The Classic ERP Segregation of Duties Conflicts
Start with the conflicts that create real financial exposure rather than a 400-rule vendor ruleset you cannot remediate. In procure-to-pay, the fraud path is vendor master maintenance plus invoice entry plus payment release: create a fake supplier, bill yourself, pay yourself. In order-to-cash, the exposure is customer credit limit maintenance plus order release plus credit memo issuance.
In inventory, it is cycle count adjustment plus physical custody, which hides shrinkage. In IT, it is developer access to production plus the ability to move code, which defeats every other control you have. Most manufacturers can cover 80 percent of their risk with 30 to 60 well-chosen rules.
- Vendor master maintenance combined with accounts payable voucher entry or payment release
- Purchase order entry combined with receiving transaction posting and invoice approval
- Customer master or credit limit maintenance combined with sales order release and credit memo creation
- Inventory adjustment or cycle count posting combined with physical warehouse custody
Infor LN Segregation of Duties: Mapping Conflicts to Sessions, Roles, and SyteLine Authorizations
A conflict matrix is worthless until it is expressed in the objects your ERP actually enforces. In SyteLine and CloudSuite Industrial, that means form and IDO method authorizations granted through user groups, so a rule reads as group membership granting access to the Vendors form and the A/P Payments process. In Infor LN, authorizations are granted by session within a role and company, so a rule targets specific sessions such as Purchase Orders (tdpur4101m000) alongside payment sessions.
Build the matrix once at the function level, then maintain two technical mappings, one per ERP, so a business rule change does not require rewriting the whole ruleset.
Running the Analysis and Cleaning Up Results
Extract every user, group, and object authorization to a flat file and evaluate the matrix in SQL or a dedicated tool such as Fastpath, SafePaas, or Pathlock. Neither SyteLine nor LN ships a full native SoD engine, so most manufacturers run the first pass with scripts. Expect ugly numbers on the first run: a 250-user site commonly shows 400 to 900 raw conflicts.
Triage before you remediate. Remove access nobody has used in six months, split combined roles, and reassign the remaining true conflicts. Plan roughly ten to sixteen weeks from first extract to a clean, signed-off state including business validation.
- Extract users, groups, and object or session authorizations plus last login date in one dataset
- Suppress conflicts held only by break-glass accounts already covered by monitored check-out procedures
- Remediate by role split first, user reassignment second, and mitigating control only as the last resort
- Re-run the analysis after every remediation wave and keep the deltas as audit evidence
Try it here, free
Acumatica User Role and Access Matrix Worksheet
Plan which users get which Acumatica roles and access levels, score segregation of duties risk and export an auditor friendly matrix.
Mitigating Controls That Auditors Accept
In a plant with three people in finance, some conflicts cannot be removed. That is acceptable if the compensating control is specific, performed by someone independent, and evidenced. A vague statement that the controller reviews everything will fail.
A working control reads: the CFO reviews a report of all vendor bank account changes weekly against supporting documentation, signs it, and the signed report is retained for seven years. Tie each accepted conflict to a named control, a named reviewer, a frequency, and a retention location. Auditors test the evidence, not the policy, so build the report and the reviewer sign-off before the audit window opens.
How Netray Automates SoD Analysis for Infor ERP
Netray AI agents connect directly to SyteLine or LN security tables, normalize authorizations into function-level entitlements, and run your conflict matrix continuously rather than once a year. Instead of a static spreadsheet, you get a dashboard showing new conflicts within hours of a provisioning change, plus a recommended remediation for each one that considers what the user actually executes. Our first-pass reports typically reduce raw conflict counts by 60 to 75 percent through false-positive suppression and unused-access removal before a single role is touched, which is what makes the remediation project finishable.
Frequently asked questions
How do you handle segregation of duties in Infor LN?
In Infor LN, authorizations are granted by session within a role and company, so a segregation of duties rule targets specific sessions, for example a purchase order session alongside a payment session, held by the same user through any combination of roles. Build the conflict matrix at the business function level, map each function to LN sessions, extract user, role, and session authorizations with last login dates, and evaluate the matrix in SQL or a dedicated SoD tool. Remove unused access first, split combined roles second, and document a mitigating control only for conflicts you cannot remove.
What is segregation of duties in ERP?
Segregation of duties in ERP means splitting a business transaction across multiple people so no one individual can create, approve, and hide it. Practically, it is enforced by granting each role only the ERP forms, sessions, or transactions needed for one part of a process. The classic example is preventing the same user from adding a vendor, entering an invoice against it, and releasing the payment.
How do you build an SoD conflict matrix?
Start with business functions rather than technical objects. List the functions in each process, such as vendor maintenance, invoice entry, and payment release, then mark which pairs create fraud or error exposure. Aim for 30 to 60 high-value rules rather than a 400-rule catalog. Only after the business signs off do you map each function to specific SyteLine forms or LN sessions and run the technical analysis.
What if a small finance team cannot avoid SoD conflicts?
Small teams are expected to have unavoidable conflicts, and auditors accept them when a mitigating control is documented and evidenced. The control must be performed by someone independent of the conflicted user, run at a defined frequency, cover the specific risk, and leave a signed artifact. A weekly owner review of all vendor bank detail changes against source documents is a typical example that passes testing.
Run a continuous segregation of duties analysis across your SyteLine or Infor LN roles and walk into your next audit with a clean, evidenced conflict register.