Infor LN User Access Review Checklist for Audits
Auditors and internal controls teams ask the same question about every ERP: who can do what, and who agreed to it. This checklist structures that review for an Infor LN or Baan environment.
0 of 33 items complete
12 critical items still open - these are the highest-risk gaps.
Scope and evidence
Accounts and lifecycle
Roles and authorizations
Privileged and developer access
Segregation of duties
Sign-off and follow-up
Aim for every critical item ticked before sign-off. Anything unticked should become a dated action with an owner.
Get a role and user extract from LN
Optional help producing a read-only access report from your LN system for the review.
Optional. The tool and every export work without this. No spam.
How to run the review
Export the user and role lists first, then work through the groups with the module owners rather than alone. IT can show what access exists, but only the business owner can say whether it is still needed. Tick each item as you confirm it and note exceptions in the export. Run the review at least annually, and quarterly for finance and developer access, or whenever your auditors or regulations require.
Why these groups
Access reviews tend to fail in three places: leavers who keep their accounts, users who accumulate roles over years, and privileged access that nobody owns. The checklist puts those first. Segregation of duties covers the classic fraud and error pairs in procure to pay, inventory and cost. Where a conflict cannot be removed because the team is small, the standard answer is a compensating control such as an independent report review.
Evidence auditors expect
Keep the exported lists with a date, the reviewer name and the decision for each exception. A screenshot of an email saying all fine is weak evidence; a signed list with removals confirmed in the system is strong. Retain evidence for the period your policy or regulation requires, and keep the previous review so you can show findings were closed.
Common mistakes
Reviewing only active employees in HR but not integration accounts, treating developer rights in production as normal, and approving access in bulk without reading it are the usual failures. Another is reviewing roles by name only: a role called Planner may include update rights you did not expect, so read what sessions it actually grants.
Frequently Asked Questions
How often should LN user access be reviewed?
Annually is a common minimum, with finance, master data and developer access reviewed more often, for example quarterly. Listed companies and regulated sectors often have stricter rules, so check your audit and compliance requirements.
Who should approve the review?
The business owner of each module should confirm access for their area, and a security or controls owner should confirm privileged access. IT administers the change but should not be the only approver of business access.
Do test and development environments need a review?
Yes, at a lighter level. The main risks are production data copied into test with real users still enabled, and developer access that is also granted in production. Include them in scope and note the differences.
What if we cannot remove a conflicting role?
Document the reason, name the person, and add a compensating control such as an independent review of transactions the person can both create and approve. Record the control owner and review date.
If access reviews take weeks of spreadsheet work, we can help produce the user and role extract directly from LN, read-only, ready for owners to review.
Related Tools
Infor LN SQL Query Generator
Fill in the table, company number and key range to get read-only SQL for the LN database, with the physical table name built for you.
Infor LN & BaanInfor LN Cutover and Go-Live Checklist
A cutover checklist for Infor LN and Baan migrations: freeze, conversion, reconciliation, integrations, support and rollback decisions.
Infor LN & BaanInfor LN Integration Methods Reference
A comparison table of the main ways to move data in and out of Infor LN, with typical use, direction and cautions.
Infor LN & BaanInfor LN Batch Job Schedule Register
An editable register of scheduled and batch jobs in Infor LN with owner, frequency, dependencies and last run status.
More Infor LN & Baan tools
See all- Infor LN Session and Module Code Reference
- Infor LN Production Order Status and Lifecycle Reference
- Infor LN 4GL Session Script Template
- Infor LN Company and Enterprise Unit Design Worksheet
- Infor LN DAL Hook Review Checklist
- Infor LN Warehousing Order Origins and Types Reference
- Infor LN Table Name and SQL Query Builder
- Infor LN Regression Test Effort Calculator
- Infor LN and Baan Customization Inventory Worksheet
New to Infor LN and Baan? Start with the Infor LN and Baan guide and toolkit, or plan with Training Path Builder, Upgrade Path Planner, ERP Table and Field Explorer.
Keep exploring
Free tools
- Infor LN User Role and Authorization Matrix WorksheetRole-by-function matrix for LN access reviews, with access level, risk rating and segregation of duties flags.
- Infor LN DAL Hook Review ChecklistReview checklist for LN data access layer (DAL) scripts: hook choice, validation, error handling, performance and upgrade safety.
- Infor LN Go-Live Readiness ChecklistGo or no-go checklist for an LN implementation, upgrade or Baan migration, with critical items flagged.
ERP fixes and how-tos
- Infor LN Not Authorized to Run This Session: How to Fix ItInfor LN blocks a user with a not authorized to run this session message. Here is what the authorization check verifies and how to grant access fast.
- How to Add Users in the Baan / Infor LN GUI (Including Admin Access)Step by step: create a user in Baan or Infor LN with the User Data session, copy from a template, assign roles and authorizations, and what admin access you need.
- How to Create an Infor LN User from a User Template and Copy AuthorizationsCreate Infor LN users from user templates and roles, copy authorizations safely, and avoid the common mistakes that give new users too much or too little.
Guides
- Infor LN SoD and Authorization Model Deep DiveInfor LN SoD (segregation of duties) explained: how LN roles, session authorizations and company security work, and how to build a SoD conflict matrix.
- Infor LN Segregation of Duties and ERP SoD: Conflicts, Matrices, and ControlsInfor LN segregation of duties: build an SoD conflict matrix, map conflicts to LN sessions and roles, test SyteLine too, and document controls for auditors.
- ERP User Access Review Process GuideEstablish a structured ERP user access review process with review cycles, certification workflows, exception handling, and audit evidence for SOX and ISO compliance.
Integrations
- How to use ChatGPT with Infor LNHow to use ChatGPT with Infor LN: exporting data versus live access through ION API, custom GPT actions, enterprise data controls, and when a private model fits better.
- How to add AI agents to Infor LNHow to add AI agents to Infor LN: a tool layer over ION API and BODs, read-only reporting first, approval before writes, and fully on-prem model hosting.