IBM i (AS/400) User Profile Access Review Worksheet
Auditors ask the same questions on IBM i every year: who has all-object authority, who can administer security, and which profiles have not signed on for months. This worksheet records the answers and the manager sign-off in one place.
| User profile | Person or purpose | Group profile | *ALLOBJ (1 = yes) | *SECADM (1 = yes) | *JOBCTL (1 = yes) | Days since last sign-on | Risk score | Reviewer | Action | Review date | |
|---|---|---|---|---|---|---|---|---|---|---|---|
9 | |||||||||||
1 | |||||||||||
3 | |||||||||||
9 | |||||||||||
1 |
Collect the source data from your own system, for example the user profile listing with special authorities and last sign-on date. Weights in the risk formula are a simple starting point; adjust them to your policy. Profile names are examples.
Optional automated access report
Interested in a read-only report that fills this worksheet from your system? Tell us about your environment.
Optional. The tool and every export work without this. No spam.
How to use it
Export your profile list with special authorities and last sign-on date, then paste the key columns into the sheet. Mark each special authority as 1 or 0. The risk score is calculated for you. Send the exported sheet to each reviewer so they can confirm that the access is still needed, and record the action and date. Re-run the review on a fixed schedule, typically quarterly for privileged profiles and yearly for the rest.
- Review service and batch profiles separately from people
- Confirm group profile membership and owned objects
- Record the action taken and when it was completed
- Keep each completed review as audit evidence
Why these authorities matter
Special authority *ALLOBJ bypasses object-level authority checks. *SECADM allows creating and changing user profiles. *JOBCTL controls other users' jobs and queues. Granting any of them casually is the most common finding in IBM i audits. The risk score weights *ALLOBJ highest, *SECADM next and *JOBCTL lowest, and adds points for profiles idle for more than 90 days.
Reading the results
Sort mentally by risk. Any profile scoring eight or more deserves a written justification. A person with *ALLOBJ and no sign-on for months is a priority to disable. Check that vendor and consultant profiles are disabled when they are not on site, and that no application profile owns more objects than necessary.
Common mistakes
Teams review only named people and miss service profiles, whose passwords are never changed. Another mistake is deleting profiles that own objects, which leaves orphaned objects owned by a default. Transfer ownership first. Also check system values for password rules and security level in the same review, because individual profile hygiene cannot make up for weak system settings.
Frequently Asked Questions
How often should IBM i user profiles be reviewed?
Privileged profiles are commonly reviewed quarterly and all others at least yearly, but your policy or regulator sets the real schedule. Also review immediately when staff leave or when a consultant engagement ends.
Is *ALLOBJ ever acceptable?
For a small number of administrator and system profiles, yes, with documented justification. It should never be given to ordinary application users to make errors go away.
What does a high risk score mean?
It means the profile combines powerful authorities or dormancy. It is a prioritization aid, not a finding by itself. Review those profiles first and record the reason if access stays.
Does this replace a full security audit?
No. It covers user profile access only. A full review also covers system values, object authority, network access and auditing journals.
Netray can help build a repeatable, read-only report of IBM i profile data so that the quarterly review is prefilled instead of typed.
Related Tools
IBM i (AS/400) Disaster Recovery Runbook Template
Fill-in recovery runbook for an IBM i production partition: objectives, restore sequence, contacts, validation steps and drill history.
OracleJD Edwards World Custom Program and Modification Inventory Worksheet
Editable inventory of custom programs, modified objects and custom files with business criticality and a retire, keep or replace decision.
ERP OperationsIBM i Batch Job Schedule Documentation Worksheet
Editable run book of scheduled jobs with timing, dependency, owner, runtime and restart notes plus a total nightly batch window.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
- ERP Contract Clauses Glossary Reference