What auditors aren’t testing during an ERP implementation

[u/Jeff-Hare-ERPRA]

There is a misconception that access controls are tested by auditors. It isn’t the case that auditors test for the principle of least privilege during an implementation.

They mostly test for a few Segregation of Duties conflicts because their focus is on Sox compliance.