Acumatica User Role and Access Matrix Worksheet
Auditors and controllers ask the same question: who can create and approve the same transaction? This worksheet lays out users, roles and rights so conflicts show up before go-live and at each periodic review.
| User | Department | Acumatica role | Functional area | Access level | Can create | Can approve | SoD risk score | Reviewed by | Last review | |
|---|---|---|---|---|---|---|---|---|---|---|
8 | ||||||||||
1 | ||||||||||
2 | ||||||||||
1 | ||||||||||
8 |
The score is a simple triage aid: rows where one person both creates and approves score 8. It does not replace a formal SoD analysis of your Acumatica roles.
Automate your periodic access review
Ask how a read-only agent can pull role assignments and flag conflicts for your reviewers.
Optional. The tool and every export work without this. No spam.
How to use it
List each user and the Acumatica role that grants access, then the functional area and the access level. Mark whether the role lets the person create transactions and whether it lets them approve or release. The worksheet scores the combination, with create plus approve in one area scoring highest. Record the reviewer and date so the matrix doubles as evidence of a periodic access review. Export to Excel for audit files.
- Start from job functions, then design roles
- Give each person the least access that works
- Review administrators and approvers first
- Repeat the review at least annually and after role changes
Roles and access levels in Acumatica
Acumatica controls access through roles assigned to users, with rights set per screen and, where relevant, per field or entity. Common access levels are View Only, Insert, Update and Delete, and rights accumulate when a user holds several roles. That accumulation is why combined roles create hidden conflicts: a purchaser who also holds an approver role can raise and release a purchase order. Approval workflows add another layer, so check both role rights and approval maps.
Reading the score
A row scoring 8 means the same user can create and approve in that area and should have a documented compensating control, such as a second approver or an exception report. A score of 1 or 2 is normal. The total is useful for tracking improvement between review cycles, not as an absolute measure. Always examine the highest rows individually rather than relying on the sum.
Common mistakes
Teams copy the access of a departing employee to a new hire, carrying old conflicts forward. Another mistake is to leave the implementation consultant or an integration account with administrator rights after go-live. Service accounts used for API integrations also need a row, with a named owner and the narrowest rights possible.
Frequently Asked Questions
Is this a segregation of duties analysis?
It is a planning and triage aid. A formal analysis compares the actual rights of each role against a conflict rule set. Use this sheet to organize roles and reviewers, then confirm the real rights in Acumatica before relying on it for audit purposes.
How often should access be reviewed?
Quarterly for administrators and financial approvers, and at least annually for everyone else. Also review after any organizational change, acquisition or role redesign. Record the date and reviewer in the sheet for evidence.
Should integration accounts be listed?
Yes. API users and scheduled integration accounts often carry broad rights and are rarely reviewed. List them with an owner and the purpose of the integration so they are included in every access review.
Can I use it for other ERPs?
The structure works for any ERP with role based access. Rename the Acumatica role column and adjust the functional areas. The scoring logic is generic.
If you want continuous monitoring of access conflicts across your ERP using an on-prem model with read-only access, we can discuss what that looks like.
Related Tools
Acumatica Data Migration Field Mapping Worksheet
Map each legacy field to its Acumatica screen and field, record the transform rule and owner, and track cleansing status. Exports to Excel.
ERP Migration & SelectionAcumatica Implementation Statement of Work Template
A fill-in SOW outline for an Acumatica project with scope, phases, deliverables, assumptions, customer responsibilities and approvals.
ERP Migration & SelectionSage Customization and Report Inventory Worksheet
List every custom report, script and integration in your Sage system, score its value and effort, and decide what to keep, replace or retire.
ERP Migration & SelectionERP Cutover Weekend Plan Template (Acumatica and Sage)
A fill-in cutover runbook with freeze times, final data loads, validation steps, go/no-go criteria and a rollback plan. Exports to PDF or Word.
More ERP Operations tools
See allKeep exploring
Free tools
- Acumatica Screen ID ReferenceLook up common Acumatica screen IDs and names for role setup, generic inquiries, import scenarios and support tickets.
- Acumatica Manufacturing Edition Setup ChecklistA group-by-group checklist covering the foundation, engineering data, shop floor, planning and costing setup for Acumatica Manufacturing.
- Acumatica Go-Live Cutover Checklist for ManufacturersA cutover checklist covering data, inventory, open orders, security, integrations and rollback before and after an Acumatica go-live.
ERP fixes and how-tos
- Acumatica Manufacturing Data Collection: Labor and Production EntryHow shop floor data collection works in Acumatica Manufacturing: clock, labor, move and material entry, who should enter what and how to keep data clean.
- Acumatica Manufacturing: Scheduling, Kiosk and EstimatingHow Acumatica Manufacturing handles production scheduling, the schedule board, shop floor kiosk entry and estimating, and what to set up first.
- Acumatica production demand 'Prepared': what it means and how to clear itWhat a Prepared production demand means in Acumatica Manufacturing planning, why it stays that way, and how to move it forward or clear it safely.
Guides
- ERP Segregation of Duties Setup GuideImplement segregation of duties in ERP systems with SoD conflict matrices, rule configuration, violation detection, and compensating controls for SOX compliance.
- ERP Role-Based Access Control Setup GuideImplement role-based access control in ERP systems with role design, permission matrices, least-privilege enforcement, and ongoing access governance processes.
- ERP User Access Review Process GuideEstablish a structured ERP user access review process with review cycles, certification workflows, exception handling, and audit evidence for SOX and ISO compliance.
AI on your ERP
- AI for Acumatica Manufacturing Edition, Built on Your Own DataAdd AI to Acumatica Manufacturing Edition without giving up control of your shop and cost data. Private LLMs and agents grounded in your Acumatica instance.
- AI for Acumatica Inventory and Purchasing: Stock, Reorder and Vendor Questions AnsweredAI for Acumatica inventory and purchasing: reorder risk, receipts, vendor lead times and stock questions answered in plain English via the REST API, read-only.
Integrations
- How to use ChatGPT with AcumaticaConnect ChatGPT to Acumatica: custom GPT actions over the REST API, exports versus live access, enterprise data controls and when a private model is better.
- How to add an AI chatbot to AcumaticaAdd an AI chatbot to Acumatica for staff or customers, grounded in ERP data and documents, with role-aware answers and an optional fully on-prem model.
Software
- AcumaticaWhat Acumatica is, how its manufacturing, distribution and financial modules work, how its REST API integrates, and which ERP alternatives to compare.
- Oracle NetSuiteOracle NetSuite explained for manufacturers: modules, SuiteScript, SuiteTalk and SuiteQL, cloud deployment, limits, alternatives and where AI helps.