Start with the request, not the storage medium
An auditor may ask for a population of invoices, a sample with supporting documents, a trial balance, evidence of payment application or a reconciliation between source and archived records. A folder of raw tables may contain the answer without making it practical to produce.
What an audit-ready archive should preserve
- Original document and account identifiers
- Transaction dates, posting dates and fiscal periods
- Original and functional currency amounts
- Document header, lines, distributions and application relationships
- Customer, vendor, item and account context
- Record notes and agreed attachments
- Source table and column provenance
- Extraction run and final archive identity
Build repeatable populations
Saved query definitions reduce argument and rework. A good definition records the entity, included companies, date field, range, status, document types, exclusions, selected columns and sort order. The exported file records row count, totals and the hash of the source archive.
The same query should return the same population from the same immutable archive. Changes to a request produce a new named definition rather than silently editing the original.
Provide supporting documents and underlying data
Auditors often need both a readable document and the rows behind it. An ERPDataArchive Audit Pack gives them:
- ✓Readable PDF documents for the selected population
- ✓The underlying transaction data in XLSX
- ✓The relevant GL trial balance for the period
- ✓An index linking documents to transaction identifiers
- ✓A record of the query, row counts and file checksums
Reconcile before the original system disappears
Do not wait for the first post-migration audit to discover that history is incomplete. During cutover, compare source and archive table counts, fiscal-year trial balances, AR/AP totals, inventory controls where applicable and document counts by type and period. Retain the reviewed report with the decommission package.
Control access to the evidence
The archive may include payroll, bank, tax and customer data that a given auditor does not need. Restrict access to the full database. Produce scoped Audit Packs for the engagement, transfer them through the approved secure channel and record who received them.
SQLite does not reproduce GP roles. Filesystem permissions, device encryption, secure transfer and data minimization become the access model.
Questions to ask before selecting a history solution
- ✓Can a controller create an audit population without a DBA?
- ✓Can an analyst inspect the exact query and source fields?
- ✓Can supporting documents be exported in a batch?
- ✓Are date and amount fields real types in Excel?
- ✓Does each package include row counts and checksums?
- ✓Can the provider prove the archive matched GP at cutover?
- ✓Will access still work if support or a subscription ends?