# IBM i (AS/400) User Profile Access Review Worksheet

> Source: https://netray.co/tools/ibm-i-user-profile-access-review-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Editable review sheet for IBM i user profiles that scores special authorities and dormant accounts and records manager approval for audits.

## Category

compliance-legal

## Erp

Oracle JD Edwards World

## Audience

- IBM i administrator
- IT auditor
- Security officer

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### User profile

**Key:** profile

**Type:** text

#### Person or purpose

**Key:** person

**Type:** text

#### Group profile

**Key:** group

**Type:** text

#### *ALLOBJ (1 = yes)

**Key:** allobj

**Type:** number

#### *SECADM (1 = yes)

**Key:** secadm

**Type:** number

#### *JOBCTL (1 = yes)

**Key:** jobctl

**Type:** number

#### Days since last sign-on

**Key:** days_idle

**Type:** number

#### Risk score

**Key:** risk

**Type:** number

**Expr:** allobj * 5 + secadm * 3 + jobctl * 1 + if(gt(days_idle,90), 3, 0)

**Format:** integer

#### Reviewer

**Key:** approver

**Type:** text

#### Action

**Key:** action

**Type:** select

**Options:**

- Keep
- Remove authority
- Disable profile
- Delete profile
- Investigate

#### Review date

**Key:** reviewed

**Type:** date

**Rows:**

**Profile:** QSECOFR

**Person:** Built-in security officer

**Allobj:** 1

**Secadm:** 1

**Jobctl:** 1

**Days idle:** 12

**Approver:** IT manager

**Action:** Keep

**Reviewed:** 2026-10-05

**Profile:** JDEBATCH

**Person:** Scheduled batch jobs

**Allobj:** 0

**Secadm:** 0

**Jobctl:** 1

**Days idle:** 1

**Approver:** IBM i admin

**Action:** Keep

**Reviewed:** 2026-10-05

**Profile:** JSMITH

**Person:** Former accounting clerk

**Group:** FINGRP

**Allobj:** 0

**Secadm:** 0

**Jobctl:** 0

**Days idle:** 412

**Approver:** Controller

**Action:** Delete profile

**Reviewed:** 2026-10-06

**Profile:** CONSULT1

**Person:** External consultant

**Allobj:** 1

**Secadm:** 0

**Jobctl:** 1

**Days idle:** 130

**Approver:** IT manager

**Action:** Remove authority

**Reviewed:** 2026-10-06

**Profile:** WHSUP02

**Person:** Warehouse supervisor

**Group:** WHGRP

**Allobj:** 0

**Secadm:** 0

**Jobctl:** 1

**Days idle:** 3

**Approver:** Warehouse manager

**Action:** Keep

**Reviewed:** 2026-10-07

**Totals:**

#### Combined risk score

**Key:** risk

**Agg:** sum

**Format:** integer

#### Profiles with *ALLOBJ

**Key:** allobj

**Agg:** sum

**Format:** integer

#### Longest idle (days)

**Key:** days_idle

**Agg:** max

**Format:** integer

**Summary:**

#### Profiles reviewed

**Key:** profiles

**Expr:** count

**Format:** integer

#### Average risk per profile

**Key:** avg_risk

**Expr:** avg_risk

**Format:** decimal

**Primary:** true

**Notes:** Collect the source data from your own system, for example the user profile listing with special authorities and last sign-on date. Weights in the risk formula are a simple starting point; adjust them to your policy. Profile names are examples.

## Content

**Intro:** Auditors ask the same questions on IBM i every year: who has all-object authority, who can administer security, and which profiles have not signed on for months. This worksheet records the answers and the manager sign-off in one place.

**Sections:**

#### How to use it

**Body:** Export your profile list with special authorities and last sign-on date, then paste the key columns into the sheet. Mark each special authority as 1 or 0. The risk score is calculated for you. Send the exported sheet to each reviewer so they can confirm that the access is still needed, and record the action and date. Re-run the review on a fixed schedule, typically quarterly for privileged profiles and yearly for the rest.

**Bullets:**

- Review service and batch profiles separately from people
- Confirm group profile membership and owned objects
- Record the action taken and when it was completed
- Keep each completed review as audit evidence

#### Why these authorities matter

**Body:** Special authority *ALLOBJ bypasses object-level authority checks. *SECADM allows creating and changing user profiles. *JOBCTL controls other users' jobs and queues. Granting any of them casually is the most common finding in IBM i audits. The risk score weights *ALLOBJ highest, *SECADM next and *JOBCTL lowest, and adds points for profiles idle for more than 90 days.

#### Reading the results

**Body:** Sort mentally by risk. Any profile scoring eight or more deserves a written justification. A person with *ALLOBJ and no sign-on for months is a priority to disable. Check that vendor and consultant profiles are disabled when they are not on site, and that no application profile owns more objects than necessary.

#### Common mistakes

**Body:** Teams review only named people and miss service profiles, whose passwords are never changed. Another mistake is deleting profiles that own objects, which leaves orphaned objects owned by a default. Transfer ownership first. Also check system values for password rules and security level in the same review, because individual profile hygiene cannot make up for weak system settings.

**Cta:** Netray can help build a repeatable, read-only report of IBM i profile data so that the quarterly review is prefilled instead of typed.

**Faq:**

#### How often should IBM i user profiles be reviewed?

**Answer:** Privileged profiles are commonly reviewed quarterly and all others at least yearly, but your policy or regulator sets the real schedule. Also review immediately when staff leave or when a consultant engagement ends.

#### Is *ALLOBJ ever acceptable?

**Answer:** For a small number of administrator and system profiles, yes, with documented justification. It should never be given to ordinary application users to make errors go away.

#### What does a high risk score mean?

**Answer:** It means the profile combines powerful authorities or dormancy. It is a prioritization aid, not a finding by itself. Review those profiles first and record the reason if access stays.

#### Does this replace a full security audit?

**Answer:** No. It covers user profile access only. A full review also covers system values, object authority, network access and auditing journals.

## Search terms

ibm i user profile review, as400 user access review template, as400 security audit excel, ibm i special authority audit, as400 allobj user list, ibm i dormant user profiles, jde world security review

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json