ASC 606: Application Portfolio Management
ASC 606 (Revenue from Contracts with Customers) requires organisations to recognise revenue by following a five-step model: identify the contract, identify performance obligations, determine the transaction price, allocate the transaction price, and recognise revenue when (or as) each obligation is satisfied.
How ASC 606 affects ERP managed services
ERP systems are the system of record for contract data, billing schedules, and revenue recognition journals. Managed services providers must understand how your ERP implements the five-step model — particularly how it handles variable consideration, contract modifications, and multi-element arrangements.
Managed services controls for ASC 606 compliance
| Control area | Managed services requirement | Evidence type |
|---|---|---|
| Access management | Provider access to production must follow least-privilege principle. Privileged access must be time-limited and logged. | Access logs, PAM tool reports |
| Change management | Every change to production configuration must go through an approved change process with before/after documentation. | Change tickets, approval records |
| Audit trail integrity | The provider must not modify or delete audit log data. Log integrity must be demonstrable (hash or WORM storage). | Log integrity reports |
| Incident response | Security incidents (or potential ASC 606 breaches) must follow a documented escalation path with defined notification timelines. | Incident records, notification evidence |
| Subcontractor management | If the provider uses subcontractors with access to in-scope data, those relationships must be disclosed and governed. | Subprocessor list, flow-down agreements |
What to include in your managed services contract for ASC 606
- A right-to-audit clause allowing your auditors (or external auditors) to review the provider's controls relevant to your environment
- A breach/incident notification SLA aligned to ASC 606 timelines
- An obligation to maintain SOC 2 Type II certification (or equivalent) and provide reports annually
- A prohibition on using your data to train models or for purposes beyond service delivery
- A data return/deletion clause at contract termination
Ready to assess your ERP managed services options?
Our specialists work with IT directors and finance leads at organisations managing one or more ERP platforms. An assessment takes 45 minutes and produces a written summary you can share with your steering committee.