Internal audit and ERP readiness for a pharmaceutical company

Background

The client is a domestic pharmaceutical company with one manufacturing plant and five branches distributing to pharmacies and hospitals. It was using several disconnected applications for accounting, warehousing, sales and production. Management had selected an ERP vendor but was concerned that the project would overrun if data and processes were not ready. It needed an independent party to assess the current state and write the control requirements the new system had to meet.

Challenges

• The item master held about 9,400 codes, many of them duplicates for the same product in different pack sizes.
• Batch and expiry tracking in the warehouse was kept in parallel spreadsheets that did not agree with the accounting records.
• Discount policies for pharmacies and hospitals were applied manually and were hard to verify after the fact.
• Approval authority between the plant and branches was unclear, with many approvals given by text message.

Our approach

• Weeks 1–6 — internal audit: assessed five processes (raw material purchasing, production and costing, batch and expiry inventory, sales and discounts, receivables), tested samples and ranked 41 findings by risk.
• Weeks 7–11 — data clean-up: worked with warehouse and sales teams to cleanse item, customer and supplier masters and agree coding and unit-of-measure rules.
• Weeks 12–15 — ERP requirements: wrote the business requirements document and 63 automated controls to be configured, including segregation of duties, discount limits and blocks on shipping near-expiry batches.
• Weeks 16–18 — readiness check: reviewed the vendor's test scripts, reconciled conversion balances and drew up a post-implementation audit plan.

Results

The item master was reduced from 9,400 to 5,100 codes, and around 1,200 duplicate customer records were removed. At conversion, the difference between batch-level inventory and the accounting ledger was brought below 0.3% of inventory value. Thirty-four of the 41 audit findings were resolved before go-live. The company put the ERP into use on its planned date without postponing the cut-over.

“An ERP only reflects the quality of the data and processes you put into it. Tidying up before you move house is always cheaper than tidying up afterwards.” — Ms Le Phuong Thao, Director, Internal Control & Risk, Corvane Advisory

Lessons learned

An internal audit ahead of ERP implementation lets the business turn findings into concrete configuration requirements. Data clean-up needs owners on the business side and cannot be left entirely to IT. In pharmaceuticals, batch and expiry controls should be automated as early as possible.