How to Run an ERP User Access Review (Quarterly Checklist)

Quarterly access review procedure

1. 1Fix the scope: all production client or company, plus service accounts, integration users, API tokens and break-glass accounts. Test and sandbox tenants go in a lighter annual review.
2. 2Extract the population directly from the ERP, not from a spreadsheet someone maintained. SAP: SUIM user and role reports or tables USR02, AGR_USERS. NetSuite: Setup > Users/Roles > Manage Users with a saved search on role, last login and inactive flag. SyteLine: the Users and Authorizations forms plus the user tables in the application database.
3. 3Join the list to HR to find terminated, transferred and long-leave staff. Any active ERP account with no matching active employee or approved contractor record is a finding to fix first.
4. 4Add last-login data and flag accounts idle for 90 days or more. Dormant accounts are the most common audit exception and the easiest to remove.
5. 5Split the list by business owner (finance, purchasing, production, inventory, HR) and send each owner only their users and roles with a certify, modify or revoke choice.
6. 6Run a separate segregation of duties check on combinations such as create vendor plus approve payment, or create purchase order plus receive goods, and on any user holding admin or developer rights in production.
7. 7Execute every revoke or modify through your normal change ticket, then re-extract the list to prove the change took effect.
8. 8Archive the extract, owner responses, tickets and the final re-extract as one dated evidence pack.

Choosing reviewers and the review unit

-- Generic idle-account pattern (adapt table and column names to your ERP)
SELECT user_id, full_name, last_login_date, role_count
FROM erp_users
WHERE is_active = 1
  AND (last_login_date IS NULL OR last_login_date < DATEADD(day, -90, GETDATE()))
ORDER BY last_login_date;

Joiner, mover and leaver controls between reviews

Common pitfalls

• !Building the user list from an HR or IT spreadsheet instead of the ERP, which misses accounts created directly in the system.
• !Letting managers click approve-all without reading, then having no evidence of any revoke decisions. Track revoke rate; a rate of zero for several cycles is suspicious.
• !Reviewing only users and ignoring service accounts, integration tokens and API credentials, which often have the broadest access.
• !Not re-extracting after removals, so the evidence shows a decision but not an outcome.
• !Having the user's own manager certify administrator access without independent IT security oversight.
• !Deleting terminated users instead of locking them, which breaks created-by and posted-by history in some ERPs.