Infor LN User Access Review Checklist (Free)

0%

0 of 33 items complete

12 critical items still open - these are the highest-risk gaps.

Download checklist:

Scope and evidence

Review period and LN environments (production, test, development) are definedCRITICALA current list of all LN user accounts has been exported with creation and last login datesCRITICALA list of all roles and the sessions or authorizations each role grants is availableThe business owner for each module has been identified as reviewerPrevious review findings and their closure status are on handReview evidence will be stored where auditors can retrieve it

Accounts and lifecycle

Every account maps to a named active employee or documented contractorCRITICALLeavers since the last review have been disabled on or before their last dayCRITICALAccounts unused for 90 days or more are reviewed for removalShared and generic accounts are listed, justified or removedCRITICALService and integration accounts have owners and are not used interactivelyPassword and lockout policy matches company standard or single sign-on rulesTransfers between departments triggered a role change, not role accumulation

Roles and authorizations

Each user holds only the roles needed for the current jobCRITICALRoles with update rights on finance, costing and bank data are limited to named peopleCRITICALAuthorization to change master data (items, business partners, price lists) is reviewedAuthorization to run job management and batch sessions is restrictedExport and data extract rights are reviewed for sensitive dataCustom roles are documented with purpose and owner

Privileged and developer access

Developer and tools authorizations are absent from production usersCRITICALAdministrator and database level accounts are listed and justifiedCRITICALAccess to run or maintain customization in production follows change controlOperating system and database access for the LN server is reviewed separatelyEmergency access is time limited and logged

Segregation of duties

Same user cannot create a purchase order and approve itCRITICALSame user cannot create a supplier and release its paymentCRITICALSame user cannot adjust inventory and own the cycle count resultSame user cannot maintain item cost and post production variancesConflicts that cannot be removed have a documented compensating control

Sign-off and follow-up

Each module owner has confirmed or revoked access in writingCRITICALRemoved access has been verified in the system, not only requestedFindings are logged with owner and due dateNext review date is scheduled

Aim for every critical item ticked before sign-off. Anything unticked should become a dated action with an owner.

Get a role and user extract from LN

Optional help producing a read-only access report from your LN system for the review.

Optional. The tool and every export work without this. No spam.

How to run the review

Export the user and role lists first, then work through the groups with the module owners rather than alone. IT can show what access exists, but only the business owner can say whether it is still needed. Tick each item as you confirm it and note exceptions in the export. Run the review at least annually, and quarterly for finance and developer access, or whenever your auditors or regulations require.

Why these groups

Access reviews tend to fail in three places: leavers who keep their accounts, users who accumulate roles over years, and privileged access that nobody owns. The checklist puts those first. Segregation of duties covers the classic fraud and error pairs in procure to pay, inventory and cost. Where a conflict cannot be removed because the team is small, the standard answer is a compensating control such as an independent report review.

Evidence auditors expect

Keep the exported lists with a date, the reviewer name and the decision for each exception. A screenshot of an email saying all fine is weak evidence; a signed list with removals confirmed in the system is strong. Retain evidence for the period your policy or regulation requires, and keep the previous review so you can show findings were closed.

Common mistakes

Reviewing only active employees in HR but not integration accounts, treating developer rights in production as normal, and approving access in bulk without reading it are the usual failures. Another is reviewing roles by name only: a role called Planner may include update rights you did not expect, so read what sessions it actually grants.

Frequently Asked Questions

How often should LN user access be reviewed?

Annually is a common minimum, with finance, master data and developer access reviewed more often, for example quarterly. Listed companies and regulated sectors often have stricter rules, so check your audit and compliance requirements.

Who should approve the review?

The business owner of each module should confirm access for their area, and a security or controls owner should confirm privileged access. IT administers the change but should not be the only approver of business access.

Do test and development environments need a review?

Yes, at a lighter level. The main risks are production data copied into test with real users still enabled, and developer access that is also granted in production. Include them in scope and note the differences.

What if we cannot remove a conflicting role?

Document the reason, name the person, and add a compensating control such as an independent review of transactions the person can both create and approve. Record the control owner and review date.

If access reviews take weeks of spreadsheet work, we can help produce the user and role extract directly from LN, read-only, ready for owners to review.

Talk to an Expert Explore More Free Tools

Related Tools

Infor LN & Baan

More Infor LN & Baan tools

See all

Infor LN User Access Review Checklist for Audits