Netsuite Control Considerations For Finanical Reporting

NETSUITE
CONTROL
CONSIDERATIONS
FOR FINANCIAL
REPORTING
TABLE OF CONTENTS
Executive Scope Introduction

Overview/ Considerations
Audience and
Purpose
Page 3 Page 4 Page 6
1 2 3
NetSuite Third Customer Control IT General
Party Reports Considerations Controls That
Affect Financial
Reporting
4 5 Conclusion
IT Application NetSuite Audit
Controls over Enablement
Financial
Reporting

Grab a seat and enjoy.
Read Time: 35 minutes
NETSUITE CONTROL
CONSIDERATIONS
FOR FINANCIAL
REPORTING
Executive Overview owned companys service offerings. In/out-of-

NetSuite Inc. (NYSE: N) is the industrys leading scope services are discussed in greater
provider of cloud-based financials/Enterprise detail, below.
Resource Planning (ERP) and omnichannel
The purpose of this whitepaper is to provide
commerce software suites. In addition to
supplemental information on the available
financials/ERP and omnichannel commerce
financial reporting controls within the NetSuite
software suites, NetSuite offers a broad suite of
application, compensating controls where
applications, including financial management,
needed, and to differentiate the users
ecommerce and retail management, commerce
responsibilities from those of NetSuite.
marketing automation, customer relationship
management (CRM), and Professional Services Disclaimer
Automation (PSA) that enable companies to This document does not replace the need for companies
manage most of their core business operations to perform their own evaluations and come to their own
conclusions regarding the information contained in this
in its single integrated suite. whitepaper. It is offered as an aid to internal auditors, external
auditors, finance and IT professionals, and any other group
chartered with establishing or reviewing controls within their
Audience and Purpose organization. The information described in this whitepaper is
The intended audience of this whitepaper is IT, intended to serve as a guide to better understand how controls
related to financial reporting work both inside and outside of
finance, and audit professionals who are using, NetSuite. It is not designed as an audit program or controls
considering using, or auditing, the NetSuite evaluation questionnaire that could be used to audit a companys
NetSuite environment. It can, however, serve as a valuable tool
Service for financial reporting. This document to aid companies in better understanding the NetSuite control
does not address specifics of other NetSuite environment around financial reporting and the division of
Inc. products or services, or those of its wholly- responsibilities for developing, maintaining, and reviewing the
controls discussed in this whitepaper.
NetSuite Inc. 2016 Page 3

SCOPE
CONSIDERATIONS
This whitepaper discusses the financial

reporting controls available for users of
the NetSuite application. It does not cover An end-to-end ecommerce platform,
services which have no financial SuiteCommerce enables B2C and B2B
reporting impact. businesses to deliver engaging and
personalized shopping experiences on any
digital device and across any channel while
Description of In-Scope Services
seamlessly connecting your core commerce
business systemsinventory and order
management, CRM, business intelligence,
One business software system connecting marketing and financials.
financials, customers, and commerce.
NetSuite combines accounting/ERP, CRM and
ecommerce in a single, fully integrated, SaaS
solution that connects a business across An end-to-end software for services-based
finance, sales, service and fulfillment. businesses, NetSuite Services Resource
Planning (SRP) provides complete services
business software for project-based
businesses. The NetSuite SRP solution
Global business management software provides complete web-based PSA including
suite for ERP, CRM, ecommerce, and PSA. resource management, project accounting,
NetSuite OneWorld seamlessly handles timesheet and expense management, all
multiple currencies, taxation rules and tightly integrated with NetSuites SaaS
reporting requirements across geographies accounting, CRM, and ecommerce capability
and subsidiaries, providing real-time increasing visibility into the professional
global business management and financial services organization, improved resource
consolidation in a unified, cloud-based system. utilization, streamlined invoicing and billing,
and elevated on-time project delivery
and profitability.

Products Excluded from Scope Order Management allows shoppers to buy
The following NetSuite Inc. products or anywhere, fulfill anywhere and
services, and those of its wholly-owned return anywhere.
companys service offerings, are excluded
LightCMS provides a powerful, yet easy-
from the scope of this whitepaper.
to-use cloud-based platform for creating
NetSuite OpenAir is the worlds #1 beautiful websites and online stores.
professional services automation (PSA) LightCMS offers an ideal set of tools for
solution. From resource management and individuals, non-profits, and small to medium-
project management, to time and expense sized businesses who want to communicate,
tracking, project accounting and advanced conduct business, and sell products online.
billing and invoicing, NetSuite OpenAir With industry-leading design flexibility,
supports the entire professional services LightCMS offers designers and developers
delivery lifecycle with a powerful Software-as- the opportunity to create custom websites
a-Services (SaaS) suite. their clients can easily manage themselves
Retail Anywhere (NS POS) is a multi-channel NetSuite TribeHR is the first social human
retail management solution designed to resources management software, enabling
improve the retail customer experience. Retail customers to manage the entire employee
Anywhere technology gives retailers the lifecycle through a powerful Recruiting, core
ability to meet increasing customer demand Human Resource Information Systems (HRIS),
for a system that can unify the online and advanced Talent Management and social
in-store retail experience to better serve Applicant Tracking System (ATS).
cross-channel shoppers, built on NetSuite
Venda is one of the worlds leading innovators
SuiteCommerce and the core NetSuite ERP/
and providers of digital commerce solutions,
financials and CRM solution.
leveraged by manufacturers and retailers to
OrderMotion provides a comprehensive deliver a consistent brand experience across
order management solution for a wide range online, mobile, and in-store channels.
of businesses including B2B, B2C, retail,
NetSuite WMS is a combination of advanced
wholesale distribution and manufacturing.
technology and operating best practices,
OrderMotions technology helps companies
that optimize all functions and resources
that ship products directly to consumers
inside a warehouse or a distribution center
which has become more complex of late,
inventory, space, equipment, and labor.
thanks to ship-to-store programs, where a
This is an optional module available for
customer orders a product online and heads
customers who require a warehouse
to a retail location to pick it up. NetSuite
management system.

INTRODUCTION
It is common for companies that use, or are As a cloud-based solution, NetSuite

considering using NetSuite, to regard IT provides its customers with annual reports
compliance as low priority. The assumption on their Statement on Controls, commonly
is that ownership of technology controls known as SOC reports (SOC1 under SSAE
strictly lies with NetSuite since its business No. 16 and ISAE 34021 , and SOC2), for the
management software is supported by IT general controls (ITGC) associated with
IT infrastructure in the cloud. One of the their customer-facing systems environments.
many advantages of utilizing a cloud- However, this does not mean that the
based business management software is responsibility for maintaining control over
the reduction of many IT risk mitigation IT risks lies exclusively with NetSuite. All
activities typically required for on-premise companies that use NetSuite are ultimately
software, such as running regular backups responsible for establishing and effectively
and establishing data recovery methods, carrying out their own activities to ensure
as an example. However, it is important to that proper IT controls are in place, including
recognize that NetSuite alone cannot be establishing any compensating controls
held solely responsible for establishing good necessary to meet their control objectives in
IT controls. Customers that use NetSuite the absence of a relevant NetSuite control.
are also accountable for implementing their
The Public Company Accounting Oversight
own complementary IT general controls
Board (PCAOB) and the new COSO2
and ensuring the effectiveness of these
framework have recently introduced
controls. Failure to recognize this may lead
new requirements for financial controls
to a lack of focus on IT controls, which could
assessment and increased scrutiny
potentially cause customers operational
over ITGC and IT risk management.
and reporting challenges, or in the case of
Organizations must now comply with more
public companies, delay their SEC filings.
rigorous evidence retention standards to
Management should keep in mind the
demonstrate key ITGC activities, such as
following important trends and drivers related
formalized approvals, project documentation
to establishing good IT controls:
and system-generated reports.
NetSuite Inc. 2016 1

The American Institute of Certified Public Accountants (AICPA) Auditing Standard Board (ASB) Statement on Standards for Attestation Engagements (SSAE) Page 6
No. 16 was published in April 2010 as a replacement for the Statement on Audit Standards No. 70 and the commonly referenced SAS 70 reports. International
Standards for Assurance Engagements (ISAE) 3402 Assurance Reports on Controls at a Service Organization was developed by the International Auditing and
Assurance Standards Board (IAASB) and published in June 2011 as a standard for documenting that a service organization has adequate internal controls. It is
also considered a replacement for SAS 70.
2
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative of five private sector organizations and provides frame-
works and guidance on enterprise risk management, internal control and fraud deterrence.
Public companies are required to establish
effective IT general control frameworks to
comply with regulatory requirements such
as the Sarbanes-Oxley Act (SOX), regardless
of whether a cloud-based business
management software is being utilized. This
includes controls in the areas of change
management, release deployments, access
provisioning, data quality/governance, and
disaster recovery. Using cloud computing
services makes third party reporting a
significant requirement to properly assess
financial reporting controls for user entities.

Chapter 1
NETSUITE THIRD
PARTY REPORTS
To assist its customers, and potential The NetSuite application provides default
customers, NetSuite issues several audit trails across a wide range of ICFR-
independent, third-party, audited reports relevant financial and configuration
that describe the design and operating management records in NetSuite. These
effectiveness of customer-impacting controls default audit trails may further be
in place within NetSuite. Where such reports augmented by custom controls, such as
are not available, or where disclosure of the saved searches and reports, email alerts,
information in such reports would present workflows and scripts. However, because
a potential security conflict in the release these custom augmented audit controls
of the information, NetSuite endeavors to are highly configurable and dependent
issue certificates, attestations of compliance, on data input, which is directly and soley
and/or point customers to our registration within the customers control, they are not
of compliance on government and industry covered by the reports. These include
authority websites and registration lists. master data management and transaction
These reports and certificates are available history, user access administration (for each
by request to all customers, and will user customers NetSuite instance), and IT
typically include: Application Controls (including scripts and
workflows), which are customized by
A well-defined scope, including what
the customer.
applications and/or modules are included or
not included in the report. NetSuite serves thousands of customers with
For in-scope systems, controls that cover different reporting requirements. As such, it
the system development life cycle (SDLC)/ endeavors to cover these differing needs
change management, logical access and by issuing the most relevant and trusted
security, data back-ups and restoration, third party audit reports and certifications.
system availability and uptime, and customer Currently, NetSuites publicly available reports/
data access controls. certifications include, but are not limited to:

approach can greatly reduce a customers
substantive testing requirements, which
eases the burden for businesses being
audited. Many NetSuites customers are
publicly traded, and as such are governed
by SOX and SEC reporting requirements.
In support of customers financial audit
requirements, NetSuite issues an
independently audited SOC 1 Type 2 report
twice a year which covers the IT general
controls within NetSuites control and
outside of its customers.
Audited financial statements/SEC filings
as a publicly traded company, these Service Organization Control 2 Type II
reports are required and available for (SOC2) NetSuites responsibilities as a
investors to analyze how NetSuite as a data custodian on behalf of our customers
business is faring. These reports assist goes beyond support of internal controls
customers and prospects in determining over financial reporting. NetSuite customers
its comfort with the viability of NetSuite as must also be able to evaluate NetSuites
a business and to assess its capabilities as controls as they relate to security, availability,
a reliable cloud service provider that can and confidentiality. In support of this,
sustain its business for the long-term. NetSuite also issues a SOC 2 report
covering the Security, Availability, and
ISO 27001 Certification as a cloud
Confidentiality principles.
service provider serving both domestic and
international customers, NetSuite certifies Payment Card Industry Data Security
against ISO 27001, an internationally Standard (PCI-DSS) NetSuites ERP and
respected and recognized Information ecommerce applications allow customers
Security Management System (ISMS) to process (through integrated gateways),
standard, which allows NetSuite to transmit, and store credit card data.
externalize its controls over security, Consequently, NetSuite is required to
confidentiality, and availability. maintain PCI DSS certification as a Level 1
Service Provider, which must be externally
AICPA SSAE 16 Type II/ ISAE 3402 (SOC1)
validated at least annually by a Qualified
as a publicly traded company, NetSuite
Service Assessor (QSA).
understands the importance auditors place
on IT General Controls reliance during Each of these reports cover different
financial reporting audits. A strong reliance compliance and operational requirements

relevant to customers running their It is also important to note that NetSuite uses
businesses in todays highly technology- third parties for its business, which could be
focused, SaaS, environment. Customers relevant to the customer control environment
are responsible for understanding their evaluations. NetSuite uses CenturyLink for
business risks and objectives, including how most of its production data centers, so in
they currently use the different NetSuite conjunction with reading NetSuites SOC
applications, in order to determine which 1 report, customers should also review
of the NetSuite reports are appropriate CenturyLinks SOC 1 report as it relates to their
and applicable. The customers control business. Any relevant third party service is
environment cannot be understood by mentioned in the reports, clearly defined as
looking at technology in isolation, but only out-of-scope for the report but may
through understanding the interactions be relevant to the overall control
between people, processes, and technology, environment consideration.
in a specific business environment.
Organizations must also look at the control
When looking at these reports, in addition objectives, principles, and criteria covered by
to knowing and understanding the business each report, and, depending on their business
risks, it is also important to understand what risks, processes, application usage, customers
each report covers. NetSuite has many need to understand what complementary
applications and locations, and frequently IT controls they need to implement to fully
acquires companies. Not all of these address their risks. Customers need to
applications, locations, or acquisitions may evaluate and understand where the lines
be covered by the report or certification. of responsibilities are drawn. NetSuites
Therefore, it is important to understand the certifications do not equate to a customers
scope of each report and how it relates certification. The fact that NetSuite is certified
to the customers systems and business against a standard, or has a clean audit
environment. For example, a SOC 2 report report, simply enables customers to attain a
may be more applicable to a privately listed similar certification or clean report, as long
company, as opposed to a SOC 1 report as they implement proper and appropriate
which mainly focuses on controls relevant to complementary controls within their own
financial reporting. If the customer is publicly environments. For example, although the
listed but is using OpenAir, it is important to NetSuite application is PCI-DSS certified, this
note that this is a separate application and does not mean that customers who use it are
has its own SOC 1 report. The scoped-in and also PCI-DSS certified. Such customers still
scoped-out applications are stated within bear the full responsibility of the PCI-DSS on
each report, and users should ensure to their environment, and how they access the
review them. NetSuite Service.

Overview of Responsibilities
NETSUITE
AREA CUSTOMER
SOC 1 SOC 2 ISO 27001 PCI-DSS
ITGC Change Management
ITGC Logical Access
ITGC Network and DB (back-end) Security x
ITGC Back-up and Restoration x x x
ITGC BCP/Disaster Recovery x x
ITGC System Uptime and Availability x x x x

ITGC - Customer Authentication Requirements
x x x
(access to customer NetSuite instance/customer database)
Business Process IT Application Controls x x x x
The scope of the SOC 1 is especially important provide reasonable assurance over the user
to understand. This is a highly customizable entities financial statements. However, this
report. Companies have control over what will not eliminate said testing.
control objectives are covered, aside from
It is important to understand that even with
specifying the applications that are in scope.
a cloud provider, there will always remain
A SOC 1 report may completely disregard
elements of internal control that are within
the control objectives surrounding change
the responsibility of the customer. It is the
management (how application changes
customers business, and ultimately their
and new features are developed, tested,
responsibility to properly mitigate their risks. A
and released). Or a company can choose
retail store will have a very different business
to cover only how change management is
model and business risk from a security
authorized, but leave out how it is tested
firm. However, both can be using NetSuite.
or released. Even with everything included,
Although there are controls that would come
having sound IT General controls would still
from NetSuite, each of these businesses
require a properly designed internal control
would need to design their own controls in
over business processes. A clean, unqualified
order to fully address their business risk. The
SOC 1 report simply means that customers
retail store may need additional controls
may rely on the in-scope controls, which
over their inventory, or the security firm may
usually results in a decrease in the level of
need greater controls around their data.
substantive or IT application controls testing
The specifics are highly dependent on the
that will be performed by users auditors to
business risk and how each firm decides to
use the NetSuite Service.

Chapter 2
CUSTOMER CONTROL
RESPONSIBILITIES
This whitepaper is intended to provide There are five critical areas that should be
guidance on the division of responsibility taken into consideration when reviewing a
between NetSuite and customers, on companys responsibilities for establishing
available financial reporting controls within good IT General Controls (ITGC) for
the NetSuite application, and how users can NetSuite applications.
take advantage of these to strengthen their
own internal controls. 1. Change Management & Source Code
Customization Just as NetSuite has
To achieve effective internal controls, NetSuite controls around how source code is
recommends customers implement a designed, developed, tested, deployed,
combination of both automated and manual and verified, each customer must develop
controls that both prevent and detect similar code change management controls
misstatements or misappropriation of assets. around its NetSuite customizations. Lack of
The level and types of controls depend on controls on custom code creates risks of
the business risks that are being addressed. It fraud, performance issues, and
is also important to determine the costs and security lapses.
benefits when establishing controls by asking
questions. Does a control truly address a Having procedures and tools in place to
particular risk? What impact do controls have control access to source code, document
on business operations? Are the errors or customization requests, record changes
misstatements that the control environment and testing of those changes, along
is trying to prevent or detect worth the with recording deployment of code, are
additional resources or effort required? essential in providing effective controls
Questions like these need to be taken to ensure changes are not made and
into consideration to determine the overall deployed to the NetSuite environment
effectiveness and efficiency of controls. without proper approval and SOD. This
is particularly important when scripts and

workflows are considered, which may run in of access required for them to do their
an administrative mode, or other elevated job properly. Limiting access reduces the
permission mode, where such scripts chance for errors and fraud. Additionally,
and workflows are capable of overriding small permission sets make it easier to
controls established via role assignment audit changes to key data. There is always
and the customers separation of a tradeoff between limiting access and
duties model. ensuring that people have the required
access to do their jobs. Granting users
2. Logical Access/Application Security extremely broad access rights may
While it is true that NetSuite has control increase productivity, but at the cost of
over the datacenters and the main greatly increased chances for errors,
application, there are still areas within the misstatements, and fraud. Additionally,
clients responsibility. For example, it is proper security is preferable to simply
up to each customer to determine how not informing users about the availability
it administers roles and responsibilities of particular operations. This security
within its own NetSuite instance, and how through obscurity inevitably leads to
to assign roles and responsibilities to its accidental discovery of excessive access.
employees. How many administrators does
it employ? What group will be responsible 3. Data Back-up and Restoration This
for writing scripts and workflows, if any? area is primarily within NetSuites control.
How many people have administrative However, customers should perform
access? How will it segregate its job their own due diligence by reviewing
functions? What is its process for assigning NetSuites reports against the firms risk
rolesfrom requesting, to approval, to tolerance in this area. It is also important
having the roles assigned, changed, or for customers to understand that NetSuite
removed? It is critical for each customer to uses co-location services. In addition to
design, deploy, maintain, and periodically
review its user access within NetSuite,
depending on its overall business risks
and how it designed its user administration
process and segregation
of responsibilities.
Best practices generally hold that roles

and permissions should be granted to
users trained to perform specific functions,
and that they be limited to the least level

reviewing NetSuites reports, customers ensure that no user has access to perform
should also review corresponding all parts of a transaction within NetSuite
co-location reports to understand the without review. Requiring multiple people
controls in effect at those locations for a process reduces the risk of errors,
and how they fit into the customers misstatements and fraud by increasing
risk assessment. the likelihood that another individual will
identify and correct an issue
4. Business Continuity Planning/ Disaster during processing.
Recovery Although customer data
resides with NetSuite, it is important It is the responsibility of each organization
for customers to ensure they have a to perform their own segregation of duties
business continuity plan in place, including review, even if they decide to use the
establishing communication lines with out-of-the-box roles that come with the
NetSuite to coordinate the restoration of NetSuite application. User entities need
their database and NetSuite instance. to understand the impact of how they
assign roles and whether opportunities for
5. Customer Authentication Requirements conflicting interests is created, regardless
It is the customers responsibility to of the use of standard roles, custom roles,
ensure that only authorized personnel global permissions assignment, or when
have access to their data and their more than one role is assigned to a user.
NetSuite instance. As administrators of Companies should establish processes
their NetSuite software, they have the for reviewing and analyzing their current
ability to provide access to personnel roles and assignments to determine that
outside their company (such as NetSuites proper segregation of duties is in place, or
Professional Services teams, to assist them if conflicts do arise, that proper mitigating
in implementing NetSuite). However, it is controls exist.
important that customers have a proper
user administration process, including 6b. Business Process Control Automation
appropriate approvals prior to providing NetSuite has been designed to be
access, and ensuring timely termination highly configurable to meet a diverse set
when it is no longer needed. of specific business requirements. There
are many NetSuite configuration settings
6. Business Process: available to the customer that, when
set correctly, can be used to automate
6a. Segregation of Duties & Transaction how a company manages business
(SOD) Processing To further reduce process risks from both a preventive and
the risk of errors and fraud, it is critical to detection perspective. For example, often

companies require that vendor invoices
entered in the system for payment are
tied to an approved purchase order and
that any goods received fall within the
companys defined tolerance policies.
This common business control can be
automated by turning on the configuration
settings that require NetSuite to
systematically perform this check. Because
it is highly configurable, it now becomes
the organizations responsibility to ensure
that they design, deploy, and monitor their
automated business process controls
within NetSuite. Once the automated
controls have been configured, its up
to the customer to test these controls to
ensure they are functioning properly and
that the configuration settings associated
with these controls are not changed
inappropriately. It is also important to note
that control automation through scripting
can bypass SOD controls. Therefore,
these should be carefully monitored and
additional compensating controls should
be considered.
Knowing and understanding the
responsibilities within these areas will enable
customers to take full advantage of the
NetSuite applications and be able to create
processes and controls that will enable
them to meet the requirements for financial
reporting. Organizations need to keep these
in mind when relying on NetSuites reports
and designing their business processes.

Chapter 3
IT GENERAL CONTROLS
THAT AFFECT
FINANCIAL REPORTING
Controls dont happen naturally. Good 1. System Development and Change

controls are designed. When designing Management (SDLC) These are
internal controls to address specific risks for controls designed to provide reasonable
the business, such as those around financial assurance that changes to production
reporting, customers must understand the application systems and programs are
associated business risks that are relevant to properly authorized, tested, approved,
their financial reporting. Examining these risks implemented and documented. Since
enables organizations to identify areas that NetSuite is a cloud-based system, changes
are in scope, and how each of these areas to the core functionality of the application
are impacted by their use of applications are outside the control of users. This is
such as NetSuite. Once a scope has been where a review of NetSuites SOC 1 report
determined, it is important that customers is important to ensure an understanding
examine NetSuites available reports and of how SDLC is managed in the core
understand how they may be best leveraged. application. This does not absolve users of
This allows companies to focus on designing responsibility, but may reduce the scope of
controls that complement those already in control work. For example, NetSuite allows
place with NetSuite. Customers may decide customers to test major feature releases
how much reliance they will put on NetSuites before they are rolled out to customers
reports, or design their processes and systems. It is the responsibility of customers
controls so that the key controls are within to test new features as part of validating
their purview. that new features do not negatively impact
their processes. Similar responsibility exists
For IT General Controls, there are specific
around error or software bugs. Customers
control objectives that must be addressed
have a responsibility to report these to
as part of the financial reporting audit
NetSuite as part of an overall
requirement of publicly-listed companies.
security control.
There may be additional control objectives
included, but the main focus of financial
reporting is the following:

Additionally, application changes such information, and maintain a process for
as customization, scripting, and workflow, investigating any potential security issues.
can be done at the organization level. It One of the most important responsibilities
is important that companies develop their of customers is to ensure that they
own SDLC and change management notify NetSuite of any significant access
program that meets the requirements of compromise. This allows NetSuite and the
financial audits. In a cloud environment, customer to work in concert to minimize
SLDC is a shared responsibility. impact to the customer.
2. Logical Access, Network and Database 3. Data back-up and restoration These
Security These are controls that provide are controls that provide reasonable
reasonable assurance that logical access assurance that system and application
to data, IT resources, applications, system data is backed up on a timely basis and
data, and networks/network devices is appropriately stored in a secured facility.
restricted to properly authorized individuals, Since this area is primarily within NetSuites
and that security violations are identified, control, it will not be discussed in detail in
followed up, and resolved on a timely basis. this whitepaper.
As a cloud-based system, NetSuite houses This whitepaper focuses on the SDLC/Change
all customer data in a customer-specific Management, Logical Access, and relevant IT
instance of NetSuite. As such, it is within Application Controls since these controls are
NetSuites purview and control to ensure managed by the customer. Choices made by
that the application properly secures organizations in these areas have significant
access, and that any security issues that impact on internal controls. Other areas, like
are encountered are properly managed. It backup and restore, may require review, but
is important for customers to take this into not the same level of participation. For the
consideration when assessing their risks other control objectives noted in the prior
since they have to rely on NetSuite to keep section, it is important to note what customers
data safe. need to consider for these areas, and refer to
the relevant reports for more details.
However, user security and access levels
are the responsibility of the customer.
Therefore, it is important for customers to
System Development Life Cycle (SDLC)
Compliance and risk-focused companies will
implement their own controls which provide
place significant importance on the design
appropriate user access, protect important
of controls in their system development

life cycle (SDLC) and change management
processes, as such changes may negatively
The request form
impact the accuracy of the financial reporting
system. This area includes customizations
should include
of the NetSuite application, such as roles, information such as:
scripts, custom records, and workflows. A Requestor
strong SDLC and change management
Date of request
process, one which is well documented and
governed, with proper segregation of duties Description of the change request
enforced, including strong controls around Business justification
the requesting, execution and testing of Assignment of the request
changes, will help ensure that only properly
Authorization of the request for code
authorized and tested changes are promoted development work to begin
to production.
Details of development, test, and
user acceptance
Change Management
Approval for release
All changes, regardless of where they
start within the organization, should be Post-release sign-off
documented on a standard change request
form. Depending on the business needs,
custom records can be tailored to serve as submits a request it could be routed
the documentation. Change requests should automatically to an authorized individual or
include an approval mechanism to move the group to approve the change. The request
request from stage to stage in the change could then be routed to other approvers as it
management process. A benefit to using Issue moves through the process, for example:
Records or Custom Records within NetSuite
is this allows a saved search to generate a Initiation
list of all records for specific periods, along Development
with filtering to deliver information needed for
Testing/Quality Assurance
audits or reviews.
User Acceptance Testing
Custom forms can be combined with a
workflow to ensure that approvals are Production Release
routed automatically when specific steps are Production Verification
completed. For example, once a requester

Such a system also makes it easier to ensure Auditing Change Management
that required fields are completed before Several mechanisms exist within the NetSuite
tickets are closed, and that approvals are application for the tracking and verifying of
obtained before a change request moves to changes to master data and/or configuration
the next level. Fields such as attachments changes, such as:
of test plans, or summary of test results, etc.,
System Notes
can be required within the request. A formal
ticketing system and supporting processes History tab
provide point in time information on any Transaction audit trails, including line
given change identifying the environment the level changes
code change resides in, responsibility for the
change, and the impact. Detailed saved search and reporting audit
trails, including Financial Layouts
To ensure this change request process
Revenue Recognition Schedule changes
is followed, companies need a standard
procedure outlining the use of the change XML capture of workflow changes
management system, the requirements for Login audit trails
completeness, standards for accuracy in data,
and a requirement for approvals as code Role permission changes and role
moves from environment to environment. This assignment changes
process must be documented and available Customers should spend time familiarizing
for review by the auditors. themselves with the capabilities and
Exceptions to change management processes limitations of each of these audit tools
will occasionally be necessary, but policies and determine an appropriate strategy
and procedures for handling such exceptions for achieving their control objectives. For
should exist, and specific occurrences of example, currently, there is no single unified
exceptions should be well documented. A audit trail search across all record types
common exception is an emergency code and audit logs. Where a particular audit trail
fix that bypasses normal code testing or does not provide an out-of-the-box level of
shortcuts standard segregation of duties. All required coverage, these mechanisms can
such exceptions should be documented, be augmented via custom solutions (scripts,
reviewed, and approved within a business workflows, saved search email alerts, etc.)
reasonable time period. and/or with manual compensating controls
and management review. Further details, tips,

and recommendations on the various audit SOD rules help ensure that only approved
trails, system notes, search and reporting change requests are worked on by the
capabilities can be found in the Help development team.
documentation of your NetSuite account, or
Once development work for a given request
trial account, under the topic Auditing Master
is complete, a code review should be
Data and Configuration Changes in NetSuite.
performed and documented by a developer
independent of the specific check-in, i.e.,
developers should be prevented from
reviewing and signing off on their own
code changes.
Subsequently, best practices require the work
be tested, first by the developer, and then by
a team independent of the developer, such
as a Quality Assurance (QA) team. Again,
SOD rules should govern that code is not
passed onto QA without proper approval
by the developers. The QA team in turn
performs and documents their work on the
change request form, and submits the output
of their work to the next stage of the process.
If at any stage proper documentation and
approvals are not captured, the development
cycle stops, waiting for the proper information.
Customization and configuration changes
in a NetSuite account are different typically
Segregation of Duties
from an external-facing cloud development,
A key component to the SDLC process is the
test, release environment, in that it is highly
segregation of duties (SOD) and authorization
likely that a business unit will want and
process which governs the assignment
require sign-off prior to release of new
and execution of the steps required to fulfill
functionality. In this case, User Acceptance
change requests. Change requests should not
Testing (UAT) must be passed prior to sign-
be assigned to the development team without
off for release into production. Additionally,
first having the proper approval from the
in less complex/mature environments, UAT
business owner and developers should not
may actually replace QA in terms of test
make changes without prior approval. Strong

sign-off. Regardless of method of testing by the testers and used to drive their testing.
(QA, UAT, or both), eventually, sign off on the These templates can also serve as audit
changes should be recorded in the change evidence. Testing documents should include
request and a formal request that the code information about what is being tested, inputs,
be scheduled to move into production expected outcomes, and documenting a
should be tracked and approved. The pass or fail status to the test.
movement of code in each of these stages,
Tests should be clearly signed off on by the
from development to test, and ultimately
testers, including the date, and routed back to
to production, should be performed by
the development or QA team as appropriate.
individuals not involved in the last code
No code should ever be moved forward in
change than who just touched or reviewed
the development process without evidence
the code last.
of testing and sign-off, ideally with the test
Developers should not promote their own results themselves also documented and
code into any next-stage environments, e.g., retained for audit.
test or production. Code deployment should
Developers and testers should not be moving
be requested and documented. Once the
code between environments. This activity
move is complete, the individual performing
should be performed by a separate group to
the move should update the change request.
ensure adequate segregation of duties, but
This provides an audit trail for code movement,
that group should not take action without first
and also provides evidence of the proper
receiving the proper documentation, including
SOD inside the SDLC process.
relevant code change request forms and
testing documents.
Test and Release Methodologies
Developers should test their code first, before Ideally, test results and sign-off information
it is ever passed on for QA or AUT testing and should be stored in the same repository as
sign-off. Testing by developers tends to be the change requests, and this repository
very specific, and typically does not address should be designed in a way that it is easily
system integration, or end to end testing, that searchable, well structured, and backed up
should be performed by QA. such that the information is not lost if the
repository data is damaged.
Strong controls around testing need to be
in place. These controls include a standard
Coordinating Release Windows
testing process that should be shared and
With respect to custom development within
consistent across functional departments.
a customer account, ideally, the release
This process should include examples of
new customizations should be performed
testing documents, which must be filled out
in isolation from: other internal projects; 3rd

party application installations; and NetSuite third-party applications installed within, or
core code updates. This will allow for easier integrated with, your NetSuite account.
and faster isolation and identification of issues.
Selection processes should require the
Also, as many businesses are sensitive to business owner and third-party provider
disruptions around key sales windows, it is (vendor) clearly define the: nature and scope
advised to avoid releases around end of of features; boundaries between the customer
month, quarter, or year. and partner application (whos responsible
for what?); where master data lives, i.e., which
Consequently, customers should adopt a
system is the source of truth; and service
strategy for release window management that
level agreements with respect to application
works for their business model and risks, but
performance and support. In addition to the
which might look like, no releases (without
requirements of the business owner,
management exception):
selection criteria should also account for
Last week of month requirements from the legal, security, and
Last two weeks of quarter compliance departments.
Within one week, before or after, of a In this context, it is also important to

NetSuite core 20XX.1 or .2 release (typically understand partner maturity. Not all partners,
Q1 and Q3, respectively) nor their applications, are equal. The selection
criteria should also consider topics such as:
Limited Resources Reputation, years of service, fiscal
In environments where personnel resources responsibility and performance, size of
are scarce, and complete SOD is not possible, install base
compensating controls should be created
Location and number of employees and
that minimize the chance of unapproved
contractors (developers, support, PS)
changes moving being promoted to the
next environment. For example, developers Use of subservice organizations and
might promote the code of other developers sub-contractors
to production, but not their own, and Availability of independent control
management could review and document all environment certifications
production code pushes.
Lastly, third-party vendor management
Third-Party Applications policies, procedures, and controls should
Policies, procedures, and controls should account for and manage the evolution of
exist to govern and monitor the selection, the contractual relationship, the companies,
installation, maintenance, and security of and the third-party application over time. A

customer-vendor relationship is highly fluid. in a change request ticket. It would be noted
The customer environment, its business who authorized the emergency change, who
objectives, risks, personnel, customer base, performed the change in the production
revenues, etc., are in a constant state of environment, when it was performed and why
evolution. The same can be said of the it did not follow normal SDLC procedures.
vendors business. Similarly, the third-party Subsequently, a management review of the
application is constantly evolving. Business emergency change should follow within
owners will likely, and reasonably, want to a reasonable time frame. It is important to
take advantage of new features of the third- capture these details as evidence for
party application. the auditors.
Given that changes to a third-party
applications functionality could impact
financial reporting, controls should be in
place to monitor, evaluate, and accept/reject
such changes. Even in a cloud model, where
changes are pushed on a regular schedule,
and the business must accept such changes,
there should be systems and controls
in place to detect, evaluate, and adjust
internal controls as necessary to maintain a
functioning financial controls environment.
Logical Security
Exceptions
Perhaps the most visible control point
As with any process, exceptions may occur,
in NetSuite is logical security. Logical
and when they do the process needs to
security, also referred to as application
document how to handle these exceptions
security, is designed to ensure that users
and capture appropriate evidence. For
can only perform actions relevant to their
example, in response to a high severity
organizational function. There are two
production issue, a developer may be
overriding considerations for logical security.
required to go directly into the production
First, security needs to be balanced against
environment to quickly correct the problem.
user productivity, as application security
That change would then be worked
becomes a negative if it prevents users from
backwards into the other environments, like
doing their jobs. Second, users should be
test and development. In this example, that
setup using the principle of least privilege.
emergency change would be documented
Following least privilege, users are not

granted more access than the minimum of third-party contractors. This will ensure
required to accomplish a particular task. that inappropriate access is flagged and
Additional access is denied by default. remediated. This review would include:
Each customer is accountable for A list of enabled users to determine
implementing their own logical security and whether access has been revoked
ensuring the effectiveness of these controls. for terminated employees and
Providing a consistent process for managing expired contractors.
and documenting logical security, combined A report of user access to critical or
with a culture of accountability, helps validate high risk functions within NetSuite for
the integrity of a companys logical security appropriateness of individuals granted
control environment in NetSuite. Proper this access.
segregation of duties, and an understanding
of how to appropriately deal with super-users A list of users with sensitive or critical
(administrators or privileged access users), are access to confirm these permissions
key considerations in logical have been restricted to authorized and
security control. appropriate individuals. The definition of
sensitive or critical will depend on
Establishing firm user administration controls the business.
would typically include processes for:
Access Removal. Have an established
Access Grants. Have an established process process for terminating access and ensuring
of requesting and approving access. that it is done in a timely manner. It is
Typically, the individual or group reviewing recommended that there be a policy for
the access should have an understanding of when access should be terminated based
the job function of the person that requires on sensitivity. For some types of access,
the access and can make a determination like administrator or other privileged users,
whether the requested access is immediate termination is recommended.
appropriate. Often, this is an IT system or Less sensitive access may take up to a few
applications team working in concert with business days to be removed. For example,
the business owner. a process may use an email termination
Access Review. Access should be notification sent by Human Resources to all
reviewed periodically, especially for relevant personnel that requests removal of
growing companies, for departments access of any person that has been officially
that are project-based where frequent terminated. The email is typically sent to
changes in job responsibilities occur, or in everyone who administers access, along
businesses that utilize a significant number with the security team. In sensitive cases it

is appropriate to remove access prior to the address specific needs. Roles can be copied
actual termination of the employee. and modified for easier customization or roles
can be defined and built from scratch.
Segregation. Finally, it is recommended
that the request, approval, and granting Customers are advised to maintain a mapping
of access should be segregated among of role assignment to a job function, and map
different individuals to ensure appropriate role assignment to job title. Most given job
authorization and application of the process. functions will have a many to one function
Segregation of duties is important not only to job title mapping. By mapping role
to user administration, but within job roles assignments to jog functions, the complexity
and responsibilities. of this matrix, and subsequent audits, is
greatly reduced.
Controls
Periodic audits of the permissions that make
NetSuites logical security is focused
up each role, and the users assigned, are an
around role-based access control to
important part of maintaining security. Role
ensure that users can only use data and
assignments and permissions should be
application functionality that is related to their
reviewed at least quarterly to ensure that
responsibilities. In addition to roles, NetSuite
they are appropriate. Once a well-managed
provides a number of features to help control
and designed system of roles and permission
and manage logical security. Certain control
management is established, customers may
activity should also be performed to protect
want to move to a model of only auditing role
the integrity of application security.
and permission changes on a quarterly basis,
and performing a full audit only annually.
Roles
Roles are the key application security control For SOX-regulated, and other financial
in NetSuite. NetSuite comes with a predefined controls sensitive businesses, a separate
set of roles and related permissions. However, financial controls analysis of incompatible
every organization is different, and the permissions should be undertaken at least
responsibility falls on each organization to annually. NetSuites Saved Search feature can
ensure that the permissions in each role be used to expedite these audits.
area support the needs of the business
while minimizing opportunities for conflicts in Administrator Role
segregation of duties. An important consideration with roles in
NetSuite is that there exist two administrative
NetSuites roles are configurable and can be
roles that are uniquely defined. Administrator
adjusted to match a companys specific needs,
and Full Access are two powerful
new roles can be defined to fill in gaps or
administrative roles that do not appear in the

list of roles, and do not appear in searches administrator-like permissions can be created
based on permissions and levels. These to minimize the number of administrators
permissions of these built-in roles are hard- who dont show on access reports, while still
coded into their very definition. providing elevated rights. Finally, users who
are members of the Administrator role, or Full
For example, a search of all roles with the
Access role, should have enhanced scrutiny
Manage Accounting Periods permission,
over their transactions via transaction audit
at a Full access level, would not show
trails and System Notes.
the built-in Administrator role. However,
because the Administrator role is defined
Script and Workflow Security
as having all permissions at Full level, any
SuiteScript allows developers and
user assigned the Administrator role could
administrators to create flexible business
manage accounting periods. The Full Access
logic within NetSuite tailored to specific
User is a similarly defined role, though with
business needsfrom sophisticated business
a more limited set of permissions than the
processes to entirely new applications. Built
Administrator role. These special roles and
on industry-standard JavaScript, SuiteScript
their access rights are detailed in the Help
enables full-featured application-level
system and customers should familiarize
scripting capabilities throughout NetSuite and
themselves with their capabilities prior to
supports sophisticated procedural logic with
assigning them to users.
robust debugging capabilities.
In addition to this, certain operations in
SuiteFlow provides developers and
NetSuite require the Administrator role, and
customers with easy-to-use point-and-click
have no corresponding permission in any
tools to customize and automate business
other built-in role, nor one that is assignable
processes via a robust graphical user
to a custom role. One must simply be an
interface that allows customers to easily
Administrator to perform the function.
create, view, edit and manage workflow states,
As such, customers are recommended to actions, rules and branching conditions, and
have at least one administrator and one back specify the triggering events that initiate a
up administrator. Beyond that, customers workflow, such as when records are viewed,
are advised to minimize the number of created, or updatedor schedule workflows
users assigned to the Administrator role to run automatically.
and encourage those users to sign in
Together, these powerful business logic
with more limited roles by default and
tools allow customers complete control
switch to the administrator role only when
of customization and automation of their
absolutely necessary. An alternative role with

business processes. The majority of NetSuite Setup Page activity, along with robust search
forms, records, customization objects, and and reporting audit trails, including reportings
their event/trigger points are programmatically financial layout changes.
accessible through SuiteScript and Workflow.
Since these scripts and workflows can
run invisibly, without user intervention or
knowledge, its important to ensure proper
control and change management over these
capabilities. In addition to the SDLC topics
previously covered, SuiteScript files should
be reviewed at least weekly to identify new
and changed scripts and to ensure that these
scripts are appropriate, approved,
and documented.
Further details, tips, and recommendations on
For individual scripts, the underlying
the various audit trails, system notes, search
JavaScript file shows changes to the script
and reporting capabilities can be found in the
via System Notes in NetSuite. The Script and
Help documentation of your NetSuite account,
Script Deployment records are also auditable
or trial account, under the topic Auditing Master
via System Notes. Workflows are auditable via
Data and Configuration Changes in NetSuite.
their History tab, and provide an XML object
describing all changes to the workflow. Tracking changes via an audit trail is a control
function, but doesnt provide a control benefit
Audit Trails without a review process. Items need to
In NetSuite, a complete audit trail ensures that be reviewed to ensure that changes were
financially-relevant changes to transactions appropriate. As part of an activity logging
are tracked with user login details and a review, users with appropriate permission
timestamp. System Notes on individual should review items like system notes, specific
transactions provide audit information for that field changes, script changes, key SOX controls,
transaction. The Transaction Audit Trail can and expired access. Since organizations may
be used to view System Notes for multiple have different needs, a user can also search for
transactions. System Notes are searchable specific information, for example, to display all
and can be exported for additional analysis. roles with Employee permission. Reviewing
There are also audit trails for changes to changes for appropriateness is an important
transaction lines, deleted transaction reports, part of any control environment.
Revenue Recognition Schedule changes,

Segregation of Duties That said, detective controls have the added
Segregation of duties is another critical benefit that they can be used to confirm that
control element in any system. No individual preventative controls are working properly.
should have excessive system access that For example, if a preventative control
enables them to execute transactions across indicates that users are prevented from
an entire business process without checks posting their own transactions, a report could
and balances. Allowing this type of access be reviewed monthly as a detective control
represents a very real risk to the business, to confirm that the preventative control is
and managing that risk in a pragmatic, working properly. Usually a mixture of both
effective way can be difficult. preventative and detective controls
is required.
Depending on the size of the organization, it
may not be possible to properly segregate The starting point for segregation of duties
all duties. Mitigating controls provide options in application security is to build a rule set
when proper segregation isnt possible. For of potential conflicts for an organizations
example, a supervisor review may be inserted specific situation. For example, a services
into a process when the process cant be firm that doesnt sell inventory doesnt need
separated among users. to design segregation of duties rules around
inventory control. Similarly, a check cashing
When considering appropriate segregation
firm might need greater controls around cash
of duties for an organization a key element
than the average business. As with other
is balancing preventative controls against
control points, a risk based approach is key
productivity. Preventative controls, often
to building a segregation of duties rule set.
embodied in application security, are
An organization doesnt have to be free of
designed to limit user access. While
segregation of duties conflicts. However, it
preventative controls are generally preferred,
does need a plan to mitigate those conflicts
preventative controls become a negative if
which cant be eliminated. An example rule
access is so restrictive that users are unable
might be that a user shouldnt have access
to do their jobs. An overly restrictive control
to both enter a payables transaction and
environment can drive users to seek alternate,
generate payments. This prevents an obvious
unapproved and unmonitored channels
risk of fraudulent payments.
to perform work which subvert security.
Detective controls, on the other hand, have
the benefit of not impeding the business
process, despite the cost of additional
overhead in their monitoring and sign-off.

Once an organization has a set of rules, those What are your risks?
rules should be reviewed against application
What are your rules?
security to understand where the two conflict.
Its also helpful to classify potential conflicts What are you doing about it?
as high, medium or low risk. This makes it
easier to concentrate on high risk items first Access Review
when deciding how to address conflicts. Maintaining security is not a static activity.
Some conflicts can be resolved by changing Organizational change, alone, requires
application security. Other conflicts regular review, monitoring, and adjustment
require mitigation. of application security, particularly of role
definition and assignment. As discussed
Mitigation previously, periodic audits of the permissions
Mitigation is the application of other controls that make up each role, and the users
to compensate for a conflict that are designed assigned, are an important part of maintaining
to minimize the conflicts impact. Mitigation security. Role assignments and permissions
does not fix or correct the conflict; rather, should be reviewed at least quarterly to
it allows the conflict to exist in the system ensure that they are appropriate. Once a
and creates, or cites existing, controls that well-managed and designed system of roles
compensate for the risk created by the and permission management is established,
conflict. For example, in a small organization, customers may want to move to a model of
a user might be able to enter vouchers and only auditing role and permission changes on
correct vendor addresses. This creates a a quarterly basis, and performing a full audit
risk that a check could be redirected to a only annually.
fraudulent address. Inserting a process that SOX-regulated, and other financial controls
requires supervisor level review of address sensitive businesses, a separate financial
changes and documentation supporting controls analysis of incompatible permissions
vendor address changes would help mitigate should be undertaken at least annually. In
against this risk. particular, key areas, like cash handling,
With all of that, we can boil the basics of should have the highest priority since
segregation of duties down to controlling permission in those areas is critical
three questions: to the organization.

SOD Tools
Given the often complex interactions between
role definitions, role assignments, global
permissions, custom scripts and workflows,
and various other compensating controls,
analyzing and identifying segregation of
duties conflicts in NetSuite is possible using
NetSuite searches and spreadsheet tools,
but the process is not trivial. Often complex
spreadsheets, usually with some amount of
macros, are utilized. Some organizations may
also use tools such as ACL, a data extraction
and analysis tool used for a variety of fraud
detection & prevention, as well as risk, audit,
and compliance management.
Customers may wish to consider using
third-party tools for evaluating segregation
of duties conflicts. For example, Fastpaths
Assure solution provides a risk based security
access review and segregation of duties
analysis platform configured specifically
for NetSuite. Assure includes the ability
to analyze segregation of duties by user,
company/subsidiary, role, and permission
allowing administrators to easily see conflicts
across roles. Assure also makes it simple to
review and sign off on mitigating controls.
Assure from Fastpath can be a powerful tool
in achieving SOX compliance in NetSuite.

Chapter 4
IT APPLICATION
CONTROLS OVER
FINANCIAL REPORTING
Determining the Significant Business investor given a specific set of circumstances

Processes and Determining Controls related to the fair presentation of a companys
over Transaction Processing financial statements and disclosures.
Organizations designing their implementation Attempting to establish this amount in a
of NetSuite may already have established vacuum without consultation can lead to faulty
governance from a manual or previous scoping and an ineffective design of the key
environment. An important consideration in internal controls.
designing an instance of NetSuite is what
Audit firms may apply standard methodologies
controls are necessary, and most efficient
to determining materiality. Common
in mitigating critical risks. A best practice in
calculation methods applied may include
designing an efficient process is properly
thresholds like 0.5 1% of gross sales, 1% of
scoping the significant accounts from the
total equity, a percentage of total assets or a
financial statements.
percentage of net revenues. Materiality can
To scope significant accounts in the financial also be a blended assessment where higher
statements, the auditors should be consulted values or a different methodology is applied
to help determine materiality in the context of to accounts determined to be less at risk to
an audit of the financial statements. Materiality misstatement and less commonly relied upon
is generally defined as misstatements, by the users of the financial statements.
including omissions, that when considered
Once materiality is discussed with the
individually or in aggregate could reasonably
auditors and determined to be appropriately
be expected to impact the decisions of users
established, the in scope accounts or those
of the financial statements. Materiality is
in excess of the materiality threshold, should
determined in conjunction with the auditors
be determined. Accounts that are particularly
and requires professional judgment to be
susceptible to fraud or other risk can and
applied based upon the size and nature
should be considered in-scope at any value,
of accounts, and what will versus what will
including zero.
not affect the decision of a knowledgeable

In financial reporting, there are 5 assertions include the right people in the conversation.
that management is expected to make Many organizations rely upon a Compliance
regarding its financial statement accounts:3 or Audit Department to determine and
outline risk to the financial statements. While
Completeness All transactions and
it is important to have risk management
accounts that should be presented in the
specialists as part of the conversation, it
financial statements are so included.
is also critical to bring management of the
Existence/Occurrence Assets or liabilities organization and staff level representatives
of the company exist at a given date, and into the discussion. When discussing a group
recorded transactions have occurred during of accounts, consider all of the applicable
a given period. attributes including, but not limited to, fraud
Allocation/Valuation Asset, liability, equity, susceptibility, normal balances, number of
revenue, and expense components have users, nature of transactions, etc. All risks
been included in the financial statements at potentially related to a misstatement of a
appropriate amounts. group of accounts should be considered and
Rights and Obligations The company then determined if they could have a material
holds or controls rights to the assets, and impact on the financial statements.
liabilities are obligations of the company at a After consideration, the risks should be
given date. compiled into a complete list to create a full
Presentation and Disclosure The risk analysis of items that could impact the
components of the financial statements are financial statements. Once the complete list
properly classified, described, and disclosed. is compiled, a global view should be taken
by those responsible for the risk analysis
IT application controls typically address risks and control of the financial statements to
that are related to completeness, determine if overlapping risks can be merged
existence/occurrence, and allocation/ or deleted. Also consider whether there are
valuation (accuracy). any risks at this point in the process that have
When determining risks, it is important to keep not been included in the list that could lead to
these assertions in mind, as those that are the financial statements being misstated.
considered relevant for financial reporting are Finally, once a full listing of all risks is
those that impact these assertions. established, it is time to identify or design the
Once the in-scope accounts are outlined, most efficient and effective internal control
organizations should consider risks to processes to mitigate these risks. NetSuite
misstatement of transactions impacting offers the opportunity for users to design
these accounts. In doing so, it is important to these control processes in a preventative,
NetSuite Inc. 2016 3

Public Company Accounting Oversight Board (PCAOB) Auditing Standard No. 15, Auditing Oversight. Page 32
http://pcaobus.org/standards/auditing/pages/auditing_standard_15.aspx
automated, fashion that leads to proactive risk. In the process of this review, companies
monitoring of account balances, and reduced may find duplicate or inefficient processes
manual, time-consuming processes on that can be removed.
the back-end. This can significantly speed
the process of closing the books at period
end. Workflows in NetSuite can be setup
to prevent changes without going through
an appropriate change management
process. With workflows, organizations can
rely upon the fact that transactions were
properly recorded. Companies may be able
to establish most of their controls in this
automated workflow fashion and rely upon
high level analytical procedures by senior
management during period-end.
After internal control processes are designed IT Application Controls (Business
and linked to risks that they mitigate, the Process Controls)
process should be reviewed to identify Each customer designs their business
gaps where attributes of the control are processes based on the needs of their
missing at a global level. When applying organization. The level of internal controls
a framework like CAVR (completeness, should depend on the firms risks and
accuracy, validity, & restricted access) make risk appetite. Business Process Controls
certain that all of the applicable attributes are encompasses the full range of items including
mitigated. For instance, for many account logical security, workflow, approvals and
balances both completeness and existence manual control items. Controls can be manual,
should be considered and controls are or exist inside of an application, and the
often designed to mitigate only one side of control environment may include both, as in
those considerations. After all of the Risk this example:
and Control Matrices (RCMs) are determined Logical security (in the form of role definition,
and established, an organization review assignment, and periodic review) is used to
their governance procedures and determine ensure a user only has rights to generate a
if there are legacy procedures that are no file for electronic funds transmission (EFT).
longer necessary. Management should
Custom workflows and logical security
also review processes that are part of an
ensure that the process was properly
organizations regular activities to mitigate
segregated prior to this step and that the
operational or business risk, not just financial
payment was approved.

A manual review matching the payments defined, a failure in this consideration
listed in NetSuite and the EFT file completed may lead to an overall ineffective rating
is evidenced by the signature of another because it does not fully address the risk.
user prior releasing the file to the bank. For example: the control states that all
system transactions have a vetted vendor,
Additional Considerations but the auditor discovers that 50% of all
After designing the control process and transactions happen outside the system
determining which areas and controls to using alternative methods. This may lead
automate, it is important to understand to the control being deemed ineffective.
that there are other aspects of the control Master Data Access and Administration
environment that should be properly system transactions rely heavily on inputs
designed in order for the controls to and master data. IT application controls are
work properly. usually designed to make sure a process is
Management Override/Workarounds this done consistently and accurately. However,
pertains to alternative processes that allows if master data is not set up properly, the
the transactions to go through outside of process would not be reliable, potentially
the established processes and controls. increasing the risk of misstatements or fraud.
For example, to reduce procurement fraud, For example, workflows are a great way to
a business may design the procurement ensure that approvals for transactions are
process to require that transactions should performed properly. However, if underlying
only be done with vendors that have data, like the organization chart or approval
been vetted and created in the system. limits, are incorrectly setup, then the
However, management may opt to override workflows effectiveness may be reduced
this process by allowing purchases to be or eliminated as a control. Auditors typically
done outside the system. This alternative check master data access and processes as
process can now render the defined part of their overall assessment of
controls potentially ineffective, especially if control activities.
the alternative process is subject to abuse
These considerations, and potentially others,
because it is easier. When designing
should be assessed and taken into context
business processes and alternative
not just when designing controls, but also
workarounds that could potentially
even after they have been established and
undermine the main process, management
put in place. This is outside the scope of what
needs to take into account the level of risk
is traditionally considered IT General Controls,
included. From an auditors point of view,
and IT Application Controls.
even with an effective IT Application control

Chapter 5
NETSUITE AUDIT
ENABLEMENT
The NetSuite application has many features 2. Scripting. Scripts are another way to
that enable user entities to build and manage establish controls that do not come out
proper internal controls over its financial of the box within NetSuite. For example:
reporting. The use of NetSuite as a financial Invoices are required to be reviewed and
system provides the opportunity for financial approved by the person who created the
process controls to exist in a single system PO and who is the business owner for the
for the organization and then extend that expense. This enables the AP team to
functionality with either custom developed determine whether the invoices from the
applications, or with partner applications vendors are appropriate, and to ensure
offered on SuiteApp.com. that they are matched against the proper
invoice. Currently, this is done through
There are several customizations that can be
scripting. When the AP team creates an
done help to ensure that financial transactions
invoice against a vendor and the PO, a
are reasonably free from misstatements due
script could be used to generate an
to errors. These include, but are not limited to:
email which is sent to the business owner
1. Workflows to establish dual requesting approval of the invoice for
authorization to address SOD issues. payment. Scripting could also be used
Workflows provides additional segregation to capture the business owner approval
of duties controls beyond logical security. directly from email.
For example, workflows can provide
3. Saved Searches on Audit Trail to
approval limits and prevent users
monitor specific transactions. For
from approving their own transactions.
most financial transactions that happen
Workflows are designed and built in
in NetSuite, an audit trail is established
NetSuite by organizations to meet that
and can be tracked on monitored, and
companys specific needs.
are searchable. Changes to roles,
customizations released into the system,
transactions created, etc., can all be
tracked in the system, with some limitations.

Saved search alerts can be created Further details, tips, and recommendations on
to identify items outside of ordinary the various audit trails, system notes, search
processing. A saved search email alert and reporting capabilities can be found in the
for any transactions initiated by personnel Help documentation of your NetSuite account,
who would not normally be initiating such or trial account, under the topic Auditing
transactions is an example. A company Master Data and Configuration Changes
may want to identify any POs created by in NetSuite.
AP since they are part of the procure to
pay process. Monitoring POs they create There are myriad ways to implement controls
could allow management to detect any within NetSuite, as it was designed to be
questionable transactions, especially if customizable for each customers business
the user is involved in another part of the needs. Each customer should properly
process. Monitoring changes to credit understand their risks, how they want to
levels, terms and addresses are address it, how much controls they put
other examples. in place, and how they will monitor these
controls. Customers must also understand
4. SuiteSolutions. SuiteSolutions are their compliance obligations, and the
custom SuiteApps developed by NetSuite requirements for each of these obligations.
Professional Services for commonly NetSuite is a tool designed to help customers
requested enhancements, but which often meet their business needs, but it is up to
have customer-specific components or customers to determine how they can best
business logic. Several of these SuiteApps use NetSuite to do so.
have been designed to address ITAC
considerations for financial controls, such
as Three-way Match for PO, Invoice, and
Receipt of Goods (SuiteBundle 16707).
5. Manual controls. There are some areas

in NetSuite not yet addressed by automatic
control. It is important to review these items
and ensure that controls outside the system
are established to monitor these types
of transactions.

Chapter 6
CONCLUSION
A system of good internal controls is Des Moines, Iowa, Fastpath delivers easy-to-
necessary in any organization to minimize use business solutions that offer customers
errors, misstatements and fraud. Public a rapid return-on-investment. Fastpath
companies in particular are required to applications include Assure, Audit Trail and
establish effective IT general control Config AD and are sold directly and via
frameworks to comply with regulatory authorized resellers around the world.
requirements such as the Sarbanes-Oxley For more information, visit
Act (SOX), regardless of whether a cloud- www.gofastpath.com.
based business management software is
being utilized. As a cloud-based solution, the About Protiviti Inc.
infrastructure portion of a companys control Protiviti is a global consulting firm that
framework is managed by NetSuite. NetSuite helps companies solve problems in finance,
provides a host of options for customers to technology, operations, governance, risk and
develop, maintain, and monitor their portion internal audit, and has served more than 60
of the control framework from within the percent of Fortune 1000 and 35 percent
NetSuite system. Third party applications of Fortune Global 500 companies. Protiviti
are also available that provide additional and its independently owned Member Firms
tools for control environment management. serve clients through a network of more than
A cloud-based environment doesnt remove 70 locations in over 20 countries. The firm
the responsibility for good controls, instead it also works with smaller, growing companies,
shares the burden to allow firms to focus on including those looking to go public, as well
their portion of the control framework. as with government agencies.
About Fastpath Ranked 57 on the 2016 Fortune 100 Best

Since 2004, Fastpath has been providing Companies to Work For list, Protiviti is a
auditing, security and compliance solutions wholly owned subsidiary of Robert Half
for mid-market ERP solutions to companies (NYSE: RHI). Founded in 1948, Robert Half is a
and organizations globally. Headquartered in member of the S&P 500 index.
.
#1 Cloud ERP

Netsuite Control Considerations For Finanical Reporting

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Netsuite Control Considerations For Finanical Reporting

Uploaded by

Copyright:

Available Formats

NETSUITE

Executive Scope Introduction

Page 3 Page 4 Page 6

Page 8 Page 12 Page 16

Page 31 Page 35 Page 37

Executive Overview owned companys service offerings. In/out-of-

NetSuite Inc. 2016 Page 3

This whitepaper discusses the financial

NetSuite Inc. 2016 Page 4

NetSuite Inc. 2016 Page 5

It is common for companies that use, or are As a cloud-based solution, NetSuite

NetSuite Inc. 2016 1

NetSuite Inc. 2016 Page 7

NetSuite Inc. 2016 Page 8

NetSuite Inc. 2016 Page 9

NetSuite Inc. 2016 Page 10

ITGC BCP/Disaster Recovery x x

ITGC System Uptime and Availability x x x x

NetSuite Inc. 2016 Page 11

NetSuite Inc. 2016 Page 12

Best practices generally hold that roles

NetSuite Inc. 2016 Page 13

NetSuite Inc. 2016 Page 14

NetSuite Inc. 2016 Page 15

Controls dont happen naturally. Good 1. System Development and Change

NetSuite Inc. 2016 Page 16

NetSuite Inc. 2016 Page 17

NetSuite Inc. 2016 Page 18

NetSuite Inc. 2016 Page 19

NetSuite Inc. 2016 Page 20

NetSuite Inc. 2016 Page 21

Within one week, before or after, of a In this context, it is also important to

NetSuite Inc. 2016 Page 22

NetSuite Inc. 2016 Page 23

NetSuite Inc. 2016 Page 24

NetSuite Inc. 2016 Page 25

NetSuite Inc. 2016 Page 26

NetSuite Inc. 2016 Page 27

NetSuite Inc. 2016 Page 28

NetSuite Inc. 2016 Page 29

NetSuite Inc. 2016 Page 30

Determining the Significant Business investor given a specific set of circumstances

NetSuite Inc. 2016 Page 31

NetSuite Inc. 2016 3

NetSuite Inc. 2016 Page 33

NetSuite Inc. 2016 Page 34

NetSuite Inc. 2016 Page 35

5. Manual controls. There are some areas

NetSuite Inc. 2016 Page 36

About Fastpath Ranked 57 on the 2016 Fortune 100 Best

NetSuite Inc. 2016 Page 37

You might also like