In short: Whether an ERP system works efficiently is judged not by looking at the system itself, but by whether the work happens in the system or around it. Six warning signs are typical: a flight to spreadsheets, double data entry, distrust of reports, customisations that block upgrades, unused modules, and integrations that are fixed by hand. An ERP health check looks at five areas: process fit, data quality, customisations and release, integrations, and usage and permissions. The decision should rest on evidence from system logs and process data, not on opinion.
What an ERP audit is, and what it is not
An ERP audit is an assessment of how far an installed system carries the company’s real processes today. It is not the independent audit of the financial statements, and it is not just an information security scan. It looks for answers to three questions: do the processes run in the system, is the data in the system reliable enough to decide on, and is the system sustainable as it stands?
Widely used frameworks for IT governance recommend regularly assessing whether information systems serve the business goals. An ERP audit applies that general principle to the company’s most critical business system.
6 warning signs that your ERP system is not working efficiently
- A flight to spreadsheets: planning, costing or shipment tracking run in spreadsheets kept beside the system; the system is used only for recording.
- Double data entry: the same order, customer or product data is keyed into more than one place by hand; moving data between systems has become somebody’s job.
- Distrust of reports: management reports are corrected by hand every month, the month-end close and reconciliation take long, and different departments answer the same question with different figures.
- Avoiding upgrades: accumulated customisations keep postponing the move to a new release; every upgrade looks like a new project.
- Unused modules and licences: some purchased modules were never rolled out or were abandoned; a large share of users open the system only to look things up.
- Integrations fixed by hand: e-document flows, bank transactions or links to other systems regularly need manual intervention.
Our assessment is that these signs usually come not from a weakness of the software but from processes that changed after go-live and were never reflected in the system. So the first question should not be «should we move to a new system?», but «how far has the current system drifted from the way we work today?».
An ERP health check: five areas
The table below summarises which area a health check looks at, and with what evidence:
| Area | Evidence to look at | Question to ask |
|---|---|---|
| Process fit | Transaction logs in the system, spreadsheets kept outside it | Which process steps run outside the system? |
| Data quality | A sample of master data, duplicate and incomplete records | Are product, customer and bill-of-materials data reliable enough to decide on? |
| Customisations and release | List of customisations, release history | Which customisations are still needed, and which block an upgrade? |
| Integrations | List of interfaces, error and manual-fix records | Which links are regularly fixed by hand, and who owns them? |
| Usage and permissions | User and module usage data, role definitions | Who uses what, and do permissions match the job? |
Where the evidence comes from
An audit is worth something because it rests on evidence rather than opinion. Four sources are used together:
- System logs: the ERP’s transaction records show how a process actually runs. Process mining derives the real process flow from these event logs; the IEEE XES standard is the common format for event data.
- Usage data: which modules are used, by which users, and how often.
- A data sample: the consistency and gaps of master data are examined on a small but representative sample.
- Interviews with process owners: the exceptions and the work outside the system that the logs do not show. Current processes are drawn in a shared notation such as BPMN 2.0.
Where the records contain personal data, the review follows the applicable data protection law (in Türkiye, Law No. 6698) and uses only as much data as the purpose requires.
After the audit: three possible decisions
- Improve: the system is right, the set-up is outdated. Processes are updated, unnecessary customisations are removed, users are retrained.
- Upgrade and simplify: some customisations can be replaced by standard functions; the upgrade is planned together with the simplification.
- Replace: the system no longer suits the company’s scale or processes. A new system selection then starts from the scope the audit has made visible.
Which decision is right cannot be known before the audit. A common mistake is to start looking for a new system the moment a problem is felt, without ever measuring why the current one falls short; the same problems then move to the new system.
Mistakes to avoid
- Leaving the audit to the IT team alone: most problems show up in the daily work of the process owners.
- Relying on one person’s or one department’s view: the signs look different from department to department.
- Not turning findings into scope: an unprioritised list of findings does not turn into action.
For the criteria to look at when choosing an ERP, see our article on five critical capabilities when choosing ERP.
The MindDX approach
MindDX sums up this order as «X-ray first, then diagnosis». For an installed Odoo, Zoho or abas ERP system, the live-system path of Assess is Audit: it evaluates the existing installation without changing it and produces the Validated Improvement Scope, which shows what to improve. Explore the MindDX Platform.
Sources
- ISACA — COBIT (framework for the governance of information and technology)
- IEEE Task Force on Process Mining — Process Mining Manifesto
- IEEE 1849 XES — eXtensible Event Stream standard
- Object Management Group — Business Process Model and Notation (BPMN) 2.0
- Turkish Revenue Administration (GIB) — e-Document portal (in Turkish)
- Law No. 6698 on the Protection of Personal Data — official text (in Turkish)