I'm an auditor, and what you're saying is probably fair, but probably not a big deal. I have a lot of clients who either use Excel for their bookkeeping or provide us their full GL in Excel, so we always have the risk of changes being made, but we're not too concerned since our regular audit procedures would uncover it.

We're required to obtain an understanding of the control environment (so the ERP system in this case), and if we want to rely on its outputs we have to do dedicated testing over it. You're right though that if you do alter one transaction it's probably not going to come up in the audit samples. There's a bit of a gradient though between how much you alter and how much the auditors care, because auditors deal with things on a materiality basis. The more you manipulate the finances, the more material it becomes and the more we care, but also the more likely it will be uncovered. If you're changing a few trivial transactions we more certainly will never uncover it unless you're really unlucky, but then the effects of those trivial transactions is trivial anyways so it's not really a problem.

> So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided.

Oracle/SAP is NOT about whether the system is actually correct.

Oracle/SAP IS about whether the system not being correct is the legal liability of someone else.

> I could make any adjustment I want to posted GL transactions using SQL and knowledge of the chart of accounts and subledgers. No one would know unless it is a transaction picked for audit. This is true at least for Oracle ERP - there is no database row-level security for posted GL transactions.

> So auditors belief that an Oracle ERP system gives them confidence in a company audit is misguided.

I'm no expert, but I don't think typical auditors are there to find things like that.