Resources
How to Filter a NetSuite Permissions Report
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Your roles and permissions report has thousands of rows. Which ones matter?
Export the permission data to Excel and copy it to a new tab. For the example rules in this series, filter the copy to Create, Edit and Full, because those levels can change your records. Keep the unfiltered source. Other rules and risks may need other permission levels.
What are the five permission levels?
| Level | What it lets a role do | Keep it for these examples? |
|---|---|---|
| Create | Create a transaction or item | Yes |
| Edit | Create and change it | Yes |
| Full | The most power: create, change and delete | Yes |
| View | See it, but do nothing with it | No |
| None | Does not have the permission | No |
View and None sit outside the change-permission examples in this series. They may still matter for other access risks.
How do I filter the report, step by step?
1. Run both reports from Part 2. Save the originals and leave them untouched.
2. Copy the roles and permissions data into a new tab. Name it Filtered Permissions. The original stays as it is.
3. Add each person to the permissions. The user report lists a person and a role. The permissions report lists a role and a permission. Join them on the role name. In Excel, use Merge Queries (Data tab, then Get Data, then Combine Queries). A normal lookup returns only one match per role, so it is not enough here. Check that every role in the user report found a match, and look into any that did not.
4. Turn on filters on the header row.
5. In the working copy, filter the level column to Create, Edit and Full.
6. Expect repeats. A person may hold the same permission through more than one role. That is normal.
7. Save with a new name and today’s date.
What can go wrong?
- You filter the original file. Always work in a copy.
- You skip custom roles. Make sure every role is in the data.
- You lose track of which file is which. Put the date in the file name.
Frequently asked questions
Why remove View?
A View permission lets a role see a record but not change it. It sits outside these examples, but another rule may still need it.
Why do I see the same permission twice for one person?
A person can hold more than one role, and more than one role can carry the same permission.
Your next step
You now have a shorter list. Next, decide which pairs of permissions one person should not hold together: Part 4, How to Build Segregation of Duties Rules for NetSuite. Get the free How to Run the NetSuite Show Role Differences Report and the free sample workbook, How to Prepare Segregation of Duties Analysis for NetSuite Template.
Part of the series How to Do a NetSuite Segregation of Duties Review Yourself.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.