Laying the Foundation for ERP Implementation Success

Laying the Foundation for ERP Implementation Success

Internal auditors can help organizations maximize the performance of enterprise resource planning (ERP) systems by becoming an active part of the application's implementation project team.

SARVA SRINIVAS, CISA
INTERNAL AUDITOR, M/S BHARAT HEAVY ELECTRICALS LTD.

Implementation of an ERP system can be long, costly, and labor-intensive and can affect an organization's bottom line if done incorrectly. This is exactly what happened to American LaFrance (ALF), a manufacturer of custom-made firefighting and rescue vehicles. The company declared bankruptcy in early 2008, blaming IBM and a failed ERP implementation project that cost the company millions of dollars. To ensure the success of any ERP implementation project, a project team consisting of an ERP consultant, internal auditing, and IT staff familiar with the company's business operations should be established before the system's implementation. As part of the team, auditors can play a proactive role in helping the organization gather the necessary resources and information before the consultant's arrival.

PART OF THE TEAM

Internal auditors can help organizations lay the foundation for an initiative's success with their knowledge of internal control practices, compliance requirements, and business processes. More specifically, auditors can help a project team find a consultant who is knowledgeable in areas the team is not. This will enable the team to identify a consultant with the right expertise and determine the consultant's necessary level of involvement in the project.

When it comes to an ERP implementation initiative, for example, it is not uncommon for organizations to hire consultants who are knowledgeable in ERP implementation best practices, while the project team provides information on the business processes, units, and functions impacted by the system. In addition, the consultant must be able to recommend the right solution — one that meets the organization's business needs — while keeping in mind the product's requirements, functionality, and performance. The consultant also needs to communicate effectively with the project team and collaborate with other company personnel, including the application's users and senior executives.

Besides identifying the right ERP consultant, auditors can help the project team in other areas, such as documenting project information and testing the efficiency of ERP controls. In particular, internal auditors can provide much needed advice in five key steps.

1. Document abbreviations and their function.

Every organization uses documents to record business transactions and track the flow of business process cycles, such as external documents (e.g., customer orders or shipping supplier forms), internal documents (e.g., production orders for plant manufacturing and quality control documents used in the testing of finished products), procedural documents (e.g., policies and procedures), and work instructions (e.g., routing sheets for floor activities). Because these documents evolve over time and become more structured in form and content, many companies assign them codes or numbers — or abbreviations — for easy and quick reference. For example, an order received from a customer can be referred to as sale order with an abbreviation of SO. Understanding document nomenclatures and abbreviations will benefit consultants during their initial interactions with employees and project team members, as they will be able to correlate abbreviations to the ERP application's terminology. A receipt from a vendor, for instance, may be referred to as store receipt voucher, while it is called goods receipt in the ERP system. Similarly, this list enables project team members and the consultant to speak the same language.

2. Identify documents used in the organization's daily operations.

IT departments usually keep a list of documents that contain commonly used information. The documents can include items such as customer order notebooks and vendor invoice files. Internal auditors can provide the project team with a list of the documents to show how internal functions, groups, or departments use them. For example, a customer order can be used by:

• The engineering department to identify the requested product performance.
• The finance department to identify payment terms.
• The shipping department to determine packaging needs and the location to which the product will be shipped.
• The quality department to identify customer-specified mandatory inspection points.

As the example illustrates, providing consultants with a list of documents and their functions will enable them to know which documents are referred to during each stage of a business process, as well as how transaction data is generated, validated, and captured before it is incorporated in the ERP system.

3. Compile a list of the organization's master data sets.

Master data sets are synchronized copies of core data elements and associated attributes. These data sets are used in analytical applications, which are often subject to governance policies. Because every organization uses master data differently, internal auditors can help the project team identify how data sets are used, digitized, and maintained. For example, a foreign customer will not be invoiced certain local taxes based on how the finance department codifies the data in the billing system. As a general rule, master data needs to be identified with its corresponding database to facilitate the generation of business documentation, while data maintenance should be assigned to a particular function depending on the data's purpose.

Identification of the master data to be incorporated in different databases will help the ERP consultant configure the ERP system faster. Consequently, an internal auditor who has a holistic view of business processes will be aware of each process' documentation flow and provide this information to the consultant and other project team members. For instance, the auditor's knowledge will enable him or her to identify risks to the master data arising from a lack of internal controls in each process, as well as how transactional data is used by middle management in the operational system or by top management for analytical purposes. The ready availability of master data also helps the consultant understand the client's data requirements and the ERP system's software requirements.

4. List the internal controls that are applied and adopted during each business process stage.

Every organization has its own set of internal controls for organizational requirements. As part of the implementation process, auditors can help the project team document the control processes and related policies and procedures that management would like replicated in the ERP system. When doing so, auditors need to describe the role of each business function and the controls that pertain to their function. Auditors also need to ensure the consultant understands the existing control environment and its level of efficiency and effectiveness. For instance, an organization that manufactures made-to-order products might not permit acceptance of high-value materials from vendors without a valid purchase order, while permitting low-value common materials to be received without a purchase order.

5. Create a list of currently used and recently generated management information reports (MIRs).

Besides using key performance indicators, senior executives rely on MIRs provided by middle management to evaluate their function's performance. As the organization digitizes process documents through electronic data flows and captures and updates data on a real-time basis, incident exception reports should decrease in frequency. In addition, while middle management desires a seamless navigation among all electronic documents, senior executives want all MIR analyses to be automated and available online. Internal auditors, therefore, need to prepare a list of MIRs that management needs daily. Creating the list will help the consultant and project team identify the kinds of data to be captured and compiled by the system on a regular basis to facilitate exception reporting.

ADDITIONAL RECOMMENDATIONS

Although the partnership between the consultant and the project team will be short-lived, ranging anywhere from six to 12 months, their work will have a lasting impact on the organization's day-to-day operations. As a result, the project team needs to communicate all system and compliance requirements to the consultant as soon as possible to determine whether the right consultant was hired for the job. Because auditors have a holistic view of the organization's business operations, documentation flows, and internal controls, they can provide this information to the project team and ensure it is incorporated into the ERP system. This, in turn, will help maximize ERP implementation efforts, minimize surprises that detract from the implementation's success, and help ensure users are satisfied with the product's performance.

Sarva Srinivas, CISA, is an internal auditor with M/s Bharat Heavy Electricals Ltd., a power equipment manufacturer in India, where he performs ERP implementation projects.

Site Search: