ARMI - KN

When it comes to managing customer invoices in NetSuite, enabling invoice approval routing is an important step in maintaining control over the billing process. First, navigate to the Accounting Preferences page in NetSuite and select the Approval Routing tab. Here, you can activate invoice approval routing, which enables organizations to build a customized workflow process within SuiteFlow. A customized workflow ensures the right individuals review invoices before sending them out. Workflow setups help businesses enforce oversight, reducing the risk of errors, fraud, or unauthorized invoice processing. 

When it comes to access management in NetSuite, global permissions serve as a strategic tool for fine-tuning access on an individual level. This offers administrators a way to tailor user access beyond the limitations of role-based assignments. Rather than adhering strictly to roles, global permissions enable administrators to assign specific access rights directly to users. This targeted approach means an individual can receive the correct level of access needed—no more, no less— and without the need to modify or expand existing role structures. These permissions are particularly useful in scenarios where users’ responsibilities blur traditional role boundaries or require flexibility beyond predefined group settings. 

Key Stakeholders, Controls, and Risks 

Designing a manual AR invoicing workflow in NetSuite requires more than following a standard template. It demands a thoughtful approach to ensure operational resiliency and strong financial controls. Involving key stakeholders, such as sales management, IT, and compliance, is essential. This collaboration helps create a process aligned with financial policies and operational goals. Each team plays a unique role: from IT configuring the system to sales and finance managers embedding necessary compliance checks and authority limits. Cross-functional collaboration across IT and business management is essential to ensure a strong workflow is implemented. 

In NetSuite, permissions grant access to specific functions, defining exactly what users can see and do within the system. These fall into four main types: Transactions, Setup, Lists, and Reports. Each plays a unique role in shaping user access and safeguarding sensitive data. Understanding these categories is key to creating roles that not only fit specific job functions but also keep your environment secure and compliant. 

Organizations are implementing new SaaS ERP systems to modernize their enterprise.  Traditional cybersecurity risks are being outsourced to the software provider, yet certain cybersecurity risks still need to be addressed by management.

Written by Connor Thompson, CIA, CISA

Passwords serve as the first line of defense against unauthorized access to a NetSuite environment and are a key IT general control.

By implementing strong password policies and properly configuring password requirements in alignment with password policies, organizations can significantly reduce the risk of data breaches. These policies should include requirements for minimum password length, complexity, and regular changes. Ensuring users create and maintain strong passwords helps protect against brute-force attacks, social engineering attacks, dictionary attacks, and other common methods used by cyber criminals to gain unauthorized access.

Written by Connor Thompson, CIA, CISA

Restricting integration accounts from having User Interface (UI) access in NetSuite is a critical security measure. This restriction protects an organization’s data and systems from potential vulnerabilities. Integration accounts are designed to facilitate seamless data transfer and automation between NetSuite and other applications to perform essential functions without human intervention. Allowing these accounts UI access poses security risks and operational challenges.

Written by Connor Thompson, CIA, CISA

In NetSuite, standard roles present significant challenges related to sensitive access risks and segregation of duties (SoD) conflicts.

Why you ask? Because standard roles have many permissions that are not appropriate for that role. Many modules only have one standard role which does not allow for the assignment of secure roles to users. For example, standard roles such as the Accounts Payable (A/P) Clerk, Buyer, and Accounts Receivable (A/R) Clerk, are overprovisioned and assigned a broad range of permissions. These are modules they should not have access to. Over provisioned roles lead to excessive access risks and segregation of duties conflicts. Meanwhile, many of these will not be adequately managed through mitigating controls. Poor role design results in an increase of compliance, cyber security, fraud, financial reporting, data security, and operational risks.