Identify the audit-relevant event types in your ERP (journal entry creation, modification, deletion, period open/close, user access changes, approval status changes) and locate the system change log or audit trail API or table for each event type.
Query the change log for the audit period using the ERP's API (e.g., NetSuite AuditTrail SuiteQL query, QBO ChangeDataCapture endpoint, Xero History and Notes endpoint on key objects) filtering by date range and event type.
For each journal entry, extract the creation timestamp, created_by user, last_modified_by user, approval_status, approver_id, and approval_timestamp; flag any entries that were posted without an approval (where required by policy) or were modified after approval.
Pull access control data via the ERP's user and role APIs to produce a list of users with journal entry posting or approval rights during the audit period; cross-reference against the HR system to verify that only active, authorized employees had access.
Export the evidence package — change log extracts, approval trails, segregation-of-duties matrix — to a structured format (CSV, PDF, or audit-tool-compatible format) with file hashes to demonstrate the extract was not altered after generation.
Automate the evidence collection run on a quarterly schedule and send the output to a designated secure storage location; include a completeness assertion showing the total transaction count in the change log versus the total transactions posted in the GL for the period.
Known gotchas
Many ERPs retain detailed audit logs for a limited retention window (e.g., 90 to 180 days depending on configuration); schedule automated evidence pulls before the retention window expires rather than pulling annually — waiting until the audit can result in missing data.
Change log APIs often return paginated results with tight page sizes; for high-volume transaction environments, the full audit period's log can require thousands of API calls — implement batched extraction with checkpointing to avoid timeout failures and data gaps.
Segregation-of-duties violations (same user creates and approves a journal entry) are a common SOX finding; build an automated SoD check into the evidence extraction script that flags same-user create/approve pairs and outputs them as a separate exception report.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp