Resources
Delinea Fastpath, Netwrix Strongpoint or A2Q2 SOD Check?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Delinea Fastpath and Netwrix Strongpoint are software products that your company licenses and runs. SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. A2Q2 runs the analysis with its own technology, a human practitioner reviews it, and A2Q2 delivers the results. It is priced per check. All three help you see risky access. None decides risk for you. Before you compare features, decide how often you need results, who will run the work, and what each option costs.
Why would a Controller compare these three?
Picture an accounts payable specialist who can create a vendor and approve a payment. The specialist may be careful and honest. But one wrong bank number could go out with no second check. The Controller needs to find that combination, judge the risk, confirm safeguards and write down a decision.
Licensing software and ordering a diagnostic can both help. They leave different jobs with your team. It is like installing a new kitchen, or hiring a cook for one dinner. Both put food on the table. Who does the cooking, and who cleans up, is different.
How do the three compare?
For Delinea Fastpath and Netwrix Strongpoint, this table uses what each vendor says on its own web page. It is not a test of the products. Product names, modules and prices change, so confirm each point with the vendor. Key: ✓ yes, ✗ no, ? ask the vendor.
| Question | Delinea Fastpath | Netwrix Strongpoint | A2Q2 SOD Check |
|---|---|---|---|
| What is it? | Software your company licenses and runs. The page names Fastpath Access Control for access risk | Software your company licenses and runs, for NetSuite security and change management | A technology-enabled diagnostic service. A2Q2 uses technology to run the analysis and delivers the results as a service. A human practitioner reviews the results. It is not manual spreadsheets |
| What does the vendor say it covers? | Checks users, roles and permissions against ready-made segregation of duties rules, within one application and across applications | Finds segregation of duties conflicts with ready-made reports and helps clean up roles. Also reviews changes to the system | Finds segregation of duties conflicts with ready-made reports. Finds conflicts for each user, inside a role and between roles. Gives trended results, so you can compare the last check with the current one |
| Related products to ask about | Access Review, Access Provisioning, Change Tracking and Access Governance are named as separate modules | Ask which Netwrix offering and which edition is in your quote | Clear UAR for point in time user access review, another A2Q2 product |
| Who runs it? | Your company | Your company | A2Q2 runs the analysis |
| System access required | ? Expect your company to need a system administrator to set it up and keep it running. Confirm with the vendor | ? Expect your company to need a system administrator to set it up and keep it running. Confirm with the vendor | ✗ SOD Check does not access your systems. Your system administrator runs standard reports from our instructions. For NetSuite, that is two standard reports. No custom reports and no technical knowledge needed. No new software, no extra license and no user license |
| What does the vendor own? | ? The software. Ask whether ready-made rules or reports are included. Your company sets up the rest | ? The software. Ask whether ready-made rules or reports are included. Your company sets up the rest | ✓ The analysis, the ready-made reports, the rules and the report instructions. No rules required from you. Your company supplies the data, read-only to SOD Check, and keeps control of it. SOD Check does not change your data |
| What does your team still own? | Review results, confirm safeguards, record decisions. Also setup, rules and upkeep | Review results, confirm safeguards, record decisions. Also setup, rules and upkeep | Review results, confirm safeguards, record decisions |
| Watching all year? | ? Depends on setup. Ask the vendor | ? Depends on setup. Ask the vendor | ✗ No. A point in time review. It does not watch access between checks |
| What to ask before you license or order | ? What is the implementation cost? The maintenance cost? Is there a minimum commitment? Which modules are offered? | ? What is the implementation cost? The maintenance cost? Is there a minimum commitment? Which modules are offered? | ✓ What is the fixed price per check? |
Is the cost fixed or variable?
Ask every software vendor for four numbers: the implementation cost, the maintenance cost, any minimum commitment, and the price of each module you need. Ask how the price changes as your users or modules grow.
A2Q2 SOD Check is a fixed price. You pay per check, not by the number of users, and there is no implementation cost. That makes it a fixed cost. Software licenses can be a variable cost, so ask the vendor to show you how.
When might Fastpath fit?
It may fit when your company wants a software-led process and has people to run it. Ask which module does the work you need. The Fastpath Access Control page names Access Review, Change Tracking and Access Provisioning as other modules. Do not assume one quote includes them all. Then ask the question that matters most: once the tool shows a possible conflict, who reviews it?
When might Strongpoint fit?
It may fit when NetSuite access and change control are the main concern. Ask which Netwrix offering and edition you would get, and what it can examine in your setup. Have IT confirm the technical scope instead of relying on a feature list. Ask who will keep it running.
When might A2Q2 SOD Check fit?
It may fit when management wants a point in time review without licensing or running software. A2Q2 runs the analysis with its own technology and ready-made rules. Your company supplies the data, and A2Q2 gives you instructions for running the reports. SOD Check does not access your systems or change your data. It finds conflicts for each user, and over time you can compare each check with the last one. You review the results, confirm safeguards and record decisions. A2Q2 SOD Check does not watch access between checks and does not remove permissions.
Who answers which question?
| Person | Question to answer |
|---|---|
| Controller | Which process and which decision matter most? |
| IT director | Which systems are involved? What would setup and upkeep take? |
| System administrator | What system access does each option need, and who would provide it? |
| System owner | Who approves changes to the system? |
| Internal audit or SOX lead | What evidence and timing are expected? |
What should every provider answer?
1. Which systems, processes and dates are in scope?
2. Is this a point in time review or an ongoing process?
3. Who sets the conflict rules, and who reviews each potential conflict?
4. What system access and administration does it need from us?
5. What are the implementation cost, maintenance cost, minimum commitment and modules?
6. What does our company do after the results arrive?
A worked example
This example is an illustration, not a real company. The Controller wants to know who can create a vendor and approve a payment. She writes one sentence: “We need to find conflicting access in our payment process and record what management decides.” She sends the six questions above to all three providers. She records the answers in one row per provider: cost, who runs it, system access needed, what her team still owns, and when results arrive. Two answers need IT’s help, so she asks the IT director to review the setup and system access parts. She does not pick on price alone. She picks the option whose answers fit how often access changes, how many people can follow up, and whether she wants a fixed cost.
Frequently asked questions
Is one of these automatically best?
No. Software may suit an ongoing program. A point in time review may suit a defined question. Compare the work you need.
Is A2Q2 SOD Check just manual spreadsheets?
No. It is a technology-enabled diagnostic service. A2Q2 uses technology to run the analysis and delivers the results as a service. A human practitioner reviews the results. It is technology plus a human review, not manual spreadsheets. Your company does not license or install software for it.
Does a potential conflict prove wrongdoing?
No. It is a question for the business owner and the Controller. IT helps confirm what the access really allows.
Can a consultant help with software?
Yes. Setup help and the software license are different costs and scopes. Ask for each one separately.
Is the vendor information on this page a product test?
No. It comes from the vendors’ own web pages, read on 25 Oct 2026. Confirm each point with the vendor before you decide.
Your next step
This week, write the one-sentence goal from the example. Ask each provider the six questions. Use the free How to Compare Segregation of Duties Review Options to line up the answers side by side. You do not need to give an email address to get it.
Want to compare how often you need results? Read Continuous Monitoring or a Periodic Segregation of Duties Diagnostic? The overview is at /products/compare.
Top internal controls and SOX education for growing companies.
Where the competitor facts come from: Delinea Fastpath Access Control page, delinea.com/products/fastpath-access-control, read 25 Oct 2026. Netwrix Strongpoint for NetSuite page, netwrix.com/en/products/strongpoint/netsuite/, read 25 Oct 2026.