1.1 Welcome: Your ERP Audit Toolkit (Start Here)

An enterprise resource planning (ERP) system is the single, integrated system an organisation uses to run finance, procurement, inventory, sales, payroll and HR on one shared database. Auditing an ERP means testing whether that system can be trusted: whether the right people have the right access, whether changes are controlled, and whether the business processes running through it produce complete and accurate results.

This course is part of the EunoiaData Professional Toolkits series. It is built for the ERP that many African organisations actually run: heavily customised, sometimes under-licensed, connected to banks, mobile money and revenue-authority portals, and audited by a small team working mainly in Excel.

What you leave with

Each module ends with a toolkit item, delivered as a table you can copy into Excel or Word and adapt:

Who this course is for

Internal and external auditors, IT auditors, finance and systems managers, and audit committee members. Audit basics (independence, working papers, sampling, reporting lines) are assumed. If you need them, start with our Internal Audit Fundamentals course.

Frameworks used in this course

This course explains these frameworks in its own words. It uses their principles; it does not reproduce their text.

• COBIT (ISACA): the 2019 edition at the time of writing. ISACA has announced COBIT 7 for 27 October 2026.
• COSO Internal Control – Integrated Framework (2013).
• ISO/IEC 27001:2022 (information security management).
• IIA Global Internal Audit Standards (2024), including the Cybersecurity and Third-Party Topical Requirements.

Product names such as SAP, Sage, Pastel, Microsoft Dynamics and Oracle are trademarks of their owners and are used for identification only; EunoiaData is not affiliated with or endorsed by any software vendor. Framework names belong to their issuing bodies; this course explains them in its own words and is not endorsed by them. The course does not prepare you for any certification exam.

How the ERP examples work

Every lesson teaches the vendor-neutral principle first. Where it helps, a short layer then shows how this typically looks in an ERP such as SAP, because SAP is widely used across the region. If you run another ERP, ask your IT team for “your system’s equivalent report”. Many African organisations run either SAP ECC (the older version) or S/4HANA (the newer one), and some report and table names differ between them, so always ask which one you run.

The case company

About the case company: Kuvanya Group, its subsidiaries (Kuvanya Bank, KuvaTel, KuvaPay, Kuvanya Mining Supplies and Kuvanya Shared Services), its client “the Power Authority” and every person named in this course are fictional. They were created by EunoiaData for teaching purposes only. Any resemblance to real organisations or people is coincidental. Countries, laws and regulators are real and are described as they stood in 2026.

Kuvanya Group is a family-founded holding group of about 4,200 staff in Zimbabwe, Zambia, South Africa, Botswana, Kenya and Nigeria. It reports in US dollars while its subsidiaries trade in local currencies as well. Kuvanya Shared Services in Harare runs one group ERP for all five subsidiaries. The ERP went live four years ago and is heavily customised. Kenya and Nigeria run stand-alone payroll systems that upload CSV journals to the ERP. Internal audit is a two-person team: Nomsa Dube, Head of Internal Audit, and Femi Adebayo, an analytics specialist working remotely from Lagos.

How the three views work

Each teaching lesson closes with three short points:

• As the auditor: what to test and what evidence to ask for.
• As the manager: what the control owner must do, and how to be ready for the audit.
• As the board: what an audit committee member should ask and expect to see.

The same control looks different from each seat. Seeing all three helps auditors write findings that managers accept and boards act on.

Example: Tendai Musarurwa, Kuvanya’s Group CFO, asks Nomsa why the group needs an ERP audit when the external auditors already sign the accounts. Nomsa explains that the external audit tests whether the financial statements are fairly stated; it does not tell management whether leavers still have access, whether consultants can change live settings, or whether KuvaPay settlements are reconciled every day. Those are the questions this audit will answer.

Three views

• As the auditor: agree the scope, the frameworks and the evidence standard before fieldwork, and write them into the engagement plan.
• As the manager: name an owner for each ERP module and interface, so the audit knows who answers for each control.
• As the board: ask when the ERP was last audited end to end, and what the scope left out.

Check before you act: Framework editions and requirements here are as at October 2026 and are expected to change. ISACA has announced COBIT 7 for 27 October 2026. Confirm the current edition with the issuing body (ISACA, COSO, ISO or The IIA) before you rely on it.

Key takeaway

An ERP audit tests whether the system that runs the business can be trusted; this course gives you five tools to do it with a small team, using frameworks explained in plain language.