# Infor LN User Access Review Checklist for Audits > Source: https://netray.co/tools/infor-ln-user-access-review-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A practical checklist for periodic review of who can do what in Infor LN, covering roles, privileged access and segregation of duties. ## Category infor-ln ## Erp Infor LN ## Audience - LN administrator - IT auditor - Controller ## Tool **Kind:** checklist **Scoring Note:** Aim for every critical item ticked before sign-off. Anything unticked should become a dated action with an owner. **Groups:** #### Scope and evidence **Items:** **Text:** Review period and LN environments (production, test, development) are defined **Critical:** true **Text:** A current list of all LN user accounts has been exported with creation and last login dates **Critical:** true A list of all roles and the sessions or authorizations each role grants is available The business owner for each module has been identified as reviewer Previous review findings and their closure status are on hand Review evidence will be stored where auditors can retrieve it #### Accounts and lifecycle **Items:** **Text:** Every account maps to a named active employee or documented contractor **Critical:** true **Text:** Leavers since the last review have been disabled on or before their last day **Critical:** true Accounts unused for 90 days or more are reviewed for removal **Text:** Shared and generic accounts are listed, justified or removed **Critical:** true Service and integration accounts have owners and are not used interactively Password and lockout policy matches company standard or single sign-on rules Transfers between departments triggered a role change, not role accumulation #### Roles and authorizations **Items:** **Text:** Each user holds only the roles needed for the current job **Critical:** true **Text:** Roles with update rights on finance, costing and bank data are limited to named people **Critical:** true Authorization to change master data (items, business partners, price lists) is reviewed Authorization to run job management and batch sessions is restricted Export and data extract rights are reviewed for sensitive data Custom roles are documented with purpose and owner #### Privileged and developer access **Items:** **Text:** Developer and tools authorizations are absent from production users **Critical:** true **Text:** Administrator and database level accounts are listed and justified **Critical:** true Access to run or maintain customization in production follows change control Operating system and database access for the LN server is reviewed separately Emergency access is time limited and logged #### Segregation of duties **Items:** **Text:** Same user cannot create a purchase order and approve it **Critical:** true **Text:** Same user cannot create a supplier and release its payment **Critical:** true Same user cannot adjust inventory and own the cycle count result Same user cannot maintain item cost and post production variances Conflicts that cannot be removed have a documented compensating control #### Sign-off and follow-up **Items:** **Text:** Each module owner has confirmed or revoked access in writing **Critical:** true Removed access has been verified in the system, not only requested Findings are logged with owner and due date Next review date is scheduled ## Content **Intro:** Auditors and internal controls teams ask the same question about every ERP: who can do what, and who agreed to it. This checklist structures that review for an Infor LN or Baan environment. **Sections:** #### How to run the review **Body:** Export the user and role lists first, then work through the groups with the module owners rather than alone. IT can show what access exists, but only the business owner can say whether it is still needed. Tick each item as you confirm it and note exceptions in the export. Run the review at least annually, and quarterly for finance and developer access, or whenever your auditors or regulations require. #### Why these groups **Body:** Access reviews tend to fail in three places: leavers who keep their accounts, users who accumulate roles over years, and privileged access that nobody owns. The checklist puts those first. Segregation of duties covers the classic fraud and error pairs in procure to pay, inventory and cost. Where a conflict cannot be removed because the team is small, the standard answer is a compensating control such as an independent report review. #### Evidence auditors expect **Body:** Keep the exported lists with a date, the reviewer name and the decision for each exception. A screenshot of an email saying all fine is weak evidence; a signed list with removals confirmed in the system is strong. Retain evidence for the period your policy or regulation requires, and keep the previous review so you can show findings were closed. #### Common mistakes **Body:** Reviewing only active employees in HR but not integration accounts, treating developer rights in production as normal, and approving access in bulk without reading it are the usual failures. Another is reviewing roles by name only: a role called Planner may include update rights you did not expect, so read what sessions it actually grants. **Cta:** If access reviews take weeks of spreadsheet work, we can help produce the user and role extract directly from LN, read-only, ready for owners to review. **Faq:** #### How often should LN user access be reviewed? **Answer:** Annually is a common minimum, with finance, master data and developer access reviewed more often, for example quarterly. Listed companies and regulated sectors often have stricter rules, so check your audit and compliance requirements. #### Who should approve the review? **Answer:** The business owner of each module should confirm access for their area, and a security or controls owner should confirm privileged access. IT administers the change but should not be the only approver of business access. #### Do test and development environments need a review? **Answer:** Yes, at a lighter level. The main risks are production data copied into test with real users still enabled, and developer access that is also granted in production. Include them in scope and note the differences. #### What if we cannot remove a conflicting role? **Answer:** Document the reason, name the person, and add a compensating control such as an independent review of transactions the person can both create and approve. Record the control owner and review date. ## Search terms infor ln user access review, infor ln authorizations checklist, baan user authorization audit, infor ln segregation of duties, erp user access review checklist, infor ln role review, sox erp access review --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json