Infor XA (MAPICS) User Access Review Worksheet
Periodic access reviews are a standard audit request, and old XA systems tend to accumulate profiles for people who left years ago. This worksheet gives you a clean layout for the review, with the columns auditors usually ask for.
| User profile | Person | Department | Role | Last sign-on | Days since sign-on | Conflicting duties | Decision | |
|---|---|---|---|---|---|---|---|---|
Enter days since sign-on yourself so it matches your review date. Typical conflicts include entering and approving purchase orders, or maintaining vendors and paying them.
Access review automation
An optional chat about producing review data directly from your systems.
Optional. The tool and every export work without this. No spam.
How to run the review
Export the list of user profiles from your system along with last sign-on dates. Paste or type them into the sheet, match each to a person and department, and have the department manager confirm the role. Mark any profile that holds incompatible duties and choose a decision for every row.
- Review shared and generic profiles first
- Disable before delete, so history is preserved
- Keep a dated copy of the exported sheet as evidence
What to look for
Inactivity is the easy flag. Profiles unused for ninety days or more deserve a closer look. Segregation of duties is the harder one: the same person should not create and approve a purchase order, or maintain vendors and release payments. Contractors and temporary accounts need an end date and an owner.
Common mistakes
Reviewers approve whatever the previous year said. Another common failure is reviewing only the ERP profile while the same person has powerful operating system or database access. Document the scope of each review so nobody assumes more coverage than there is.
- No evidence of manager sign-off
- Leaver profiles still active
- Shared accounts with no accountable owner
Frequently Asked Questions
How often should access be reviewed?
Many organizations review quarterly or twice a year, and sooner after reorganizations. Your auditors and policies set the minimum. More frequent review of privileged and finance profiles is common.
Is this a SOX control document?
It is a review worksheet that can support such a control, but it is not a complete control design. Align the columns and evidence with what your auditor requires.
Why is days since sign-on manual?
The worksheet cannot know your review date, so you enter the figure. Many teams calculate it in the source report and paste it across.
Where do I get the user list?
Your system administrator can extract profiles with last sign-on dates from the operating system and the application security tables. Check with them for the correct sources in your environment.
If reviewing XA access is a manual yearly scramble, we can discuss how to automate the data pull. The worksheet itself is free to use and export.
Related Tools
Infor XA (MAPICS) Custom Modification Inventory Worksheet
List every XA modification, score value and complexity, and see a priority score to guide keep, replace or retire decisions.
ERP Migration & SelectionVISUAL to CloudSuite Data Cleanup Worksheet
Track record counts, cleanup effort and owners for each master data object before a VISUAL to CloudSuite Industrial migration.
ERP Migration & SelectionERP Cutover Runbook Template for VISUAL and XA Migrations
A fill-in go-live weekend runbook with freeze time, task sequence, rollback criteria, contacts and approvals.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
- ERP Contract Clauses Glossary Reference