NetSuiteFree worksheetPDF, Excel, Word exportNetSuiteAll NetSuite tools

NetSuite Role Permission Matrix Worksheet

Auditors and controllers regularly ask who can create vendors, post journals or adjust inventory in NetSuite. This worksheet documents each role and permission level by record area, scores the risk and exports to Excel so access reviews are repeatable.

Free, optional. Reopen it on any device.

Download:

Role	Record or permission area	Permission level	Level score (0 to 4)	Sensitivity (1 to 3)	Risk score	Reviewer	Last reviewed
					12
					9
					8
					3
					8
					6
					4
					12

Total risk score

Highest risk score

Average risk per row

7.75

Highest single score

Risk score is level times sensitivity, with a maximum of 12. Review every row of 9 or more. Use the Setup, Users/Roles area and the role's permission subtabs in NetSuite to confirm levels, and check for the same user holding two conflicting roles.

Automate your NetSuite access review

Optional: see how a read-only report over roles and users can flag conflicting access without exporting by hand.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

How to use the worksheet

List one row for each role and record area you want to review. Select the permission level, enter the score and rate the sensitivity of the area, then assign a reviewer and date. The risk score is computed for you. Start with the areas that touch money or master data, such as vendors, bills, payments, journal entries, inventory adjustments, price lists and role administration, then widen the scope over time.

NetSuite permission levels

NetSuite permissions use five levels. None gives no access, View allows reading, Create allows adding new records, Edit allows changing existing records, and Full allows everything including deletion where it applies. Each permission is also tied to the role as a whole, so a user with several roles gets the combined access. Review the roles assigned to each user, not only the roles themselves.

Segregation of duties

Segregation of duties means one person cannot start and approve the same financial action, such as creating a vendor and paying that vendor. Use the matrix to spot roles that hold conflicting full access, then fix them by splitting roles, adding approval workflows or placing a compensating review in the close process. Document exceptions you accept, with an owner and an expiry date.

Common mistakes

Teams copy the Administrator role to create custom roles, grant Full where View would do, leave leavers active, and forget that roles can be assigned to users per subsidiary. Another is a review done once and never repeated. Schedule it quarterly and keep each version of the exported file as evidence.

Frequently Asked Questions

What permission levels does NetSuite have?

NetSuite has None, View, Create, Edit and Full. Create adds records, Edit changes existing records, and Full includes the rest, including deletion where allowed. Choose the lowest level that lets the person do their job.

How do I export NetSuite role permissions?

You can build a saved search on roles and permissions, use a role list report, or record the permissions on this worksheet. Check what your account supports and confirm the output against the role record before sharing it with an auditor.

What does the risk score mean?

It multiplies the permission level by the sensitivity of the area, so full access on financial master data scores 12 and view access on low sensitivity data scores 1. Treat it as a way to sort what to review first, not as a formal rating.

How often should roles be reviewed?

Quarterly is common for financial roles and at least annually for the rest. Also review after any acquisition, system change, major hire or leaver wave, and keep the dated worksheet as evidence for your audit file.

If you need regular access reviews across several systems, Netray can build read-only reports from role and user data held in your ERP, on-prem if required.

Talk to an Expert Explore More Free Tools