Need to verify the existence of the audit trails for key configurations and dataset

24 Absence of ERP System Audit Trails

We have some reuirement related to the Audit where thwy have asked the following information.

Observation

As part of review of Oracle ERP System detective controls (such as logs enablement), IT Department was not able to provide audit logs including changes made to master records (e.g. employees, vendors,fixed assets). Accordingly, assurance could not be provided if unauthorized changes had been made to master data.

Internal Audit assess the possible root cause lack of specified system requirements and validation of the system during acceptance.

Risk / Implication

Absence of audit logs for changes made to master data (e.g. employees, vendors, and fixed assets), increase the risk of errors not being detected.