IBM i (AS/400) User Profile Access Review Worksheet
Auditors ask the same questions on IBM i every year: who has all-object authority, who can administer security, and which profiles have not signed on for months. This worksheet records the answers and the manager sign-off in one place.
| User profile | Person or purpose | Group profile | *ALLOBJ (1 = yes) | *SECADM (1 = yes) | *JOBCTL (1 = yes) | Days since last sign-on | Risk score | Reviewer | Action | Review date | |
|---|---|---|---|---|---|---|---|---|---|---|---|
9 | |||||||||||
1 | |||||||||||
3 | |||||||||||
9 | |||||||||||
1 |
Collect the source data from your own system, for example the user profile listing with special authorities and last sign-on date. Weights in the risk formula are a simple starting point; adjust them to your policy. Profile names are examples.
Optional automated access report
Interested in a read-only report that fills this worksheet from your system? Tell us about your environment.
Optional. The tool and every export work without this. No spam.
How to use it
Export your profile list with special authorities and last sign-on date, then paste the key columns into the sheet. Mark each special authority as 1 or 0. The risk score is calculated for you. Send the exported sheet to each reviewer so they can confirm that the access is still needed, and record the action and date. Re-run the review on a fixed schedule, typically quarterly for privileged profiles and yearly for the rest.
- Review service and batch profiles separately from people
- Confirm group profile membership and owned objects
- Record the action taken and when it was completed
- Keep each completed review as audit evidence
Why these authorities matter
Special authority *ALLOBJ bypasses object-level authority checks. *SECADM allows creating and changing user profiles. *JOBCTL controls other users' jobs and queues. Granting any of them casually is the most common finding in IBM i audits. The risk score weights *ALLOBJ highest, *SECADM next and *JOBCTL lowest, and adds points for profiles idle for more than 90 days.
Reading the results
Sort mentally by risk. Any profile scoring eight or more deserves a written justification. A person with *ALLOBJ and no sign-on for months is a priority to disable. Check that vendor and consultant profiles are disabled when they are not on site, and that no application profile owns more objects than necessary.
Common mistakes
Teams review only named people and miss service profiles, whose passwords are never changed. Another mistake is deleting profiles that own objects, which leaves orphaned objects owned by a default. Transfer ownership first. Also check system values for password rules and security level in the same review, because individual profile hygiene cannot make up for weak system settings.
Frequently Asked Questions
How often should IBM i user profiles be reviewed?
Privileged profiles are commonly reviewed quarterly and all others at least yearly, but your policy or regulator sets the real schedule. Also review immediately when staff leave or when a consultant engagement ends.
Is *ALLOBJ ever acceptable?
For a small number of administrator and system profiles, yes, with documented justification. It should never be given to ordinary application users to make errors go away.
What does a high risk score mean?
It means the profile combines powerful authorities or dormancy. It is a prioritization aid, not a finding by itself. Review those profiles first and record the reason if access stays.
Does this replace a full security audit?
No. It covers user profile access only. A full review also covers system values, object authority, network access and auditing journals.
Netray can help build a repeatable, read-only report of IBM i profile data so that the quarterly review is prefilled instead of typed.
Related Tools
IBM i (AS/400) Disaster Recovery Runbook Template
Fill-in recovery runbook for an IBM i production partition: objectives, restore sequence, contacts, validation steps and drill history.
OracleJD Edwards World Custom Program and Modification Inventory Worksheet
Editable inventory of custom programs, modified objects and custom files with business criticality and a retire, keep or replace decision.
ERP OperationsIBM i Batch Job Schedule Documentation Worksheet
Editable run book of scheduled jobs with timing, dependency, owner, runtime and restart notes plus a total nightly batch window.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
- ERP Contract Clauses Glossary Reference
New to IBM i (AS/400) ERPs? Start with the IBM i (AS/400) ERPs guide and toolkit.
Keep exploring
Free tools
- IBM i (AS/400) System Health Check ChecklistA practical weekly and monthly health check for IBM i partitions running ERP such as JD Edwards World, covering storage, jobs, patches, security and recovery.
- AS/400 (IBM i) Backup Verification ChecklistVerify that your IBM i saves actually completed, cover the right objects, are stored safely and can be restored, with critical items flagged.
- IBM i (AS/400) Disaster Recovery Runbook TemplateFill-in recovery runbook for an IBM i production partition: objectives, restore sequence, contacts, validation steps and drill history.
ERP fixes and how-tos
- How to Add a Private AI Layer to JD Edwards World on IBM iAdd AI to JD Edwards World without moving data: DB2 for i access, journal-based replication, rebuilt row security, local GPUs and approved batch write-back.
- How to Run an ERP User Access Review (Quarterly Checklist)How an IT manager runs an ERP user access review: pull the user and role list, get owner sign-off, test segregation of duties, and keep audit evidence.
- Cost profile in Oracle Fusion: cost organization, cost book and manufacturing costingHow cost organizations, cost books and cost profiles fit together in Oracle Fusion Cost Management, and how to set up manufacturing costing step by step.
Runs with your ERP
- RF-SMART Manufacturing Data Collection for JD Edwards WorldShop floor barcode data collection for JD Edwards World with RF-SMART: what it reports, how it connects, setup steps, pitfalls and a private AI layer on top.
- Vertex Tax Connectors with JD Edwards EnterpriseOneHow Vertex calculates sales, use and VAT tax for JD Edwards EnterpriseOne and World, plus Oracle EBS and Cloud ERP: integration model, flows, setup, pitfalls.
- RF-SMART and JD Edwards EnterpriseOne: Barcode Scanning and Mobile WMSHow RF-SMART connects barcode scanning to JD Edwards EnterpriseOne and World: integration method, data flows, setup steps, pitfalls and where private AI helps.
Guides
- Oracle JD Edwards to Infor: Migration Planning GuidePlan your Oracle JD Edwards EnterpriseOne migration to Infor CloudSuite or LN. Data mapping, functional comparison, and migration timeline.
- ERP User Access Review Process GuideEstablish a structured ERP user access review process with review cycles, certification workflows, exception handling, and audit evidence for SOX and ISO compliance.
AI on your ERP
- AI for JD Edwards World on IBM i, without a EnterpriseOne migrationAdd AI to JD Edwards World on IBM i without replatforming: read the physical files safely, ground an LLM on your data, and keep control on the box you already run.
- AI for JD Edwards EnterpriseOne Manufacturing, Without Leaving the F-Tables ExposedGrounded AI over JD Edwards EnterpriseOne Manufacturing: work orders, routings, and Orchestrator data, answered on-prem without sending F-table data to a public model.
Integrations
- How to add AI agents to JD Edwards World on IBM iHow to add AI agents to JD Edwards World on IBM i: a read-first tool layer over DB2 for i, human approval before any write, and a fully on-prem model option.
- How to use ChatGPT with JD Edwards WorldUsing ChatGPT with JD Edwards World on IBM i: custom GPT actions vs data exports, enterprise data controls, and when a private model is the better fit.