Resources
How to Match NetSuite Permissions to Your Rules
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
You have a long list of permissions and a short list of rules. How do you connect them?
List the permissions your rules use. In Excel, look up each person’s permissions against that list with an exact match. Remove the rows that do not match. For these example rules, keep only Create, Edit and Full. What remains are the permissions that could be part of a conflict.
What do you need?
1. The filtered permissions list from Part 3, with each person matched to their roles.
2. Your rules from Part 4.
3. Excel.
How do I match them, step by step?
1. Start with the filtered permissions list.
2. Copy both sides of every rule into a new tab. Name it Rule Permissions.
3. Remove repeated permission names. Keep the exact names from your rules. How many are left depends on your rules.
4. Make sure the names are spelled the same in the report and in the rule list. Copy them straight from the report, and remove extra spaces with the TRIM function.
5. On the people list, add a column named Match.
6. In the first Match cell, type a formula such as =VLOOKUP(C2,’Rule Permissions’!A:A,1,FALSE). C2 is the person’s permission. ‘Rule Permissions’!A:A is your list. FALSE means exact match. Copy the formula down.
7. Read the result. A permission on your list shows its own name. A permission not on your list shows #N/A.
8. In a working view, filter out the #N/A rows. Keep the original data unchanged.
9. Check the level column. It should show only Create, Edit or Full.
10. Save with a new name and today’s date.
What does the result look like?
You start with thousands of rows. You end with a short list of people and the few permissions that appear in your rules. Most of the work is behind you.
What can go wrong?
- A permission name is spelled a little differently in the report and in your rules. An exact match will miss it. Copy names straight from the report.
- You delete rows in the original. Work in a copy.
Frequently asked questions
Why do I need an exact match?
A near match can pick up the wrong permission. An exact match gives you only the names in your rules.
What does #N/A mean?
The permission is not on your list, so it does not match these rules. It may still matter for another rule or access review.
Your next step
You now have a short list. Next, find the pairs: Part 6, How to Find Segregation of Duties Conflicts in NetSuite.
Part of the series How to Do a NetSuite Segregation of Duties Review Yourself.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.