Infor XA (MAPICS) User Access Review Worksheet
Periodic access reviews are a standard audit request, and old XA systems tend to accumulate profiles for people who left years ago. This worksheet gives you a clean layout for the review, with the columns auditors usually ask for.
| User profile | Person | Department | Role | Last sign-on | Days since sign-on | Conflicting duties | Decision | |
|---|---|---|---|---|---|---|---|---|
Enter days since sign-on yourself so it matches your review date. Typical conflicts include entering and approving purchase orders, or maintaining vendors and paying them.
Access review automation
An optional chat about producing review data directly from your systems.
Optional. The tool and every export work without this. No spam.
How to run the review
Export the list of user profiles from your system along with last sign-on dates. Paste or type them into the sheet, match each to a person and department, and have the department manager confirm the role. Mark any profile that holds incompatible duties and choose a decision for every row.
- Review shared and generic profiles first
- Disable before delete, so history is preserved
- Keep a dated copy of the exported sheet as evidence
What to look for
Inactivity is the easy flag. Profiles unused for ninety days or more deserve a closer look. Segregation of duties is the harder one: the same person should not create and approve a purchase order, or maintain vendors and release payments. Contractors and temporary accounts need an end date and an owner.
Common mistakes
Reviewers approve whatever the previous year said. Another common failure is reviewing only the ERP profile while the same person has powerful operating system or database access. Document the scope of each review so nobody assumes more coverage than there is.
- No evidence of manager sign-off
- Leaver profiles still active
- Shared accounts with no accountable owner
Frequently Asked Questions
How often should access be reviewed?
Many organizations review quarterly or twice a year, and sooner after reorganizations. Your auditors and policies set the minimum. More frequent review of privileged and finance profiles is common.
Is this a SOX control document?
It is a review worksheet that can support such a control, but it is not a complete control design. Align the columns and evidence with what your auditor requires.
Why is days since sign-on manual?
The worksheet cannot know your review date, so you enter the figure. Many teams calculate it in the source report and paste it across.
Where do I get the user list?
Your system administrator can extract profiles with last sign-on dates from the operating system and the application security tables. Check with them for the correct sources in your environment.
If reviewing XA access is a manual yearly scramble, we can discuss how to automate the data pull. The worksheet itself is free to use and export.
Related Tools
Infor XA (MAPICS) Custom Modification Inventory Worksheet
List every XA modification, score value and complexity, and see a priority score to guide keep, replace or retire decisions.
ERP Migration & SelectionVISUAL to CloudSuite Data Cleanup Worksheet
Track record counts, cleanup effort and owners for each master data object before a VISUAL to CloudSuite Industrial migration.
ERP Migration & SelectionERP Cutover Runbook Template for VISUAL and XA Migrations
A fill-in go-live weekend runbook with freeze time, task sequence, rollback criteria, contacts and approvals.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
- ERP Contract Clauses Glossary Reference
New to Infor XA? Start with the Infor XA guide and toolkit.
Keep exploring
Free tools
- MAPICS and Infor XA AI Assistant Sizing and Value CalculatorEstimate GPU count, token volume, index size, hours saved and payback for a private on-prem AI assistant on MAPICS and Infor XA.
- MAPICS and Infor XA Private AI Layer Blueprint GeneratorGenerate a shareable architecture plan for adding a private, on-prem AI assistant to MAPICS and Infor XA, with components, security controls and a three-phase rollout.
- Infor XA (MAPICS) Migration Readiness AssessmentTen questions that score how ready you are to move off Infor XA (MAPICS), covering customizations, IBM i dependencies, data quality and ownership.
ERP fixes and how-tos
- Infor XA User List Report: Users, Status and Access for an AuditHow to produce an Infor XA user list and access report for an audit: IBM i user profiles, group profiles, last sign-on and XA application security, with SQL.
- How to Add AI to MAPICS and Infor XA on IBM i Without Leaving Your NetworkHow to give MAPICS and Infor XA on IBM i a private AI assistant: DB2 for i access, journal-based change capture, local GPU model, authority mapping and rollout.
- Infor XA costing: cost types, roll-up and standard cost setupHow product costing works in Infor XA (MAPICS): standard versus current cost, how roll-up builds cost from BOM and routing, setup order, and common pitfalls.
Guides
- MAPICS to SyteLine Migration Planning GuidePlan your MAPICS XA or MAPICS AS/400 migration to Infor SyteLine or CloudSuite Industrial. Data mapping, timeline, and risk mitigation strategies.
- ERP User Access Review Process GuideEstablish a structured ERP user access review process with review cycles, certification workflows, exception handling, and audit evidence for SOX and ISO compliance.
- How to Run ERP User Access Reviews That Pass AuditHow to run ERP user access reviews that pass audit: extract entitlements, choose reviewers, evidence decisions, and close revocations on a defensible timeline.
Integrations
- How to add an AI chatbot to Infor XAHow to add an AI chatbot to Infor XA on IBM i: grounded answers from Db2 for i, internal and customer portals, role-based access, and a fully on-prem option.
- How to use ChatGPT with Infor XACan you use ChatGPT with Infor XA on IBM i? Export versus live access, custom GPT actions, data controls, and when a private model is the better fit.