Infor LN VRC Development and Change Control Checklist
This checklist covers IT general controls around custom code on an on-prem Infor LN 10.x system: how VRCs are laid out, who can develop, how changes are approved and transported, and what evidence you hand auditors. It is about development control, not the periodic user access review.
0 of 29 items complete
9 critical items still open - these are the highest-risk gaps.
VRC structure
Developer access
Change approval
Transport and patching
Evidence for auditors
Critical items map to the controls auditors usually test first: segregation of development and production, restricted developer access, approved changes and periodic review. Treat any unchecked critical item as a likely audit finding.
Get your LN change controls reviewed before the audit
Send us your completed checklist and a sample of recent changes and we will point out the gaps an auditor is likely to raise.
Optional. The tool and every export work without this. No spam.
Why on-prem LN customers need their own evidence
People often search for an Infor LN SOC report expecting it to cover their system. The SOC reports Infor provides relate to Infor's cloud services, where Infor runs the infrastructure and the change process. When you run LN on your own servers, you operate the controls: who can change scripts, how changes reach production and who reviews access. Your external auditor will test those controls directly, usually by sampling changes and checking for approval and testing evidence, and by reviewing developer and superuser access. This checklist is the set of controls and the evidence they produce.
Where this lives in LN
Customizations live in customer VRCs derived from the standard update VRC, so the standard code stays intact and PMC solutions can still be installed. Scripts and libraries are maintained in Program Scripts / Libraries (ttadv2530m000), reports in Reports (ttadv3530m000), and developers normally work through LN Studio, which checks software components out to a developer and back in. Developer authorization and user types are held in user management (User Data, ttams1100m000) and must be converted to runtime to take effect. Package combinations bind VRCs to environments, which is how you keep development objects out of production.
How to use it
Run it once as a baseline with the development lead and the system owner, mark what exists today and attach evidence to each ticked item. Unchecked critical items become remediation actions with owners. Then rerun it every quarter as part of the access and change review, exporting the PDF as the review record. For the change log, sample five to ten production changes per quarter and confirm each has a change request, peer review for DAL or UE code, test evidence and a transport by someone other than the developer. Keep the periodic user access review on its separate checklist.
Common findings
The usual findings on LN systems are predictable. Developers keep developer authorization in production for support reasons. The bsp account password is shared and its use is not logged. Small report changes skip the change process because they feel harmless. Production objects were edited directly during an incident and never reconciled. Each of these is fixable: a break-glass account with logging for production fixes, named admin accounts, and a rule that every object in a customer VRC must trace to a change number.
Frequently Asked Questions
Does Infor provide a SOC report for Infor LN on-prem?
Infor's SOC reports cover its cloud services, not a system you host yourself. For on-prem LN, your organisation operates the change and access controls and must produce its own evidence. A SOC report from your hosting provider may cover infrastructure controls, but not LN development and access within the application.
How do I list active Infor LN users for an audit?
Export user records from User Data (ttams1100m000) with user type and status, and compare them against HR leavers and your licence position. Include developer authorization and superuser flags in the export, because auditors focus on those. Keep the export with a dated sign-off by the system owner.
What should an LN technical consultant follow for change control?
Develop only in a customer VRC on the development environment, check components out and in through LN Studio, link every change to an approved request, get DAL and UE code peer reviewed, and hand transport to production to someone else. Record each changed object with its change number.
Is this the same as a user access review?
No. A user access review checks that each user's roles and authorizations still fit their job. This checklist covers development: who can change code, how changes are approved and transported, and the evidence for that. Most audits test both, so run them as separate, linked reviews.
If you want auditors and IT to ask your LN system in plain English which objects changed and under which change number, we can set that up on your own servers.
Related Tools
Infor LN User Access Review Checklist
A practical checklist for periodic review of who can do what in Infor LN, covering roles, privileged access and segregation of duties.
Infor LN & BaanInfor LN PMC Solution and Patch Installation Checklist
A 5-stage checklist for installing Infor LN solutions and patches through PMC on an on-prem system, from reading the release notes to recording what is installed in production.
Infor LN & BaanInfor LN DAL Hook Review Checklist
Review checklist for LN data access layer (DAL) scripts: hook choice, validation, error handling, performance and upgrade safety.
Infor LN & BaanInfor LN Change Request Form Template
Fill-in change request form for LN and Baan changes, covering scope, impact, testing, rollback and sign-off.
Infor LN & BaanInfor LN Report Designer and Report Personalization Checklist
Checklist for changing Infor LN report output on-prem: choose between Report Designer personalization and a new report, build, route output, test and deploy.
More Infor LN & Baan tools
See all- Infor LN Session and Module Code Reference
- Infor LN Production Order Status and Lifecycle Reference
- Infor LN 4GL Session Script Template
- Infor LN Company and Enterprise Unit Design Worksheet
- Infor LN Warehousing Order Origins and Types Reference
- Infor LN Table Name and SQL Query Builder
- Infor LN Regression Test Effort Calculator
- Infor LN and Baan Customization Inventory Worksheet
- Baan to Infor LN Data Conversion Mapping Worksheet
Keep exploring
Free tools
- Infor LN Change Request Form TemplateFill-in change request form for LN and Baan changes, covering scope, impact, testing, rollback and sign-off.
- Infor LN User Access Review ChecklistA practical checklist for periodic review of who can do what in Infor LN, covering roles, privileged access and segregation of duties.
- Infor LN New Company Creation ChecklistStep-by-step checklist for adding a company to an on-prem Infor LN 10.x system, from planning the company number and table sharing to validating the first transactions.
ERP fixes and how-tos
- How to Check the Infor LN Version and Current Package VRCFind your Infor LN version, feature pack, porting set and current package VRC from the About box, Tools sessions and the server shell, and learn how to read them.
- Infor LN Report Designer: How to Build and Personalize ReportsHow reports are built and personalized in Infor LN: LN Studio's report designer, copying standard reports to a customer VRC, layouts, scripts and a safe workflow.
- Infor LN Studio: compile errors when building DAL/4GL codeInfor LN Studio compile errors on DAL and 4GL objects: how to read the build log, common unresolved-reference causes, and when a full rebuild fixes it.
Guides
- Infor LN API Development: REST, SOAP, and BOD Integration GuideBuild integrations with Infor LN APIs using BODs, web services, and the LN Integration Framework. Developer guide for LN REST and SOAP endpoint programming.
- Infor LN Report Development: Complete GuideCreate and customize Infor LN reports using BShell report sessions, Crystal Reports integration, and Infor Document Output Management for BAAN/LN systems.
- Infor LN Session Programming GuideComplete guide to Infor LN session programming. Session architecture, form design, data handling, and business logic implementation for LN developers.
AI on your ERP
- AI for Infor LN Project Control: Budget, Cost and Forecast Questions Answered From Your PCS DataAI for Infor LN Project Control: budget versus actual, forecast to complete and change tracking in plain language. Private, read-only by default.
- AI for Infor LN: Sessions, BODs, and Engineer-to-Order WorkAdd grounded AI to Infor LN 10.x or CloudSuite: natural-language answers over sessions and BODs, agents for project and engineer-to-order work, on-prem options.
Integrations
- How to use ChatGPT with Infor LNHow to use ChatGPT with Infor LN: exporting data versus live access through ION API, custom GPT actions, enterprise data controls, and when a private model fits better.
- How to add AI agents to Infor LNHow to add AI agents to Infor LN: a tool layer over ION API and BODs, read-only reporting first, approval before writes, and fully on-prem model hosting.