ERP Audit Toolkit: IT General Controls and Business Process Controls

Most organisations now run their finance, procurement, payroll and inventory on one ERP system, yet few have audited it end to end. This course gives you a practical toolkit for doing exactly that: testing IT general controls and business process controls on the ERP that African organisations actually run. That ERP is often heavily customised, sometimes under-licensed, connected to banks, mobile money and revenue-authority portals, and audited by a small team working in Excel.

It is part of the EunoiaData Professional Toolkits series and is written for internal and external auditors, IT auditors, finance and systems managers, and audit committee members. Every lesson teaches the vendor-neutral principle first, then shows how it typically looks in an ERP such as SAP. The same approach works for Sage, Pastel, Microsoft Dynamics, Oracle and local payroll systems. Each lesson closes with three views: as the auditor, as the manager and as the board.

Examples follow one fictional case company, Kuvanya Group, operating across Zimbabwe, Zambia, South Africa, Botswana, Kenya and Nigeria. The company and all its people are fictional, created by EunoiaData for teaching.

Frameworks used

The course explains these frameworks in its own words: COBIT (ISACA, 2019 edition at the time of writing), COSO Internal Control – Integrated Framework (2013), ISO/IEC 27001:2022 and the IIA Global Internal Audit Standards (2024). Framework editions are shown as at 2026 and are expected to change. EunoiaData is not affiliated with or endorsed by any framework body or software vendor; product names are trademarks of their owners and are used for identification only. The course does not prepare you for any certification exam.

What you will learn

• How an ERP changes risk and control, and how to map its modules, interfaces and third parties
• How to test access management, privileged and emergency access, and change and configuration management
• How to find segregation-of-duties conflicts using user and role extracts in Excel, and design compensating controls for small teams
• How to test procure-to-pay, payroll, bank, mobile-money and multi-currency controls
• How to plan a risk-based ERP audit with a two-person team, test system-generated evidence, and report findings in business language

Your toolkit

You leave with five ready-to-adapt tools: an ERP scoping worksheet, an ITGC test checklist, a segregation-of-duties conflict matrix, an application controls test programme, and an ERP audit programme with a findings template.

How the course works

There are five modules, each with four lessons and a short quiz. You need 70% on each quiz to complete the course and earn your certificate. Audit basics are assumed; if you need them, start with our Internal Audit Fundamentals course.