Resources
How to Do a NetSuite Segregation of Duties Review Yourself
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Run two NetSuite reports: one lists who holds each role, the other lists what each role can do. Filter the permissions, write a few rules, match the permissions to the rules, then look for people who hold both sides of a rule. Each match is a conflict to review, not proof of a problem. Seven short articles walk you through it.
What do you need?
1. A NetSuite administrator account, or the system administrator who can run reports for you.
2. Excel.
3. Time to check each export and review the results. How long it takes depends on your users, roles and rules.
What are the steps?
| Part | Question it answers | What you end up with |
|---|---|---|
| 1 | What Is Segregation of Duties in NetSuite? | The idea and three pairs worth checking first |
| 2A | How to Run a NetSuite User Report | An Excel file of every user and role, with proof of when you ran it |
| 2B | How to Run a NetSuite Roles and Permissions Report | An Excel file of what every role can do, with proof |
| 3 | How to Filter a NetSuite Permissions Report | A shorter list of the permissions that can change your records |
| 4 | How to Build Segregation of Duties Rules for NetSuite | A short list of permission pairs one person should not hold together |
| 5 | How to Match NetSuite Permissions to Your Rules | A short list of the permissions that matter for your rules |
| 6 | How to Find Segregation of Duties Conflicts in NetSuite | A list of conflicts to review, with the reason each one matters |
What can go wrong?
- You miss custom roles. Compare every role, not just the standard ones.
- You filter the report before you export it. Filters hide users and roles you need. Filter in a copy.
- You overwrite the original file. Keep it untouched so you can check your work later.
- You keep no record. Write down what you decided, who decided it and when.
Frequently asked questions
Can I do a segregation of duties review in Excel?
Yes, for a small set of rules. The pairs grow quickly as you add rules and users, so larger reviews need more than a spreadsheet.
Is this the same as a user access review?
No. A segregation of duties review looks for people who hold duties that should be split. A user access review asks whether each person’s access still fits the job more broadly. The same reports can feed both.
Does a conflict mean someone did something wrong?
No. A conflict is a reason to look closer. Management decides what it means.
Your next step
Download the free How to Run the NetSuite Manage Users Report and the free How to Run the NetSuite Show Role Differences Report, and have your NetSuite administrator run both reports. Want the idea first? Start with Part 1. Comparing ways to get this done? Use the free How to Compare Segregation of Duties Review Options.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.