The guide answers how Enterprise Resource Planning systems like SAP and Oracle provide crucial evidence in UK litigation, investigations, and disputes.
Guide · 17 pages · 23 min read · Published 2026-08-30
Written for UK legal practitioners handling complex commercial litigation, enterprise systems such as SAP and Oracle store critical transactional evidence that can dictate the outcome of high-value disputes. Commercial claims, procurement fraud, warranty disputes, and supply-chain failures routinely hinge on establishing an accurate history of events within the corporate system of record. Reconstructing these flows requires a precise understanding of purchase-to-pay processes, module architecture, change documents, audit logs, and authorisation evidence, alongside physical verification mechanisms such as three-way matching. Legal teams must navigate technical challenges surrounding data extraction at enterprise scale, system backups, production archives, and user identity attribution when logs show only a user ID. Addressing e-discovery strategies, CPR Part 35 expert reports, and full chain-of-custody documentation, this material equips solicitors with actionable checklists, red flag identification, suggested wording for preservation letters, and targeted interrogatories. Ultimately, it enables litigators to evaluate opponent objections regarding extraction cost or operational disruption, scrutinise technical disclosures, and instruct digital forensic experts effectively.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
17 pages · 23 min read
Enterprise Resource Planning (ERP) systems, such as SAP and Oracle, are the machine that runs the company, linking every disputed transaction into a documented flow with a change history.
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
ERPEVIDENCE · A GUIDE FOR UK LAWYERS ERP Evidence: SAP, Oracle and Enterprise Systems Purchase-to-Pay, Change Documents and the System of Record at Enterprise Scale COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CHANGE-DOCUMENT & WORKFLOW ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the machine that runs the company 03 Anatomy: modules, documents and the flow 04 Change documents, audit logs and the history layer 05 Approvals, workflows and author is at i on evidence 06 Scoping and extraction at enterprise scale 07 Patterns: procurement fraud, warranty and supply-chain disputes 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: THEERPLINKSEVERYDISPUTEDTRANSACTIONINTOA DOCUMENTEDFLOWWITHACHANGEHISTORY: FOLLOWTHEFLOW, READTHECHANGES, TESTTHEAPPROVALS
§ 02 · FIRST PRINCIPLES The problem in plain English: the machine that runs the company
§ 03 · ANATOMY Anatomy: modules, documents and the flow
§ 04 · THEHISTORYLAYER Change documents, audit logs and the history layer
§ 05 · WHO COULD, WHODID Approvals, workflows and author is at i on evidence
§ 06 · SCALE Scoping and extraction at enterprise scale
§ 07 · THEPATTERNS Patterns: procurement fraud, warranty and supply-chain disputes
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE TEST PRODUCTION ARCHIVE S / WAREHOUSE / BANKS & DELETED / SYSTEM BACKUPS REPORTING COUNTERPARTIES RECOVERABLE COPIES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEBANKDETAILSTHATCHANGEDFORNINEDAYS EXAMPLE2 · THE THREE - WAYMATCHTHATNEVERHAPPENED EXAMPLE3 · THETWOERPSTHATAGREEDAGAINSTTHEPLEADING
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · ERPLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The ERP checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can we really get evidence out of something as vast as SAP? What is a change document, in one paragraph? The opponent says extraction would cost a fortune and disrupt production. Genuine? Who actually did it, when the system only shows a user ID? The relevant years have been archived off the live system. Problem? Our supply dispute is really about what physically shipped. Can the ERP say?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
17 pages · 20 min read
Source code from platforms like GitHub and GitLab offers a detailed, date-stamped history of development.
17 pages · 19 min read
Document management systems, such as iManage and Net Documents, record every version and interaction with a document.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
