Enforcing Role Separation: IT Provisioning vs Configuration in NetSuite

Why IT Provisioning and IT Configuration Roles Must Be Separate

In NetSuite, separating access provisioning from system configuration isn’t just about following a segregation of duties checklist—it’s about sharply defining who can do what and ensuring there’s oversight every step of the way. Provisioning rights are limited to a small, approved group who can create, deactivate, and maintain user accounts and role assignments, while configuration rights are given only to those responsible for managing workflows, system settings, and integrations. This separation reduces the risk of accidental configuration changes by provisioning admins, minimizes the number of accounts that could alter key controls, and lowers the probability of critical ITGCs or ITACs being bypassed.

Provisioning vs Configuration: Risk Considerations

The risks go beyond obvious fraud scenarios. An all-access admin could, depending on the system, disable audit logging, alter approval routing, create hidden ghost accounts, or change reporting parameters to conceal activity. They could also exploit integrations or APIs to extract or inject data without oversight. In short, giving one person full control over both “who can access the system” and “how the system operates” removes critical checks and balances

Provisioning vs Configuration: Control Rationale

• Defined Role Boundaries – Access provisioning and system configuration are assigned to separate, clearly defined roles and users, each with a small, vetted list of authorized users.
• Accidental Change Prevention – Makes it harder for provisioning admins from making system changes to configurations, workflows, or key controls.
• Reduced Attack Surface – Limits the number of accounts with configuration rights, lowering the probability that critical ITGCs (IT General Controls) and ITACs (IT Application Controls) can be undermined.
• Auditability – Creates a clear, reviewable chain of activity; if a provisioning admin creates a highly privileged account without a change ticket, detective controls and UARs can flag, investigate, and document the event; if a configuration admin changes a high-risk setting without a ticket, detective controls and alerts can identify, review, and document the event.

Provisioning vs Configuration: Role Design and Controls

• Distinct Roles:

• 1. IT Provisioning Role – Create, deactivate, and maintain user accounts and role assignments only.
  2. IT Configuration Role – Modify workflows, system preferences, integrations, configuration settings, and customize roles.

• Change Management for Access and Configuration Changes – Any change that grants access, customizes roles, or modifies high-risk configurations records should go through the formal change management process. Where supported, administrators can subject changes to high-risk records and configuration pages (e.g., The Employee Record or the Enable Features page) to an IT workflow for independent review, approval, and documentation before implementation.
• Privileged Session Monitoring Tools (e.g., CyberArk) – Record and review activities performed in privileged accounts to detect unusual or unauthorized actions.
• User Access Review / Recertifications – Quarterly review of all privileged accounts and roles to ensure ongoing appropriateness.