Resources
What Is Segregation of Duties in NetSuite?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Segregation of duties means no one person controls a whole process from start to finish. In NetSuite, it means checking that the person who sets something up is not also the person who approves it or pays for it. Spread the work across two or three people, so a mistake or a bad act has to get past someone else.
What are the three kinds of work to split?
| Kind of work | Plain meaning |
|---|---|
| Approving | Saying yes to a payment, an entry or a change |
| Handling assets | Holding or moving money, checks or goods |
| Keeping records | Entering and changing the books |
Separate these responsibilities where practical. If staffing makes that difficult, management can evaluate and document other safeguards.
Why does it matter in NetSuite?
The practical concern is whether access lets someone complete incompatible steps without an independent check. Permissions are a starting point, not proof that the person used the access.
Which pairs of permissions should you check first?
| Pair | Why it deserves a look |
|---|---|
| Create vendors and pay bills | One person could set up a vendor and pay it with no second check |
| Create customers and issue credit memos | One person could add a customer and clear what it owes |
| Create journal entries and approve them | One person could post and approve the same entry |
A pair on one person is not proof of anything. It is a reason to look closer.
What if my team is too small to split every job?
That is common. Add a safeguard instead: an approval step, a notice to a second person, or a report that someone else reviews every week or two. Write down what you chose and why.
Frequently asked questions
Does segregation of duties mean I do not trust my team?
No. A tired afternoon is enough to cause a mistake. Splitting the work protects honest people as much as the company.
Is this the same as a user access review?
No. A user access review asks whether each person’s access fits their job. Segregation of duties asks whether one person holds access that should be split.
Your next step
Read Part 2 to get the two NetSuite reports you need: How to Run a NetSuite User Report, and How to Run a NetSuite Roles and Permissions Report. Get the free SOD Check Method Overview and the free How to Run the NetSuite Manage Users Report.
Part of the series How to Do a NetSuite Segregation of Duties Review Yourself.
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
Top internal controls and SOX education for growing companies.