The best accounting software for mid-market companies with audit and regulatory requirements

Sage's help center documents an Audit History custom report for Sage Intacct with columns for the user, the field name and the field's value before and after each change, and a second, the User Permissions Activity report, that lists every change to a user's permissions with its date and time. We name Sage Intacct the best accounting software for a mid-market company with audit and regulatory requirements because those two reports, together with the read-only auditor setup in the same help center, give a finance team a documented way to hand its auditor record-change and permission-change evidence.

Oracle NetSuite suits a group that keeps separate accounting books for subsidiaries in several countries, which NetSuite OneWorld handles with Multi-Book Accounting and country tax audit files. SAP S/4HANA Cloud Public Edition suits a company adopting SAP's standard processes in countries where SAP delivers the local version and takes responsibility for its legal changes.

What should a mid-market company with audit requirements weigh in accounting software?

The SEC's rule on internal control over financial reporting puts the annual assessment on a registrant's management and requires an auditor's attestation from the filer classes it specifies, with an exception for emerging growth companies. Revenue alone does not place a company in one of those classes, so the starting point is the set of controls your own auditor plans to test.

The PCAOB's auditing standard AS 2201 has auditors test a control through inquiry, observation, inspection of documentation and reperformance. Which records your auditor inspects depends on the controls in scope. Where that scope includes system controls, we would ask each vendor to show two outputs: a record of changes with the old and new value, and a record of who held which permission during the period. Ask which subscription and which user role produce them, because the answer changes both the quote and the access you hand out.

The AICPA defines a SOC 1 report as an examination of controls at a service organization that are likely to be relevant to its customers' internal control over financial reporting, and its SOC 2 reports cover security, availability, processing integrity, confidentiality or privacy. Both describe the vendor's hosted service. Under AS 2201 an auditor looks at the report's period and the applications it covers, so ask each vendor for the report that matches the service and period you will run, along with the controls it leaves to the customer.

IFRS 10 requires a parent to present consolidated financial statements for the subsidiaries it controls, and IAS 21 separates an entity's functional currency from the currency its statements are presented in. Keeping a second set of books under another accounting basis is a different job, and so is producing the tax file or statutory report a country requires. List your legal entities and countries, then test each of those jobs separately in the edition you are quoted.

ERP Pilot's selection guide for mid-market ERP buyers sets the budget as a ceiling on three-year total cost of ownership. That ceiling compares vendors fairly when each one quotes the same legal entities, countries, modules and users, and when the reporting subscriptions and add-on products the audit evidence depends on are written into it.

HHS does not endorse or recognize private certifications of compliance with the HIPAA Security Rule, and its business associate guidance describes a vendor's assurances as a contract or other written arrangement. So a healthcare buyer that will put patient information in the accounting system asks each vendor for its business associate agreement and the conditions attached to it.

Sage Intacct, NetSuite and SAP compared on audit evidence and reporting scope

Sage Intacct: field history and permission history as exported reports

Sage Intacct's audit trail records who changed a record and when, with each edit shown in Before and After columns. It opens from the record and exports to formats that include Excel and PDF.

For a review across many records, Sage documents the Audit History report, whose columns include the user, the object, the field name and the field's value before and after. Sage's own example filters it to journal entries. It is a custom report, so it requires the Customization Services or Platform Services subscription and a business user with admin privileges to build it.

The User Permissions Activity report lists each change to a user's permissions with the action taken (Set, Grant or Revoke) and the date and time. It exports to Excel and CSV among other formats and carries the same subscription and admin requirements. A second custom report, Sage's permissions report for all users, lets an admin review what every direct user holds and export it to Excel; console users from outside the company are left out of it.

An auditor gets a read-only user or a read-only Auditor role in the setup Sage's help center recommends. Sage's permission model caps every role at the user's type, so a role cannot grant more than that type allows.

Sage's information security policy states that it maintains SOC 1 Type II and SOC 2 Type II opinions with its US production environments in scope, and that the environments for Sage AI Services sit outside those opinions. The same policy states that Sage Intacct maintains ISO 27001. Customers download the SOC reports and quarterly bridge letters through the Intacct Community, and a customer implemented by a partner asks the partner for them.

Sage Intacct keeps GAAP and tax adjustment books and user-defined books alongside the actual books, and a financial report picks its book column by column. Sage describes user-defined books as most commonly used for specialized adjustments to the actual books. Global Consolidation covers multi-entity companies with two or more base currencies, and country features are documented region by region: Making Tax Digital VAT submissions for the UK, and for Germany ELSTER submission with DATEV and GoBD exports.

Sage enters a business associate agreement only with customers that subscribe to its Advanced Audit Trail module and meet its listed conditions. Under its HIPAA guidelines, those include keeping protected health information in the contact, vendor and customer records and out of any sandbox company, and third-party services fall outside the agreement. Advanced Audit Trail is an optional subscription that logs access to personal data in those records, and it is separate from the edit history in the standard audit trail.

LA Opera, a nonprofit with a $50 million budget, moved to Sage Intacct with the implementation partner Armanino, and Sage's story on the opera company lists zero audit findings among its results. In another Sage story, the workforce nonprofit Towards Employment replaced QuickBooks after finding no approval-before-posting control and an inadequate audit trail, and chose Sage Intacct for its internal controls and audit trail.

Sage's US pricing page bases each plan on the modules included, built to the buyer's industry and size, and takes a request for pricing. The reporting subscription behind the two audit reports belongs on that request by name, and so does Advanced Audit Trail for a buyer that needs the business associate agreement.

Oracle NetSuite: several accounting books and country outputs in OneWorld

NetSuite's System Notes record, for each change to a record, the date and time, the person, the field and its old and new value. The help center says the notes cannot be edited by any user, script or app. Seeing them takes access to the record plus the Notes Tab permission, and querying all of them takes the Administrator role or the System Notes for Analytics and REST permission.

Each transaction line carries a History link that shows updates to that line and exports to CSV or XLS. The help center notes that this line-level history tracks updates to existing lines and does not record a line's creation or deletion.

The employee record carries a History subtab with the date and time, the user and a description of each change to role and global-permission assignments. Saved searches add fields such as Permission Change Date for roles and Role Change Date for employees, which a finance team runs for the period under review.

NetSuite's security page says the service is externally audited to SOC 1 Type 2 and SOC 2 Type 2 standards and maintains ISO 27001. Ask Oracle for the report's period and the service it covers before your auditor relies on it.

Multi-Book Accounting is available only in NetSuite OneWorld. The full feature supports five active accounting books including the primary book, with secondary books that use a different chart of accounts, currency or set of accounting rules, and the help center requires NetSuite Professional Services or an authorized Multi-Book partner to implement it. NetSuite's example is a company that keeps its primary records under US GAAP and adds books for the reports local governments mandate. Localization features are listed country by country in the help center, among them a GoBD tax audit file for Germany and FEC files for France.

An annual license made up of the core platform, optional modules and the number of users, plus a one-time implementation fee, is how NetSuite's ERP page describes its pricing. A quote for a multi-book group names OneWorld and the full Multi-Book feature, along with the implementation work Multi-Book requires.

Physitrack, a digital health company in London, appears in a NetSuite customer story that lists revenue of €15 million and nine subsidiaries. The company runs OneWorld for accounting and reporting requirements that vary by country, with automatic consolidation.

SAP S/4HANA Cloud Public Edition: local versions that SAP keeps current

SAP's help center lists 60 local versions that SAP delivers for S/4HANA Cloud Public Edition, the product SAP now markets as SAP Cloud ERP. SAP is responsible for legal changes in those versions. A country outside that list is handled as a customer local version, where the customer develops the country-specific functions and carries the legal changes.

The Public Edition uses parallel ledgers to report under a country's local accounting principles and under IFRS or US GAAP as well. Ledgers and local versions are separate questions, so check each return and statutory report you file against the content of the version for that country.

In the Public Edition's Manage Journal Entries app, a user selects a journal entry and displays its change history. A separate app, Display Change Documents, returns old and new values, the user responsible and timestamps for the change-document objects it covers, and SAP includes access to it in its external auditor business role template. SAP cautions that this app cannot apply detailed organizational restrictions, so a user sees change documents outside their own authorization area. Ask SAP which finance objects the app covers in the scope you are quoted.

SAP documents a User Access Review History Report under SAP Access Control 12.0, a separately named product. The report filters review requests by user, reviewer, status and action and exports the results. Confirm with SAP whether Access Control is in the proposed scope before you count on that report.

SAP's Trust Center lists a SOC 1 Type 2 report for the audit period October 1, 2025 through March 31, 2026, with S/4HANA Cloud Public Edition Finance Base and Finance Premium in its scope. The report is restricted, and SAP makes it available to qualifying customers that ran productive, financially relevant systems during the period.

AIDS Healthcare Foundation, a healthcare provider, paired the Public Edition with Concur, Ariba and SuccessFactors, and SAP's customer story reports payment runs cut from hours to minutes across that combined deployment. The pricing section of SAP's product page takes a request for a quote.

Which accounting software should a mid-market company with audit requirements choose?

Sage Intacct is our pick for a mid-market company with audit and regulatory requirements. Where an audit tests system controls, the history of changes to records and the history of changes to access are the outputs we would want ready, and Sage documents both as reports a controller filters to a period and exports, plus a read-only role for the auditor who reads them. Its nonprofit customer stories turn on the same things, internal controls and the result of the audit.

Both reports are custom reports that need the Customization Services or Platform Services subscription and an admin user to build them, which adds a subscription and a setup step to the purchase. We still put Sage Intacct first because the two reports cover both record changes and permission changes, with their columns named in Sage's help center. Put the subscription and the admin setup in the scope you ask Sage to quote.

NetSuite is the better pick for a group that keeps separate books for subsidiaries in several countries. Multi-Book Accounting in OneWorld gives a secondary book its own chart of accounts and currency, and the country features add tax audit files such as the GoBD file. Physitrack's story shows OneWorld handling country-specific accounting across a group's subsidiaries, and the implementation help Multi-Book requires belongs in the plan from the start.

SAP S/4HANA Cloud Public Edition is the better pick for a company that will adopt SAP's standard processes in countries on SAP's delivered list. SAP carries the legal changes for those local versions, which takes that maintenance off a finance team reporting in many of them, and parallel ledgers keep local principles beside IFRS or US GAAP. Settle with SAP whether the access review report in SAP Access Control is part of the scope.

Other accounting software providers