Accounts Payable: Xero vs Microsoft Dynamics 365 Business Central

Would migration improve the controls, and would it be financially worthwhile?

I assessed the accounts payable process of a four-person giftware retailer using Xero. The review mapped twelve policy controls against the evidence available in the accounting system. I then tested a Business Central sandbox using the Australian localisation to assess which limitations could be addressed.

The assessment found that the controls were designed and performed, but eight of the twelve had no corresponding record in the accounting system. As a result, they could not be consistently evidenced, tested or relied upon. For example, attaching a delivery note to a bill stores supporting documentation but does not demonstrate that the invoice, purchase order and delivery were matched.

Key findings

• A A$3,000 control-grading benchmark, equal to 1% of assumed turnover, was used to assess the findings against COSO’s deficiency scale. Limitations 7 and 8 were classified as a material weakness when considered together because one user could create a supplier, change its bank details, enter a bill and reconcile the payment without a second approval or independent review.
• The assessment identified ten limitations. Eight were structural and two were configurable. These were traced to three main system-design issues. Business Central addressed eight of the ten limitations in the sandbox.
• The financial case was less favourable than the control assessment. Annual licensing costs were estimated to increase by A$2,364, compared with A$1,920 in quantified annual savings. This produced a recurring cash shortfall of A$444 per year, before implementation costs of A$23,840 to A$38,840.
• Estimated payback ranged from 33 to 55 months and depended on redeploying approximately 0.14 FTE of released capacity. That capacity has no financial value unless it is used for additional work, deferred tasks or growth without hiring another employee.

Recommendation

I recommended deferring migration rather than rejecting Business Central as a platform. The immediate priority is to implement five compensating controls in Xero, particularly around supplier-master changes, payment preparation and independent approval.

The platform decision should be revisited if invoice volume remains above approximately 90 per month, the business adds a second entity or store, a fourth user needs to process transactions, or the strengthened Xero process fails to prevent or detect a control issue.

The main conclusion is that Business Central addresses genuine control limitations, but the current transaction volume does not provide enough measurable benefit to justify the migration cost.