Resources
How to Run a Workday User Access Report
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Workday can list who belongs to which security group in a report called Security Group Assignments – All Account Types. Your Workday system administrator runs it, makes sure four fields show, leaves every filter off, and exports it to Excel. Save a screenshot that shows the web address, the date and time, and the report. Menus and report names can differ by company.
What does the Workday user access report show?
It lists every Workday account and the security groups each account belongs to. A security group is a set of actions people in that group are allowed to take. Four fields are required:
1. Workday Account: which account the access belongs to.
2. Email – Primary Work: who that account is for.
3. Security Group: which groups the account belongs to. SOD Check maps each group to what it allows.
4. Active Status: whether the user is still active.
The standard report also shows other columns, such as Type and Manager. Leave them in. Do not add pay, salary or any other compensation field. This report covers access only.
What do I need before I start?
1. An account that can view users and security groups and run reports. This is usually the Workday system administrator account.
2. A plan to run the report for every user. Do not filter it to selected users or groups. Filters hide the accounts you need.
3. Time to take your proof screenshot right after you export, while the report is still open.
How do I run it, step by step?
1. Sign in to Workday.
2. Type Security Group Assignments – All Account Types in the search box.
3. If it does not appear, ask your Workday reporting specialist to build it as a custom report. The settings are: Report Type Advanced, Data Source Security Groups, Data Source Type Standard, and Primary Business Object Security Group. Names can differ by company, so have your specialist confirm them.
4. Open Additional Info. Add or edit the fields so the four required fields show.
5. Run the report, then export it to Excel.
What proof should I keep?
Keep the report on screen and take a screenshot. It must show three things: the web address in the browser bar, the date and time on your computer clock, and the report itself. The web address helps show which Workday account the report came from. It does not prove the report is complete. The clock shows when you ran it. Do not crop, blur or black out these three things. Auditors often ask where a report came from and when it was run.
How should I save the file?
Open the Excel file. Add a tab named Evidence Screenshot and paste your screenshot into it. Save the file as CompanyName_Workday_Security_Group_Assignments_All_Account_Types_YYYY-MM-DD.xlsx. Then check four things:
1. Every account has an email, a security group and an active status. If any are blank, find out why before you rely on the file.
2. No filters are on.
3. The Evidence Screenshot tab shows the web address, the clock and the report.
4. The file opens in Excel.
What can I do with this report?
This report tells you which groups each person belongs to. It is the starting list for a segregation of duties review. The next step is to compare those groups with rules about which duties one person should not hold together.
Frequently asked questions
Do I need an administrator account?
You need an account that can view users and security groups and run reports. This is usually the Workday system administrator account.
What if the report is not in my search results?
Ask your Workday reporting specialist to build it as a custom report, using the settings in step 3.
Does the report include pay data?
No. Do not add pay, salary or any other compensation field.
Is this the same as a user access review?
No. A user access review asks whether each person’s access fits their job. The same report can feed both.
Your next step
Use the free How to Pull the Workday Security Group Assignments Report. It has pictures for every step. Want to see where one person may have too much control? Use the free How to Find Conflicting Duties: Highlight Conflicts Worksheet to list the pairs of rights that should not sit with one person, the roles that hold them, and which pairs to look at first.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.