Building internal controls into your ERP with COSO
Policies on paper do not stop errors or fraud. Here is how to translate the five COSO components into automated controls, approvals and audit trails inside your system.
Most companies have an internal control framework somewhere: a policy manual, a delegation of authority matrix, maybe a risk and control matrix prepared for the external auditors. The problem is that these documents live outside the systems where transactions actually happen. An ERP implementation is the best opportunity you will ever get to close that gap, because every approval, limit and permission can be enforced by the system itself.
COSO in one paragraph
The COSO Internal Control — Integrated Framework is the most widely used reference for designing and evaluating internal control. It defines internal control as a process designed to provide reasonable assurance about operations, reporting and compliance objectives, built on five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Each has a direct translation into ERP design.
1. Control environment → roles, authority and accountability
The tone at the top becomes concrete through organizational structure and authority. In the ERP, this means:
- A role design that mirrors the real organization chart, not generic “admin” users.
- Your delegation of authority (DoA) matrix translated into approval limits by amount, document type and department.
- Named users only, with no shared accounts, so every action is attributable.
2. Risk assessment → a risk register that knows your processes
Before configuring controls, identify what can go wrong in each process: paying a fictitious supplier, selling below cost, recording revenue in the wrong period, losing inventory. Maintain these risks in a register linked to processes and owners, ideally in the same platform, so controls can be mapped to risks rather than designed in isolation.
3. Control activities → automated, preventive controls first
This is where the ERP delivers the most value. Prioritize controls that prevent problems over those that only detect them later:
| Risk | ERP control | Type |
|---|---|---|
| Unauthorized purchases | Purchase orders require approval by amount; invoices must match PO and receipt | Preventive |
| Fictitious suppliers | Supplier creation and bank detail changes require a second approver | Preventive |
| Selling below margin | Minimum price rules and discount limits by role | Preventive |
| Bad debts | Credit limits with automatic holds on overdue customers | Preventive |
| Back-dated entries | Closed accounting periods and posting date restrictions | Preventive |
| Inventory loss | Warehouse-level permissions and cycle count variance approvals | Detective |
Segregation of duties (SoD)
No single person should be able to create a supplier, approve a purchase, record the invoice and release the payment. Design roles so incompatible duties are separated, and run a periodic SoD conflict report to catch exceptions created over time.
4. Information and communication → one source of truth
Controls depend on reliable information. An integrated ERP ensures that sales, inventory, purchasing and finance share the same data, and that every change is logged with who, what and when. Policies and procedures should be accessible inside the system, linked to the processes they govern.
If a control is not enforced by the system or evidenced by the system, assume it is not operating.
5. Monitoring activities → continuous, not annual
Instead of testing controls once a year, configure monitoring that runs continuously: alerts for overrides, reports on approvals bypassed in emergencies, exception dashboards for internal audit, and periodic access reviews. This turns monitoring from an audit event into a management habit.
A practical roadmap
- Document key processes and their risks with process owners.
- Approve a DoA matrix and translate it into system approval rules.
- Design roles with SoD in mind, then test them with real scenarios.
- Configure preventive controls first, then detective reports and alerts.
- Build a risk and control matrix linked to system evidence.
- Train users on why controls exist, not just how to click.
- Review access, overrides and exceptions monthly.
How Amy Technology helps
Our GRC consultants and ERP engineers work together: we design or review your control framework, translate it into ERPNext roles, approvals and rules, and build the monitoring dashboards your management and audit committee need. The result is control that is enforced every day, not just documented.