Hacker News Reader

Comment by tablespoon | Hacker News Reader

> Too easy for someone to use it to cook the books? Maybe it looks better in an audit if they can point to an external source for their accounting software.

I think that is probably a big concern. I read a comment once by someone who said they worked in some kind of company that did financial audits, and it said that as soon as they got a whiff of some homegrown accounting system, the audits got way more expensive, because then they'd have to do a technical audit of the system in addition to the bean counter's audit.

If the company ran SAP or some other common ERP system, they didn't have to do that, because it was battle-tested and assumed to be correct.

View on HN

This is it right here.

The magic of these horrible ERP systems is that auditors like them because they've dealt with them before.

I've had a similar conversation about such with the owner of a company who wanted to go public on the horizon. Switching to SAP or Oracle is for this reason and this reason alone. It's such a shame that they are so awful and yet this somewhat tiny thing is the deciding factor.

I'm sure many companies have fucked up their entire internal systems and, potentially, lost out on moving forward simply because they went with these beasts. Tech turnover has got to be huge when you move to something like this. It's probably not worth it in the end, really.

Let the auditors bitch.

Does SAP use its own system?

Excel. ;-)

It does.

It’s turtles all the way down.

I'm an external auditor, this is definitely true. Large ERPs have special audits done over their technical systems that we can rely on and not really think too much about whether the system works or not, since another auditor has already signed off that it does.

I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions.

So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided.

Cheers

> I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions.

> So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided.

I'm no expert, but I don't think typical auditors are there to find things like that.

> So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided.

Oracle/SAP is NOT about whether the system is actually correct.

Oracle/SAP IS about whether the system not being correct is the legal liability of someone else.

I'm an auditor, and what you're saying is probably fair, but probably not a big deal. I have a lot of clients who either use Excel for their bookkeeping or provide us their full GL in Excel, so we always have the risk of changes being made, but we're not too concerned since our regular audit procedures would uncover it.

We're required to obtain an understanding of the control environment (so the ERP system in this case), and if we want to rely on its outputs we have to do dedicated testing over it. You're right though that if you do alter one transaction it's probably not going to come up in the audit samples. There's a bit of a gradient though between how much you alter and how much the auditors care, because auditors deal with things on a materiality basis. The more you manipulate the finances, the more material it becomes and the more we care, but also the more likely it will be uncovered. If you're changing a few trivial transactions we more certainly will never uncover it unless you're really unlucky, but then the effects of those trivial transactions is trivial anyways so it's not really a problem.

Reply on news.ycombinator.com