# Infor XA (MAPICS) User Access Review Worksheet

> Source: https://netray.co/tools/xa-mapics-user-access-review-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Review each user profile, last sign-on, role and conflicting duties, with a days inactive figure and review decision.

## Category

compliance-legal

## Erp

Infor XA

## Audience

- IT auditor
- System administrator
- Finance controller

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### User profile

**Key:** user

**Type:** text

#### Person

**Key:** person

**Type:** text

#### Department

**Key:** dept

**Type:** text

#### Role

**Key:** role

**Type:** select

**Options:**

- Order entry
- Purchasing
- Inventory
- Production
- Finance
- IT
- Read only

#### Last sign-on

**Key:** last

**Type:** date

#### Days since sign-on

**Key:** today_days

**Type:** number

**Help:** Enter manually from your review date

#### Conflicting duties

**Key:** conflict

**Type:** select

**Options:**

- No
- Yes

#### Decision

**Key:** decision

**Type:** select

**Options:**

- Keep
- Reduce authority
- Disable
- Investigate

**Rows:**

**User:** JSMITH

**Person:** J. Smith

**Dept:** Purchasing

**Role:** Purchasing

**Last:** 2026-10-15

**Today days:** 5

**Conflict:** No

**Decision:** Keep

**User:** MCHEN

**Person:** M. Chen

**Dept:** Finance

**Role:** Finance

**Last:** 2026-10-18

**Today days:** 2

**Conflict:** Yes

**Decision:** Reduce authority

**User:** TEMP02

**Person:** Contractor

**Dept:** IT

**Role:** IT

**Last:** 2026-03-02

**Today days:** 232

**Conflict:** No

**Decision:** Disable

**User:** RGOMEZ

**Person:** R. Gomez

**Dept:** Inventory

**Role:** Inventory

**Last:** 2026-09-30

**Today days:** 20

**Conflict:** No

**Decision:** Keep

**Totals:**

#### Profiles reviewed

**Key:** user

**Agg:** count

**Format:** integer

#### Longest inactivity in days

**Key:** today_days

**Agg:** max

**Format:** days

#### Average days since sign-on

**Key:** today_days

**Agg:** avg

**Format:** days

**Notes:** Enter days since sign-on yourself so it matches your review date. Typical conflicts include entering and approving purchase orders, or maintaining vendors and paying them.

## Content

**Intro:** Periodic access reviews are a standard audit request, and old XA systems tend to accumulate profiles for people who left years ago. This worksheet gives you a clean layout for the review, with the columns auditors usually ask for.

**Sections:**

#### How to run the review

**Body:** Export the list of user profiles from your system along with last sign-on dates. Paste or type them into the sheet, match each to a person and department, and have the department manager confirm the role. Mark any profile that holds incompatible duties and choose a decision for every row.

**Bullets:**

- Review shared and generic profiles first
- Disable before delete, so history is preserved
- Keep a dated copy of the exported sheet as evidence

#### What to look for

**Body:** Inactivity is the easy flag. Profiles unused for ninety days or more deserve a closer look. Segregation of duties is the harder one: the same person should not create and approve a purchase order, or maintain vendors and release payments. Contractors and temporary accounts need an end date and an owner.

#### Common mistakes

**Body:** Reviewers approve whatever the previous year said. Another common failure is reviewing only the ERP profile while the same person has powerful operating system or database access. Document the scope of each review so nobody assumes more coverage than there is.

**Bullets:**

- No evidence of manager sign-off
- Leaver profiles still active
- Shared accounts with no accountable owner

**Cta:** If reviewing XA access is a manual yearly scramble, we can discuss how to automate the data pull. The worksheet itself is free to use and export.

**Faq:**

#### How often should access be reviewed?

**Answer:** Many organizations review quarterly or twice a year, and sooner after reorganizations. Your auditors and policies set the minimum. More frequent review of privileged and finance profiles is common.

#### Is this a SOX control document?

**Answer:** It is a review worksheet that can support such a control, but it is not a complete control design. Align the columns and evidence with what your auditor requires.

#### Why is days since sign-on manual?

**Answer:** The worksheet cannot know your review date, so you enter the figure. Many teams calculate it in the source report and paste it across.

#### Where do I get the user list?

**Answer:** Your system administrator can extract profiles with last sign-on dates from the operating system and the application security tables. Check with them for the correct sources in your environment.

## Search terms

mapics xa user access review, as400 user profile audit template, erp access review worksheet, segregation of duties worksheet excel, inactive user review template, infor xa security audit, user authority review sheet, sox it general controls user review

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json