More Indian companies, including mid-sized firms and startups, now run on SAP S/4HANA or the older SAP ECC. Their auditors have not always kept pace. Large firms have IT risk teams that understand the system. Smaller and mid-tier CA firms often learned their craft on Tally or Busy, where an entry is a debit and a credit that you can trace to a voucher. SAP does not work that way, and an audit built around vouching will miss most of what matters.
This post explains what the standards expect, what Rule 11(g) now requires, and where we see auditors miss things in SAP.
1. What SA 315 and SA 330 Expect
SA 315 requires the auditor to understand the entity’s information system and the automated controls it relies on. In an SAP environment, that understanding is the starting point of the audit strategy. SA 330 then governs how the auditor tests those controls and designs substantive procedures around the risks found.
Section 143(3)(i) of the Companies Act, 2013 adds a reporting requirement on whether the company has adequate internal financial controls and whether they operated effectively.
The practical point is that most numbers in SAP are outputs of controls. Three-way match tolerances, automatic tax code derivation and inventory valuation all happen inside the system. Before relying on those numbers, the auditor needs to validate the IT General Controls (ITGC) around them. Sampling vouchers without testing the controls that produced them is where many audits go wrong.
2. Rule 11(g) and the Audit Trail
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 applies to financial years starting on or after 1 April 2023. The company must use accounting software with an audit trail that records every change to every transaction, with the date of the change, and the feature must not be capable of being disabled.
The ICAI Implementation Guide on reporting under Rule 11(g) puts a heavy burden on the auditor. The report must say that the feature exists, that it operated throughout the year, that it captured changes to each transaction, that it was not tampered with, and that records were retained as the law requires, which is eight years.
SAP has native logging, but having it is not the same as proving it worked all year. The table below shows where audits usually fall short.
| Rule 11(g) requirement | SAP mechanism and audit step | Where audits fail |
|---|---|---|
| Audit trail exists | Change documents (CDHDR, CDPOS) and FI documents (BKPF, BSEG) | Assuming native logging is enough without checking configuration |
| Operated throughout the year | Confirm logging parameters such as rec/client were never switched off | Not obtaining evidence (such as profile parameter change records) that logging stayed on all year |
| Not tampered with | Restrict database-level access and track privileged user activity | Relying on a management representation letter instead of ITGC logs |
| Records preserved | Archiving that matches the 8-year retention period | Testing only the live production client and ignoring archives |
3. Common Problem Areas
Even when ITGCs are reviewed, a few SAP areas get missed again and again.
Inventory, valuation and GR/IR
- Check the price control indicator (S or V) in the material master. Find out who can change it and how often it changes.
- Analyse standard price variances for size and persistence. Large ones often trace back to wrong standard costs or capitalisation errors.
- Review bulk or manual price changes (for example MR21) made around period end.
- Test for negative stock and its effect on moving average prices and cost of goods sold.
- Review the GR/IR account item by item with ageing. Compare it with open POs, later invoices and delivery confirmations.
- Ask who runs MR11, under what authorisation and with what cut-off logic. Then check whether each write-off reflects a vendor liability that was really extinguished, or an incorrect receipt.
Journals, posting periods and reconciliation accounts
- Extract the full journal population and analyse it by user, time, document type and round amounts.
- Check for manual postings to accounts that should not take them, such as inventory, fixed asset and GR/IR accounts.
- Review parked or held documents at period end.
Segregation of duties and privileged access
- Review users with SAP_ALL, emergency or firefighter IDs, and conflicting roles, for example a user who can both create a vendor and post a payment.
- Confirm that direct table changes in production are disabled.
- Review transports from development to production during the year. They bypass application controls and are central to Rule 11(g).
Interfaces, reports and data integrity
- Test completeness and accuracy of data from third-party systems such as payroll, e-invoicing and banking.
- Validate custom (Z or Y) reports and ageing reports that are used as audit evidence or for provisioning, including the logic behind them.
- Check reconciliations between subledgers and the general ledger, and look at interface error queues.
4. The Takeaway
SAP does not make an audit easier. It moves the audit from the voucher to the system. The trail that an auditor once followed in Tally or Busy now sits behind configuration, authorisations and automated postings.
SA 315, SA 330, section 143(3)(i) and Rule 11(g) all point the same way. Understand the IT environment, test the ITGCs and key automated controls, and only then decide how much substantive work is needed.
We will cover each of these areas in more detail in future articles, including how to understand and validate them.
Need help with this?
If you want to talk through your SAP audit approach, speak with a partner.
Disclaimer: This article is for general information only and is not legal, tax or professional advice. Facts differ from case to case, and each matter is decided on its own facts. The judgments and orders discussed here may have been appealed, modified or overruled since this article was written. Please rely on this content at your own risk, and consult a qualified professional before acting on any of it. We accept no liability for any loss or action arising from its use.