# Oracle EBS User Access Review Template > Source: https://netray.co/tools/oracle-ebs-user-access-review-template > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A periodic access review record for EBS users and responsibilities, with scope, evidence, exceptions and reviewer sign-off. ## Category oracle ## Erp Oracle E-Business Suite ## Audience - Internal auditor - EBS security admin - Finance controller ## Tool **Kind:** template **Output:** document **Fields:** #### Company **Key:** company **Type:** text **Default:** Acme Components Inc. #### Reviewer **Key:** reviewer **Type:** text **Default:** Dana Whitfield, Controller #### Review period **Key:** period **Type:** text **Default:** Q3 2026 #### Review date **Key:** date **Type:** date **Default:** 2026-10-20 #### Scope (modules, responsibilities) **Key:** scope **Type:** textarea **Default:** GL, AP, AR and PO responsibilities, plus System Administrator and Application Developer. #### Population source and size **Key:** population **Type:** text **Default:** Extract from FND_USER and FND_USER_RESP_GROUPS_DIRECT, 412 active users #### Exceptions found **Key:** exceptions **Type:** textarea **Default:** 3 terminated employees with active accounts; 2 users holding both AP Invoice Entry and Payment responsibilities. #### Corrective actions **Key:** actions **Type:** textarea **Default:** End-date the 3 accounts by 2026-10-22. Remove one conflicting responsibility from each of the 2 users or document a compensating control. **Blocks:** #### Oracle EBS User Access Review **Body:** Company: {{company}} Reviewer: {{reviewer}} Period: {{period}} Review date: {{date}} #### Scope and population **Body:** Scope: {{scope}} Population: {{population}} #### Procedure performed **Table:** **Columns:** - Step - Result **Rows:** **0:** Obtain active user and responsibility list with end dates **0:** Compare to HR list of current employees and contractors **0:** Business owners confirm each user's responsibilities are still needed **0:** Check privileged responsibilities (System Administrator, Application Developer) **0:** Check conflicting responsibility pairs against the SoD matrix **0:** Review shared and generic accounts #### Exceptions **Body:** {{exceptions}} #### Corrective actions **Body:** {{actions}} #### Sign-off **Signatures:** - Reviewer - Security administrator - Business owner - Internal audit **Notes:** Starting point for your own control documentation, not audit or legal advice. Keep the extract used as evidence with the signed form, and align the steps with your auditors' expectations. ## Content **Intro:** Auditors ask the same thing every year: who has access to what in EBS, and did anyone check? This template records a periodic user and responsibility review, with the population, procedure, exceptions and fixes, so the evidence is complete when the auditor asks. **Sections:** #### How to use the template **Body:** Run your user and responsibility extract first and note the source and count in the population field. Then walk through the procedure table with the business owners, fill in exceptions and corrective actions, and export the document to PDF or Word. Store it with the extract and any emails confirming owner approval. Repeat on a fixed schedule, quarterly for financial systems being common. #### What to look at in EBS **Body:** Users are stored in FND_USER, with start and end dates, and their responsibilities in FND_USER_RESP_GROUPS_DIRECT or the older assignment tables, depending on the user management model. Focus on terminated staff with active accounts, privileged responsibilities, generic IDs, and combinations of duties that should be separate, such as entering and approving the same transaction or creating suppliers and paying them. **Bullets:** - End-dated users should not hold active responsibilities - Privileged responsibilities need an owner and justification - Define an SoD conflict matrix before the review - Review function and menu exclusions, not only responsibility names #### Common mistakes **Body:** Reviews often check responsibility names but not what the responsibility can actually do, since menus and function exclusions vary. Others rely on the user to confirm their own access, or close exceptions without evidence of the fix. Rerun the extract after remediation and attach it, so the record shows the problem is actually closed. **Cta:** If access reviews are a manual spreadsheet exercise, we can discuss a read-only way to query users, roles and conflicts directly, with human approval on any change. **Faq:** #### Which tables show user access in Oracle EBS? **Answer:** FND_USER holds users and their dates, FND_RESPONSIBILITY and FND_RESPONSIBILITY_TL describe responsibilities, and FND_USER_RESP_GROUPS_DIRECT links them. Newer user management also uses role based tables. Confirm against your version. #### How often should EBS access be reviewed? **Answer:** For financially significant systems, quarterly or at least semi-annually is common, plus a review after reorganisations. Your auditors and policy set the requirement, so follow those rather than a generic figure. #### What is segregation of duties in EBS? **Answer:** It means no single person can complete conflicting steps, such as creating a supplier, entering an invoice and releasing payment. You define conflicting responsibilities or functions in a matrix and test users against it. #### Is this template enough for SOX? **Answer:** It is a useful record of the review step, but SOX compliance depends on your whole control design and your auditors' view. Treat it as a starting point and adapt it with your compliance team. ## Search terms oracle ebs user access review template, oracle ebs responsibility review sox, ebs segregation of duties review form, oracle apps user access audit, fnd_user responsibility review, oracle ebs periodic access recertification --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json