An ERP system nobody fully understands anymore, patched around instead of upgraded
Undocumented systems that depend on one person who happens to still work there
Remote vendor access to machine controllers that's never been reviewed
An ERP or MES migration that's stalled, with no clear end date
Software running production-adjacent systems that the vendor no longer supports
No real confidence that a backup would actually restore a plant system
Manufacturing Application Landscape
ERP, MES-related integrations, CRM, warehouse and inventory applications, quality and production reporting, custom software, databases, and business-critical integrations.
Infrastructure & Plant Connectivity
Servers, cloud & on-premise infrastructure, network topology, production to office dependencies, remote connectivity and single points of failure.
Unsupported applications and operating systems, aging infrastructure, obsolete dependencies, maintainability and upgrade constraints.
Security, Access & Vendor
Risk identity and access management, privileged accounts, remote vendor access, vulnerability management, backup security, logging and segmentation between systems.
Current-state ERP landscape, integration and data dependencies, migration blockers, solution fit, and project status and governance.
IT Organisation, Costs & Resilience
IT ownership, vendor management, licensing and cost issues, and disaster recovery and business continuity dependencies.
Before an ERP or MES migration
Before plant expansion or acquisition
After recurring downtime
Before legacy modernisation
When vendor access has grown uncontrolled
After major organizational change
Chudovo defines audit objectives together with what can and can’t be disrupted during the engagement.
Chudovo documents systems, dependencies, and data flows across IT and production-adjacent systems.
Chudovo interviews IT, plant, and vendor stakeholders to close the gap between documentation and how systems are actually used.
Chudovo conducts a hands-on assessment against the agreed scope.
Findings are ranked by what could disrupt production or cost the business the most, not by technical severity alone.
Chudovo walks through findings and priorities directly with your team before the engagement closes.
Challenge
Kelly-Moore Paints, a US paint manufacturer, needed an independent view of high-cost, underperforming IT operations across its stores and support functions.
What Chudovo Assessed
Application and infrastructure landscape, security programme, asset, vulnerability, change, and vendor management, disaster recovery, physical security, IT roles, financial management, and ERP alternatives. Chudovo’s CEO conducted part of the assessment on-site, in partnership with Sigma Global Consulting.
Decision/Output
A roadmap for reducing IT costs and correcting weaknesses across ERP, tooling, and data security.
Challenge
Pleuger, a German industrial engineering manufacturer, faced an Oracle ERP to proAlpha EBS migration with no clear end date, and implementation delays still unresolved.
What Chudovo Assessed
The IT department, proAlpha EBS modules, departmental needs, and the specific blockers slowing down the migration.
Decision/Output
A comprehensive action plan to address the issues that are preventing the migration due to data transfer and implementation.
Challenge
An aerospace component manufacturer needed an independent review of a desktop application used for modelling aircraft and spacecraft behavior during planning, design, and construction.
What Chudovo Assessed
Code quality and architecture, performance, security, testing, and compliance for the .NET/WPF desktop application.
Decision/Output
Identified security gaps and problem areas, with fixes that improved the client’s budgeting and ongoing software maintenance costs.
ERP platforms such as SAP, Microsoft Dynamics, Epicor, or Infor
On-premises and hybrid data centers
Identity and access platforms
Network and backup systems
OT-adjacent interfaces, where explicitly in scope
NIST CSF 2.0 — general cybersecurity risk-management framework
ISO/IEC 27001:2022 — information security management systems
NIST SP 800-82 Rev. 3 — OT-specific, where the engagement includes OT-related dependencies
IEC 62443 — industrial automation and control systems, where relevant
IT Audit Experience
Chudovo operates a dedicated IT audit practice covering applications, infrastructure, security, risk, and audit reporting.
Manufacturing Experience
Chudovo has audited enterprise IT operations, an ERP migration, and engineering software for manufacturing clients across different industries and risk profiles.
Software Engineering Expertise
This matters when audit scope includes source code, custom applications, integration architecture, or migration constraints, in addition to policy and control assessment.
