A public or pre-IPO manufacturer changing its ERP system should have its external auditors review the design of its data conversion and account reconciliation controls in time to change them before cutover.
Revlon's 10-K for 2018, an older case filed in March 2019, reports a material weakness: the company did not perform an effective continuous risk assessment process over its financial reporting controls associated with the implementation of its new ERP system in the U.S. and did not keep enough trained staff in the affected operations and elsewhere, and as a result did not design, implement and consistently operate effective controls to ensure it accounted for inventory, reconciled balance sheet accounts and used complete and accurate information in performing manual controls. Its remediation plan included enhancing its review and sign-off procedures for IT implementations.
Embecta, a pen needle and syringe maker that separated from BD in 2022 and replaced BD's systems, reported a material weakness in its 10-K filed December 11, 2024: controls it put in after the first two phases of its ERP implementation were not designed or operating effectively to ensure the management review, precision and evidence that the data used in account reconciliations was complete and accurate. Its 10-K filed November 25, 2025 reports the weakness remediated as of September 30, 2025.
KPMG, which audits public companies and sells SOX and controls services, published its 2025 study of material weaknesses in 2026, drawn from Audit Analytics data and SEC filings. It counted 238 reports disclosing material weaknesses in 2025, and the share of each year's reports citing information technology, software, security and access issues rose from 31% in 2021 to 40% in 2022, 52% in 2023, 54% in 2024 and 58% in 2025.
Under SEC independence rules, an audit firm is not independent if it performs any decision-making, supervisory, or ongoing monitoring function for its client, and a public company's audit committee approves the auditors' services in advance or under its pre-approval policies, with a narrow waiver for small non-audit services. So the company should write and decide its own controls and ask the auditors only to comment on them. The corporate controller writes them: for each converted balance, a total from the legacy system, the same total from the new system after each mock conversion, meaning a trial load, a named preparer and reviewer, and the account reconciliations due at the first two month-end closes. Internal audit, or an outside firm that is not the audit firm, paid from the conversion budget, tests them.
At a two-plant manufacturer, one line of the conversion log might read: balance, raw material, work in process and finished goods inventory at the second plant; control, quantities and extended standard cost in the new system tied to the legacy stock valuation report, which ties to the general ledger inventory account at cutover; prepared by, the plant controller; reviewed by, the corporate controller; tested by, internal audit; auditors' question, who approves the entry clearing a standard cost difference.
With cutover ninety days out, the controller finishes the conversion log in the first month. In the second, the auditors walk through its design and name the controls they expect to rely on in the audit, while internal audit tests it. In the third, the controller decides the changes, internal audit retests them in the last mock conversion, the audit committee hears the auditors' comments, and the CFO decides on cutover.
KPMG's study also found that 269 of the 740 companies that filed a report with a material weakness between 2021 and 2025, or 36%, disclosed material weaknesses in more than one year.
