Resources
How to Find Segregation of Duties Conflicts in NetSuite
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
You have a short list of people and permissions. Who holds both sides of a rule?
List every pair of permissions each person holds. Check each pair against your rule list. A pair that matches a rule is a conflict to review, not proof of a problem. A pair that does not match falls outside your rules, so filter it out of your working view, never out of the source data. Management then decides what each conflict means.
What is a conflict?
A conflict is a potential conflict. The data suggests one person may hold both sides of a rule. You still need to confirm what the person can really do, the business reason and any safeguards.
How do I find the conflicts, step by step?
1. Copy the Part 5 list into a new sheet. Name it Final List for Conflicts. Keep the original.
2. Highlight repeated names and sort. In the working copy, filter out any person with fewer than two different permissions from your rules. One permission cannot make a pair. Do not delete rows in the source data.
3. For each remaining person, write every pair of their permissions on a new tab named Employee All Pairs. Example: if a person has permissions A, B and C, the pairs are A with B, A with C and B with C. Put the two names of each pair in alphabetical order and join them into one cell, for example “A | B”.
4. On your rule list, do the same: put the two sides of each rule in alphabetical order and join them into one cell.
5. Look up each person’s pair in the rule list with an exact match. Because both lists use alphabetical order, one lookup catches a pair whichever side was listed first.
6. In the working view, filter out the pairs that do not match. They are not matches to these rules, but could matter for other rules.
7. Add a lookup that pulls each rule’s risk description next to each conflict, so the list explains itself.
8. Review each conflict. Is there a second person who checks the work? Is there a business reason? What changes?
9. Record each decision with the date and who decided.
What do you do with a conflict?
| Option | What it means |
|---|---|
| Remove a role | The person no longer holds one side |
| Split the work | A second person takes one side |
| Add an approval or notice | Someone else sees the action |
| Review a periodic report | A second person checks after the fact |
| Accept and record why | Management decides the risk is acceptable and writes down the reason |
Management decides which one fits. Your authorized system staff make any access change.
What if the list gets very long?
With three rule groups, Excel works. As you add rules, the number of pairs for each person grows fast. Larger reviews usually need database tools, not a spreadsheet.
Frequently asked questions
Does a conflict mean fraud?
No. A potential conflict pair is a reason to look closer, not proof of a problem.
Why filter out people who appear only once?
A person with one matching permission cannot hold both sides of a rule.
Is this a user access review?
No. A user access review asks whether each person’s access fits their job. This looks for access that should be split.
Your next step
Work through your conflict list and record each decision.
Comparing doing it yourself with other options? Download the free How to Compare Segregation of Duties Review Options.
Part of the series How to Do a NetSuite Segregation of Duties Review Yourself.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.