Built for warehouses that get audited.
SOX and audit readiness for warehouses running Acumatica.
Role-based access, an immutable inventory transaction log, exportable user access reports and ERP reconciliation — the four things your IT auditor asks for.
Your WMS is in scope, and you will find out during the audit.
Inventory sits on the balance sheet. The systems that move it, count it and adjust it are subject to the same scrutiny as the general ledger. If your company is public — or a subsidiary, a division, or a supplier to one — your warehouse management system is almost certainly in scope for Sarbanes-Oxley Section 404, and most warehouse teams learn this in the room, when the auditor starts asking.
Illustrative only. The 30-minute pass flags what does not agree; it does not silently correct it. See how reconciliation works for the nightly comparison — including the two things to confirm before you rely on it for audit evidence.
The four questions, in the auditor's own words
“Who has access to post inventory adjustments — and who approved them?”
“Show me every login to your WMS over the past 90 days.”
“What happens when an employee is terminated? How quickly is their access revoked?”
“How do you know your WMS inventory matches your ERP?”
If your current system cannot answer those cleanly, that is a control gap, and it is yours — not your software vendor's.
No software vendor is “SOX certified.” That certification does not exist. SOX is an assessment of your internal controls, not a badge a product carries. What a WMS can do is produce the evidence your auditor asks for. Here is exactly what WMSi produces.
What your auditor gets.
Five control groups, each stated as the control it satisfies rather than the table it lives in.
Who can do what — and who changed it
Role-based permissions enforce least privilege at the function level. A receiving clerk receives and cannot post adjustments. A cycle counter counts and cannot approve their own variance. Segregation of duties is enforced by the role system, not by policy. Every role assignment and removal is logged with a timestamp and the administrator who made it.
Who got in, who was locked out, who left
Every login attempt — successful or failed — records username, source system, IP address and timestamp, with portal and scanner sessions tracked independently. Five consecutive failures locks the account automatically, and every unlock is logged. User creation, role change and deactivation are each recorded with the actor and the time.
Evidence you can hand over, not screenshots you have to assemble
Administrators pull a full User Access Report for any period, exportable to CSV. The inventory transaction log is immutable and timestamped across receipts, putaways, picks, adjustments, count results and transfers — each record carrying the user, the location and the lot or licence plate, queryable by date range, user, location and transaction type.
Proof that the WMS agrees with the ERP
WMSi posts every inventory movement to Acumatica in real time. A nightly comparison against Acumatica — by item, by location, by warehouse — is available in the portal, exportable to CSV. It shows the current state, not a history, and it must be enabled per warehouse.
How the two passes differSessions that expire, with the setting itself audited
Portal sessions time out after a configurable period of inactivity, between ten minutes and one hour, set by your administrator. Users are warned before the timeout and can extend. The timeout setting is itself stored in the audited system settings.
Two reconciliation mechanisms, and they answer different questions.
One is an operational safety net. The other is a nightly comparison you can export as evidence — if it's turned on for the warehouse in question. It is worth knowing which is which, and whether the second one is even enabled, before someone asks you in a control walkthrough.
The 30-minute pass
Every 30 minutes WMSi queries Acumatica directly for purchase orders closed in Acumatica with no matching webhook on the WMSi side. Anything that does not agree is flagged in the manager portal for review. It flags; it does not silently correct. This is the current scope of the pass — broader document coverage is planned, not shipped.
See the integration architectureThe nightly inventory reconciliation
Every night at 2:00 AM UTC, WMSi runs a full comparison against Acumatica for every item in every location: WMSi's quantity, Acumatica's quantity, the variance, and a status — in balance, WMSi over, Acumatica over, or Acumatica-only. Results live in the portal under Reports → Inventory Reconciliation, with a CSV export.
Where exceptions surfaceIt shows the last run only. Each warehouse gets one row, overwritten every night — there is no retained history to hand an auditor asking for a trend over time. If your control design needs a historical archive, export the CSV nightly and keep it yourself; WMSi does not accumulate one for you.
It is off by default. This reconciliation is enabled per warehouse, not turned on automatically. Confirm with your implementation contact that it is switched on for every warehouse your controls depend on — there is no email delivery, so nobody is notified if it is left off.
What auditors actually see.
| Control area | What auditors ask | WMSi response |
|---|---|---|
| Access control | Who can do what in the system? | Role-based permissions, least privilege enforced |
| User provisioning | How are users created and removed? | Full log with actor, timestamp and change detail |
| Login security | Are failed logins tracked and locked? | Login audit log, automatic lockout after 5 failures |
| Session management | Do sessions expire? | Configurable timeout with warning |
| Inventory trail | Can you trace every movement? | Immutable transaction log, full lot and LP traceability |
| ERP reconciliation | Does the WMS match the general ledger? | Automated reconciliation with exception reporting |
| Segregation of duties | Can one person receive and approve? | Role system enforces segregation at the function level |
Reconciliation is a system behaviour, not a monthly chore.
WMSi is built natively for Acumatica, so reconciliation is not a report someone assembles — it is a
comparison the system runs against your ERP on a schedule. Inventory movements post to Acumatica in real
time over an OAuth 2.0 REST connection, with ExternalRef idempotency so a retried post can
never become a duplicate document in your GL. Every customer runs on a dedicated VM with its own database,
so the data-isolation answer in your vendor questionnaire is one sentence long.
See the full integration architecture — authentication scope, idempotency, and what happens when a push notification does not fire.
Inventory is a balance sheet asset. Count it like one.
WMSi — audit & compliance
The answer to “is your WMS SOX-compliant?”
Compliance comes up whenever the prospect is a subsidiary of a public company or sits in a food, pharma or automotive supply chain. The answer:
“WMSi provides the access controls, audit trails and ERP reconciliation your IT auditors need to satisfy ICFR controls over inventory. We will walk your auditors through the control framework directly.”
The questions finance teams ask first.
Is WMSi SOX certified?
No software vendor is. That certification does not exist. SOX Section 404 is an assessment of your company's internal controls over financial reporting, not a badge a product carries. What WMSi does is produce the evidence your auditor asks for: role-based access enforcement, a login audit log, an immutable inventory transaction log, exportable user access reports and automated ERP reconciliation.
Do you hold SOC 2, ISO 27001 or a recent penetration test?
SOC 2 Type I is complete. Type II attestation has not been pursued yet. ISO 27001 is not certified. A third-party penetration test has not been published; ask about current status on a call rather than take a date stated here that may have moved.
How long are the audit logs retained?
The inventory transaction log is immutable. Audit logs are retained for 12 months.
Can we export the full transaction log, or only the User Access Report?
The User Access Report exports to CSV for any period. The inventory transaction log is queryable by date range, user, location and transaction type, and available for an auditor's sample as a full extract of every record matching the selected filter, exported as CSV — there is no sampling mechanism.
Who runs the dedicated VM, and what is the backup and recovery commitment?
Every customer runs on their own virtual machine with its own database — no shared infrastructure. Each customer runs on dedicated cloud infrastructure, US-based. Data is backed up nightly with encrypted snapshots retained for 30 days.
Is the five-failure lockout threshold configurable?
Five consecutive failed logins locks the account automatically and every unlock is logged. The lockout duration and the unlock path are configurable: five consecutive failures trigger a one-hour lockout by default; managers unlock individual accounts from the user detail page, or in bulk from Settings — Security — Lockouts.
Bring your auditor's list. We will go through it.
Twenty minutes, the real control screens, no slides. We sell through Acumatica VARs — tell us about your operation and we will introduce you to the right partner.