Auditing Business Applications: Internal Auditors Need to Understand the Systems That Run the Business

John C. Blackshire, Jr.
Aug 22
9 min read

Why ERP Systems, Automated Controls, Interfaces and AI Have Made Business Application Auditing an Essential Internal Audit Skill

Modern organizations do not simply use business applications.

They operate through them.

Purchasing happens in an application. Vendors are established in an application.

Employees are paid through an application. Sales orders, inventory movements, customer billing, cash receipts, journal entries and financial reporting increasingly depend on integrated information systems.

That creates a fundamental challenge for Internal Audit:

How can you audit the business process without understanding the application that operates and controls the process?

Corporate Compliance Seminars' Auditing Business Applications program is designed to help auditors answer that question. CCS currently lists the webinar as an 8-CPE program, and its broader IT-audit curriculum emphasizes practical evaluation of business applications, technology controls and technology risk.

Two upcoming opportunities to attend are:

Wednesday–Thursday, September 16–17, 2026
Wednesday–Thursday, November 11–12, 2026

Auditing Business Applications — Corporate Compliance Seminars

Business Applications Are Where Many Internal Controls Actually Operate

Consider a traditional procure-to-pay process.

An auditor might identify controls over:

Vendor Creation

→ Purchase Requisition

→ Purchase Order

→ Approval

→ Receiving

→ Invoice

→ Three-Way Match

→ Payment

Twenty years ago, an auditor might have encountered considerably more paper throughout that process.

Today, much of it may happen automatically.

The application determines who can create the vendor.

The application routes the purchase for approval.

The application determines the required approval level.

The application performs the three-way match.

The application identifies duplicate invoices.

The application creates the payment file.

The application records the transaction in the general ledger.

That means the auditor cannot fully understand the internal-control environment by looking only at people and paperwork.

The auditor needs to understand what the application is doing.

ITGCs Are Important—but They Are Not Enough

Internal Auditors increasingly understand the importance of Information Technology General Controls (ITGCs).

These commonly address areas such as:

User access
Change management
Passwords and authentication
Backup and recovery
System development
IT operations
Security administration

These controls are essential.

But strong ITGCs do not automatically mean that transactions are being processed correctly.

That is where IT Application Controls (ITACs) become important.

CCS's own discussion of business-application auditing distinguishes ITGCs from application controls that help determine whether transactions are authorized, complete, accurate, valid, timely and properly recorded.

The Internal Auditor needs to understand both.

What Is an Application Control?

An application control is embedded within or closely associated with a particular business application or transaction process.

Examples can include:

Three-Way Invoice Matching
The system compares the purchase order, receiving information and invoice before payment.
Credit-Limit Enforcement
The application prevents or escalates customer orders exceeding approved credit limits.
Duplicate-Invoice Detection
The system identifies potentially duplicate invoices before payment.
Approval Workflows
Transactions are electronically routed to employees with appropriate approval authority.
Journal-Entry Approval
Entries meeting defined criteria require review before posting.
Payroll Validation
The system performs programmed checks over payroll information.

These are not merely IT controls.

They are business controls implemented through information technology.

CCS identifies these types of ITACs as a major focus of effective business-application auditing.

Start With the Business Objective—not the Technology

Auditors should avoid turning a business-application audit into a technical inventory of system features.

Start with the business.

For example:

Objective: Pay only valid vendors for goods and services actually received at authorized prices.

Then ask:

What risks threaten that objective?

Potential risks might include:

Fictitious vendors
Unauthorized purchases
Duplicate invoices
Incorrect prices
Payments for goods not received
Unauthorized changes to vendor bank information
Duplicate payments

Only then should the auditor ask:

What application controls address those risks?

The audit logic becomes:

Business Objective

→ Risk

→ Business Process

→ Application Control

→ Configuration

→ Evidence

→ Testing

→ Conclusion

That keeps the audit focused on risk rather than technology for technology's sake.

Don't Assume an Automated Control Works

This is one of the most dangerous assumptions in auditing.

Management tells the auditor:

“The system won't allow that.”

The auditor documents:

“Automated control prevents transaction.”

Audit complete?

No.

The appropriate response is:

“Show me.”

The auditor needs to understand how the control is configured.

Can anyone override it?

Can administrators change it?

Does it apply to every transaction?

Are there exceptions?

Who reviews exceptions?

What happens when the configuration changes?

Can transactions bypass the application?

A control does not become reliable merely because someone describes it as “automated.”

Interfaces Create Risk Between Systems

Modern organizations rarely operate one isolated application.

Data moves among systems.

For example:

CRM

→ Order Management

→ Inventory

→ Billing

→ Accounts Receivable

→ General Ledger

→ Financial Reporting

Now the auditor has another question:

What happens to the data between applications?

CCS specifically identifies interfaces, APIs and integrated workflows as increasingly important components of business-application auditing.

An application can process information perfectly while receiving incomplete or inaccurate information from another system.

Auditors therefore need to consider:

Interface completeness
Interface accuracy
Rejected transactions
Duplicate transmissions
Error handling
Reconciliations
Monitoring

The control problem may not exist inside either application.

It may exist between them.

Master Data Deserves Serious Audit Attention

Business applications depend heavily upon master data.

Consider:

Vendor Master
Customer Master
Employee Master
Chart of Accounts
Product Master
Pricing Tables
Banking Information
Approval Limits
User Roles

If the master data is wrong, transactions can be processed exactly as programmed and still produce the wrong result.

That makes master-data governance an important application-audit subject.

Auditors should ask:

Who can create master records?

Who can change them?

Who approves changes?

Are sensitive changes independently validated?

Are changes logged?

Are dormant records periodically reviewed?

Are duplicate records identified?

Are unusual changes monitored?

CCS identifies ineffective master-data governance as one of the recurring weaknesses encountered in business applications.

Segregation of Duties Has Become a Systems Issue

Segregation of duties used to be relatively easy to visualize.

One person prepares the check.

Another signs it.

Another reconciles the bank account.

Modern ERP systems make the problem considerably more complicated.

An employee might have combinations of system permissions allowing that person to:

Create Vendor

Enter Invoice

Approve Invoice

Change Banking Information

Initiate Payment

The employee may never touch a paper check.

The segregation-of-duties problem exists entirely inside the application.

That means auditors need to understand:

Users + Roles + Permissions + Transactions

not merely job titles.

ERP Systems Demand a Different Kind of Auditor

Enterprise Resource Planning systems integrate multiple processes.

Common platforms include systems from SAP, Oracle, Microsoft and other enterprise-software providers.

The auditor does not need to become the organization's SAP or Oracle administrator.

But the auditor does need to understand questions such as:

Which business processes are performed in the ERP?

Which controls are automated?

Which controls remain manual?

What data feeds the application?

What interfaces exist?

Who has privileged access?

How are configuration changes controlled?

What reports does management rely upon?

How do we know those reports are complete and accurate?

That is becoming basic Internal Audit competency.

AI Is Changing Business Applications Again

The next transformation is already occurring.

Enterprise applications increasingly incorporate artificial intelligence and advanced automation.

CCS's recent analysis identifies AI uses involving invoice processing, inventory-demand prediction, fraud detection, purchasing analysis, pricing recommendations, cash-flow forecasting, financial-close activities and customer service.

That means auditors now need to add another layer to the application audit.

The old model might have been:

What was the system programmed to do?

The emerging question becomes:

How is the system arriving at its recommendation or decision?

That introduces risks involving:

AI Governance
Data Quality
Algorithmic Bias
Model Transparency
Human Oversight
Model Changes
Automated Decision-Making
Monitoring
Accountability

The technology is new.

The audit logic remains familiar:

What is the objective, what can go wrong, what controls address the risk, and what evidence demonstrates those controls work?

AI Does Not Eliminate Accountability

Suppose an AI-enabled application recommends rejecting a customer transaction.

Who owns the decision?

Suppose AI identifies an invoice as fraudulent.

Who investigates it?

Suppose an AI-supported forecast materially affects a financial estimate.

Who validates the output?

Suppose management says:

“The AI made the decision.”

That cannot become the end of the audit trail.

Someone in management remains accountable for the business process.

AI should enhance the control environment.

It should not become a mechanism for avoiding responsibility.

Cloud Applications Change the Control Boundary

Cloud computing creates another issue.

An organization may no longer operate the application infrastructure itself.

That does not mean the organization's responsibility disappears.

Internal Audit needs to understand the shared-control environment.

Questions include:

What controls are performed by the cloud provider?

What controls remain management's responsibility?

What does the service agreement require?

Is a SOC report available?

What complementary user-entity controls apply?

How does management monitor the provider?

How are incidents communicated?

What happens if the service becomes unavailable?

Outsourcing the application does not outsource the organization's risk.

APIs Deserve Auditor Attention

Application Programming Interfaces—APIs—allow applications to exchange data automatically.

That creates efficiency.

It also creates risk.

Auditors should increasingly understand:

Which systems exchange data?
What data is transferred?
How is the API authenticated?
Who can modify the interface?
What happens when a transfer fails?
How are exceptions identified?
How does management know the transfer was complete?

Again, the auditor doesn't necessarily need to write the API.

The auditor needs to understand the risk created by the API.

Common Business Application Findings

CCS identifies several recurring weaknesses that auditors encounter in business applications, including excessive access, segregation-of-duties conflicts, weak approval workflows, inadequate change management, poor interface controls, incomplete audit trails, duplicate payments, weak configuration management, ineffective master-data governance and insufficient monitoring of automated controls.

Notice something about that list.

Very few of these problems are exclusively “IT problems.”

They affect:

Financial Reporting
Fraud
Operations
Compliance
Cybersecurity
Data Integrity

That is precisely why business-application auditing should not be left exclusively to highly technical IT specialists.

Internal Auditors and IT Auditors Need Each Other

The business auditor understands:

The process
The accounting
The risks
The controls
The organization

The IT auditor understands:

The technology
Access
Configuration
Interfaces
Databases
Security
Change management

The strongest business-application audits combine both perspectives.

The business auditor asks:

“What could go wrong?”

The IT auditor helps determine:

“How could the technology allow or prevent that from happening?”

That is a powerful combination.

Frameworks Give the Auditor Structure

Business-application audits can also draw from established frameworks.

CCS identifies COBIT, COSO, the NIST Cybersecurity Framework, ISO 27001 and SOX Section 404 among the frameworks relevant to these audits.

These should not become competing checklists.

Each can provide criteria appropriate to different portions of the audit.

COSO may help the auditor evaluate internal control.

COBIT can help structure IT governance and control.

NIST can inform cybersecurity assessment.

ISO 27001 can provide information-security criteria.

The framework supports the audit.

It should not replace risk-based thinking.

Business Application Audit Should Follow the Transaction

One practical auditing technique is deceptively simple:

Follow a transaction from beginning to end.

Take a purchase.

Who requested it?
Who approved it?
What application captured it?
What automated controls operated?
Where did the data go next?
What interfaces moved the information?
Who received the goods?
How did the invoice enter the system?
What matching occurred?
What exceptions were generated?
Who approved payment?
How did the transaction reach the general ledger?
How did it ultimately affect financial reporting?

That walkthrough can reveal more about an application than reviewing a hundred pages of system documentation.

Who Should Attend?

CCS describes business-application auditing as relevant to professionals responsible for evaluating business systems, including Internal Auditors, IT Auditors, External Auditors, Compliance Officers, Risk Managers, Controllers, financial-systems professionals, ERP teams, information-security professionals and Audit Managers.

CCS's current Internal Audit and IT training listings identify Auditing Business Applications as an 8-CPE webinar.

That makes this substantially more than a brief introduction to IT controls.

Two Opportunities to Attend in 2026

Corporate Compliance Seminars has two upcoming presentations of Auditing Business Applications:

Wednesday–Thursday, September 16–17, 2026

The September program provides an opportunity for Internal Audit teams to strengthen their application-auditing capabilities before year-end audit work and 2027 risk-assessment activities.

Wednesday–Thursday, November 11–12, 2026

The November program is particularly well positioned for audit departments developing their 2027 audit plans.

Ask a useful planning question:

How many of the processes on our 2027 audit plan depend substantially upon business applications?

For many organizations, the answer will be:

Almost all of them.

The Bottom Line: You Cannot Audit the Modern Business Without Auditing Its Applications

Internal Audit has traditionally divided the world into:

Business Audit

and

IT Audit

That distinction is becoming increasingly artificial.

Procurement is technology-enabled.

Payroll is technology-enabled.

Revenue is technology-enabled.

Inventory is technology-enabled.

Treasury is technology-enabled.

Financial reporting is technology-enabled.

And now artificial intelligence is being embedded directly into those applications.

The modern Internal Auditor therefore needs to understand the chain:

Business Objective

→ Business Process

→ Application

→ Data

→ Automated Control

→ ITGC

→ Interface

→ AI/Automation