SyteLine Security and User Access Audit Checklist

0%

0 of 29 items complete

14 critical items still open - these are the highest-risk gaps.

Download checklist:

Users and accounts

Every active user maps to a current employee or named contractorCRITICALLeavers are disabled in SyteLine and in the directoryCRITICALShared and generic accounts are listed, justified or removedCRITICALInactive accounts over 90 days are reviewedDefault and vendor-supplied accounts have changed credentialsCRITICALNew user requests have a recorded approval

Roles and authorizations

Authorization groups are documented with an owner for eachAdministrator rights are limited to named peopleCRITICALUsers with form access to setup and parameters are reviewedCRITICALAccess to costing, price and margin data matches job rolesAccess to bank, payment and vendor master changes is restrictedCRITICALPermissions are reviewed each time a person changes role

Segregation of duties

No one both creates vendors and approves paymentsCRITICALNo one both creates purchase orders and receives goodsCRITICALInventory adjusters are separate from stock custodians where practicalJournal entry creators differ from approversCRITICALPrice and discount changes need review by a second personCompensating controls are written down where separation is not possible

Service accounts and integrations

Each integration uses its own account, not a person'sCRITICALService accounts have only the IDO and form access they needCRITICALPasswords or tokens are stored in a secrets store, not in scriptsDirect database logins are limited and reviewedCRITICALIntegration owners are named and contactableInterface logs are retained and checked for failures

Monitoring and evidence

Audit trail or change logging is enabled for sensitive dataFailed logins and lockouts are reviewedAccess reviews are done on a regular schedule with sign-offCRITICALEvidence from the review is stored for auditorsRemediation items have owners and due dates

Any unchecked critical item is a finding to log with an owner and date. The checklist is a review aid, not a replacement for your auditor's procedures or your internal policy.

Want a read-only access conflict report?

An optional discussion of generating a user and role report from your SyteLine data, with conflicts flagged for human review.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Run the review with the SyteLine admin, a representative from finance and the process owners, working from a current export of users and their authorizations. Tick each item as verified, note exceptions, and assign owners. Repeat at least once a year and after reorganizations. Export the completed list as evidence for auditors and keep the user export alongside it.

Start from a fresh export, not memory
Review by role, not by individual alone
Record decisions, not just results

Segregation of duties in practice

Small teams often cannot fully separate duties. In that case, document the conflict and the compensating control, such as a manager review of a daily exception report. What auditors dislike is not an imperfect separation, but an undocumented one. Focus first on high-risk pairs: vendor setup with payments, purchasing with receiving, and journal entry with approval.

Service accounts and integrations

Integrations are often the weakest part of access control. A shared account with administrator rights used by a script written years ago is common. Replace it with a dedicated account limited to the IDOs and forms it needs, rotate credentials, and store them properly. Review who owns each interface so that someone answers when it fails or changes.

Frequently Asked Questions

How often should we review SyteLine user access?

At least annually, and after any reorganization, system change or audit finding. Many companies run a quarterly review of privileged accounts and a yearly review of all users, matching their audit cycle.

What is the biggest access risk in an ERP like SyteLine?

Excess privilege that accumulates when people change roles, plus shared and service accounts with broad rights. Both are easy to overlook because nothing breaks until someone looks.

Do we need to do this for SOX compliance?

If SyteLine supports financial reporting at a regulated company, access reviews are a standard control. Your auditor defines the exact evidence needed, so align the checklist with their requirements.

How do I get a list of users and their permissions?

Use the user and authorization forms or the relevant IDOs to export the data, or ask your administrator for a report. Compare it with HR's current employee list to find leavers and mismatches.

Netray can help build a read-only access report from your SyteLine user and authorization data that highlights conflicts for your reviewers to assess.

Talk to an Expert Explore More Free Tools

Related Tools

Infor SyteLine

More Compliance & Contracts tools

See all

SyteLine Security and User Access Audit Checklist

0 of 29 items complete

Users and accounts

Roles and authorizations

Segregation of duties

Service accounts and integrations

Monitoring and evidence

Want a read-only access conflict report?

How to use the checklist

Segregation of duties in practice

Service accounts and integrations

Frequently Asked Questions

How often should we review SyteLine user access?

What is the biggest access risk in an ERP like SyteLine?

Do we need to do this for SOX compliance?

How do I get a list of users and their permissions?

Related Tools

SyteLine IDO Names Reference

SyteLine Upgrade Regression Test Checklist

SyteLine Reporting and BI Maturity Assessment

SyteLine License Optimization Calculator

More Compliance & Contracts tools