Resources
How to Build Segregation of Duties Rules for NetSuite
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
You have a filtered list of permissions. Which combinations should worry you?
A segregation of duties rule is a pair of permissions that one person should not hold together. List your pairs. For each person, check whether they hold both sides. Each person who does is a potential conflict to review, not proof of wrongdoing.
What do three example rules look like?
| Rule | Side A | Side B | Why it deserves a look |
|---|---|---|---|
| 1. Customer file and credit memos | Maintain customers | Issue credit memos | A person could add a customer and clear what it owes |
| 2. Vendor file and vendor payments | Maintain vendors | Print checks or pay bills | A person could add a vendor and pay it with no second check |
| 3. Journal entries | Create journal entries | Approve journal entries | A person could post and approve the same entry. Errors count too, not only fraud. |
These are three examples. Your company may need more, depending on its processes.
What does a potential conflict look like?
Illustration, not real data. Dana works in accounts payable. Her roles let her maintain vendors and pay bills. That is both sides of Rule 2, so Dana is a potential conflict. It may be fine: perhaps a second person approves every payment before it goes out. Someone with authority decides, and writes down why.
How do I build my own list, step by step?
1. Write each rule as Side A and Side B. Next to each side, put the NetSuite permission names.
2. For each person, gather all permissions from all their roles.
3. For each rule, mark the people who hold both sides.
4. Review each potential conflict. Is there a second person who checks the work? Is there a good business reason?
5. Present each potential conflict to the responsible business owner. Management evaluates the risk and safeguards, documents the decision and authorizes changes. System staff make the approved access changes.
6. Keep a record of each decision, with the date and who decided.
What if my team is too small to split the work?
Add a safeguard. Use an approval workflow. Send an automatic notice to a second person when the same person creates and approves a journal entry. Or run a report every week or two and send it to the approver, so monitoring does not have to be daily.
Frequently asked questions
How many rules do I need?
Start with a few that cover your riskiest processes: payments, customer credits and journal entries. Add more as your review matures.
Does holding both sides mean someone did something wrong?
No. It means the combination deserves a closer look.
Your next step
Take your rule list to Part 5: How to Match NetSuite Permissions to Your Rules. Use the free How to Find Conflicting Duties: Highlight Conflicts Worksheet to list the pairs of rights that should not sit with one person, the roles that hold them, and which pairs to look at first.
Part of the series How to Do a NetSuite Segregation of Duties Review Yourself.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.