Logs are useless if not reviewed. Best practices:

• Automated monitoring: Use SIEM tools to flag anomalies.
• Regular audits: Sample review of logs by internal audit.
• Exception reporting: Daily reports of critical events (e.g., failed logins, changes to finance settings).
• Retention policy: Define how long logs are kept (online vs archived).

8. Best practices

• Design controls before go‑live: Don't retrofit.
• Automate where possible: SoD checks, approval workflows.
• Document controls: Maintain a control matrix.
• Test controls regularly: Include in UAT and periodic audits.
• Train users: Make them aware of control requirements.