Oracle EBS User Access Review Template
Auditors ask the same thing every year: who has access to what in EBS, and did anyone check? This template records a periodic user and responsibility review, with the population, procedure, exceptions and fixes, so the evidence is complete when the auditor asks.
Fill in
Oracle EBS User Access Review Template
Oracle EBS User Access Review
Company: Acme Components Inc. Reviewer: Dana Whitfield, Controller Period: Q3 2026 Review date: 2026-10-20
Scope and population
Scope: GL, AP, AR and PO responsibilities, plus System Administrator and Application Developer. Population: Extract from FND_USER and FND_USER_RESP_GROUPS_DIRECT, 412 active users
Procedure performed
| Step | Result |
|---|---|
| Obtain active user and responsibility list with end dates | |
| Compare to HR list of current employees and contractors | |
| Business owners confirm each user's responsibilities are still needed | |
| Check privileged responsibilities (System Administrator, Application Developer) | |
| Check conflicting responsibility pairs against the SoD matrix | |
| Review shared and generic accounts |
Exceptions
3 terminated employees with active accounts; 2 users holding both AP Invoice Entry and Payment responsibilities.
Corrective actions
End-date the 3 accounts by 2026-10-22. Remove one conflicting responsibility from each of the 2 users or document a compensating control.
Sign-off
Starting point for your own control documentation, not audit or legal advice. Keep the extract used as evidence with the signed form, and align the steps with your auditors' expectations.
Query user access without spreadsheets
Optional demo of read-only questions over user and role data, with the query shown.
Optional. The tool and every export work without this. No spam.
How to use the template
Run your user and responsibility extract first and note the source and count in the population field. Then walk through the procedure table with the business owners, fill in exceptions and corrective actions, and export the document to PDF or Word. Store it with the extract and any emails confirming owner approval. Repeat on a fixed schedule, quarterly for financial systems being common.
What to look at in EBS
Users are stored in FND_USER, with start and end dates, and their responsibilities in FND_USER_RESP_GROUPS_DIRECT or the older assignment tables, depending on the user management model. Focus on terminated staff with active accounts, privileged responsibilities, generic IDs, and combinations of duties that should be separate, such as entering and approving the same transaction or creating suppliers and paying them.
- End-dated users should not hold active responsibilities
- Privileged responsibilities need an owner and justification
- Define an SoD conflict matrix before the review
- Review function and menu exclusions, not only responsibility names
Common mistakes
Reviews often check responsibility names but not what the responsibility can actually do, since menus and function exclusions vary. Others rely on the user to confirm their own access, or close exceptions without evidence of the fix. Rerun the extract after remediation and attach it, so the record shows the problem is actually closed.
Frequently Asked Questions
Which tables show user access in Oracle EBS?
FND_USER holds users and their dates, FND_RESPONSIBILITY and FND_RESPONSIBILITY_TL describe responsibilities, and FND_USER_RESP_GROUPS_DIRECT links them. Newer user management also uses role based tables. Confirm against your version.
How often should EBS access be reviewed?
For financially significant systems, quarterly or at least semi-annually is common, plus a review after reorganisations. Your auditors and policy set the requirement, so follow those rather than a generic figure.
What is segregation of duties in EBS?
It means no single person can complete conflicting steps, such as creating a supplier, entering an invoice and releasing payment. You define conflicting responsibilities or functions in a matrix and test users against it.
Is this template enough for SOX?
It is a useful record of the review step, but SOX compliance depends on your whole control design and your auditors' view. Treat it as a starting point and adapt it with your compliance team.
If access reviews are a manual spreadsheet exercise, we can discuss a read-only way to query users, roles and conflicts directly, with human approval on any change.
Related Tools
Oracle EBS Profile Option Change Log Worksheet
Track every profile option change with its level, old and new value, reason and approver, so clones, upgrades and audits stop being guesswork.
OracleOracle EBS Instance Clone Request Template
A clone request form for EBS refreshes: source and target, backup point, data scrambling, post-clone configuration and sign-off.
OracleOracle EBS Concurrent Program Registration Request Template
A request form that captures everything an EBS developer needs to register a custom concurrent program: executable, execution method, parameters, request group and incompatibilities.
OracleOracle EBS GL Journal Import Worksheet
Prepare journal lines in the shape of GL_INTERFACE, check debits against credits per row set, and export to Excel or CSV before loading.
More Oracle tools
See all- Oracle EBS Inventory Tables Reference
- Oracle EBS WIP Tables Reference
- Oracle EBS Cycle Count Workload Calculator
- Oracle EBS Discrete Manufacturing Go-Live Checklist
- Oracle EBS Inventory Accuracy Readiness Assessment
- Oracle EBS Concurrent Request Phase and Status Reference
- Oracle EBS Responsibility Design Worksheet
- Oracle EBS GL Period Close Checklist
- Oracle EBS AP Invoice Interface Template