{"id":3173,"date":"2026-10-28T14:29:28","date_gmt":"2026-10-28T08:59:28","guid":{"rendered":"https:\/\/www.nevastech.com\/blog\/?p=3173"},"modified":"2026-10-28T14:29:28","modified_gmt":"2026-10-28T08:59:28","slug":"segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for","status":"publish","type":"post","link":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/","title":{"rendered":"Segregation of Duties in Dynamics GP: The Conflicts Auditors Look For"},"content":{"rendered":"<p>Few things make a finance director more uncomfortable than an audit management letter that says: &#8220;Segregation of duties within the ERP system is inadequate.&#8221;<\/p>\n<p>It is one of the most common findings for organizations running <a href=\"https:\/\/www.nevastech.com\/solutions\/microsoft-dynamics-erp\/microsoft-dynamics-gp\/\">Dynamics GP<\/a>. Not because GP lacks the tools, but because security was often set up quickly during implementation, with broad access to keep things moving, and then never revisited. Over the years, people change roles, small teams cover for each other, and access only ever grows.<\/p>\n<p>In this article, we will explain what segregation of duties means in practical terms, the specific conflicts auditors look for in GP, and how to tighten your controls without making daily work impossible.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_Segregation_of_Duties_Means\"><\/span>What Segregation of Duties Means<span class=\"ez-toc-section-end\"><\/span><\/h2><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_79 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title ez-toc-toggle\" style=\"cursor:pointer\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#What_Segregation_of_Duties_Means\" >What Segregation of Duties Means<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#How_Security_Works_in_Dynamics_GP\" >How Security Works in Dynamics GP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#The_Conflicts_Auditors_Look_For\" >The Conflicts Auditors Look For<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#1_Vendor_maintenance_and_payables_processing\" >1. Vendor maintenance and payables processing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#2_Entering_and_posting_payables_batches\" >2. Entering and posting payables batches<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#3_Customer_maintenance_and_cash_receipts\" >3. Customer maintenance and cash receipts<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#4_Cash_receipts_and_bank_reconciliation\" >4. Cash receipts and bank reconciliation<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#5_Journal_entry_and_approval\" >5. Journal entry and approval<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#6_Purchasing_and_receiving\" >6. Purchasing and receiving<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#7_Inventory_adjustments_and_stock_custody\" >7. Inventory adjustments and stock custody<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#8_Payroll_setup_and_payroll_processing\" >8. Payroll setup and payroll processing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#9_Security_administration_and_transactions\" >9. Security administration and transactions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#10_The_POWERUSER_role_and_shared_logins\" >10. The POWERUSER role and shared logins<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#How_to_Find_the_Conflicts_in_Your_System\" >How to Find the Conflicts in Your System<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#How_to_Fix_Them_in_GP\" >How to Fix Them in GP<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Redesign_roles_around_real_jobs\" >Redesign roles around real jobs<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Remove_POWERUSER_from_everyday_users\" >Remove POWERUSER from everyday users<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Use_batch_approval\" >Use batch approval<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Use_Workflow_for_approvals\" >Use Workflow for approvals<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Turn_on_Activity_Tracking_and_audit_trails\" >Turn on Activity Tracking and audit trails<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Close_the_obvious_gaps\" >Close the obvious gaps<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#When_the_Team_Is_Too_Small_to_Separate_Duties\" >When the Team Is Too Small to Separate Duties<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#A_Note_on_Licensing\" >A Note on Licensing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Looking_Ahead_to_Business_Central\" >Looking Ahead to Business Central<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#How_Nevas_Technologies_Can_Help\" >How Nevas Technologies Can Help<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Summarizing_the_Key_Points\" >Summarizing the Key Points<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#What_is_the_most_common_SoD_finding_in_Dynamics_GP\" >What is the most common SoD finding in Dynamics GP?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#Can_Dynamics_GP_prevent_conflicting_access_automatically\" >Can Dynamics GP prevent conflicting access automatically?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#How_can_I_track_changes_to_vendor_bank_details\" >How can I track changes to vendor bank details?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#How_often_should_GP_access_be_reviewed\" >How often should GP access be reviewed?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n<p>Segregation of duties (SoD) is a simple principle: no single person should be able to carry out every step of a sensitive process on their own. If one person can create a supplier, enter an invoice and pay it, there is nothing to stop an error or a fraud from going unnoticed.<\/p>\n<p>Typically, a process is split into four kinds of activity:<\/p>\n<ul>\n<li><strong>Authorization:<\/strong> approving a transaction<\/li>\n<li><strong>Recording:<\/strong> entering it in the system<\/li>\n<li><strong>Custody:<\/strong> handling the related asset, such as cash or stock<\/li>\n<li><strong>Reconciliation:<\/strong> checking the results independently<\/li>\n<\/ul>\n<p>Good control means these sit with different people, or that a strong compensating control exists where they cannot be separated.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_Security_Works_in_Dynamics_GP\"><\/span>How Security Works in Dynamics GP<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>To fix SoD issues, it helps to recognize how GP security is built. Dynamics GP uses role-based security with three layers:<\/p>\n<ul>\n<li><strong>Operations:<\/strong> individual windows, reports and SmartLists.<\/li>\n<li><strong>Tasks:<\/strong> groups of operations, such as &#8220;Enter payables transactions&#8221;.<\/li>\n<li><strong>Roles:<\/strong> groups of tasks that match a job, such as &#8220;AP Clerk&#8221;.<\/li>\n<\/ul>\n<p>Roles are then assigned to each user, per company, in User Security Setup. A user can have several roles, and their access is the combined total of all of them.<\/p>\n<p>That last point matters. Most SoD conflicts are not caused by a single badly designed role. They appear when two reasonable roles are given to the same person.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_Conflicts_Auditors_Look_For\"><\/span>The Conflicts Auditors Look For<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>These are the combinations we see questioned most often in GP audits.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"1_Vendor_maintenance_and_payables_processing\"><\/span>1. Vendor maintenance and payables processing<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This is the conflict auditors focus on first. If one person can create or change a vendor, including bank details, and also enter invoices or produce payments, they could set up a fictitious supplier or redirect a genuine supplier&#8217;s payments to their own account.<\/p>\n<p>We would emphasize vendor bank details in particular. Changes to EFT information are a frequent route for payment fraud, both internal and through fake emails from &#8220;suppliers&#8221;.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Entering_and_posting_payables_batches\"><\/span>2. Entering and posting payables batches<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If the same person enters invoices and posts the batch without any review, there is no independent check before the ledger is updated.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Customer_maintenance_and_cash_receipts\"><\/span>3. Customer maintenance and cash receipts<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A user who can create customers, change credit limits or issue credit notes, and also record cash receipts, could hide misappropriated cash by crediting the customer account.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Cash_receipts_and_bank_reconciliation\"><\/span>4. Cash receipts and bank reconciliation<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The person who records money coming in should not be the person who reconciles the bank account, because the reconciliation is the control that would detect missing receipts.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Journal_entry_and_approval\"><\/span>5. Journal entry and approval<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Manual general ledger journals are a classic area of risk. Auditors expect journals, especially large or unusual ones, to be reviewed by someone other than the person who prepared them.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"6_Purchasing_and_receiving\"><\/span>6. Purchasing and receiving<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If one user can raise a purchase order and also record the goods receipt, they could approve and &#8220;receive&#8221; goods that never arrived.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"7_Inventory_adjustments_and_stock_custody\"><\/span>7. Inventory adjustments and stock custody<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Warehouse staff who handle stock should not also be able to post inventory adjustments, as these can hide losses.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"8_Payroll_setup_and_payroll_processing\"><\/span>8. Payroll setup and payroll processing<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Creating employees, changing pay rates and running payroll should be separated, with an independent review of changes before each run.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"9_Security_administration_and_transactions\"><\/span>9. Security administration and transactions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Anyone who can change security can give themselves any access they want. Security administrators should not perform day-to-day finance transactions.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"10_The_POWERUSER_role_and_shared_logins\"><\/span>10. The POWERUSER role and shared logins<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This is the one auditors almost always ask about. The POWERUSER role gives unrestricted access to everything in a company. It is often assigned &#8220;temporarily&#8221; during implementation and never removed.<\/p>\n<p>Auditors will also ask about:<\/p>\n<ul>\n<li>The sa and DYNSA accounts, which have full rights over the GP databases and should be used only for administration.<\/li>\n<li>Shared or generic logins, such as &#8220;accounts1&#8221;, which make it impossible to know who did what.<\/li>\n<li>Leavers&#8217; accounts that are still active.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"How_to_Find_the_Conflicts_in_Your_System\"><\/span>How to Find the Conflicts in Your System<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Before changing anything, you need a clear picture of current access. Here is a practical approach:<\/p>\n<ol>\n<li><strong>List users and roles per company:<\/strong> GP&#8217;s security reports, and SmartList or SQL queries against the security tables, can show which roles each user has in each company.<\/li>\n<li><strong>Check for POWERUSER:<\/strong> Identify every user with this role, in every company.<\/li>\n<li><strong>Build a simple conflict matrix:<\/strong> List the key activities down one side and across the top, and mark which combinations are not allowed.<\/li>\n<li><strong>Compare users against the matrix:<\/strong> Highlight anyone holding conflicting access.<\/li>\n<li><strong>Review with managers:<\/strong> Some conflicts will be genuine requirements in a small team. Others will be leftover access that nobody needs.<\/li>\n<\/ol>\n<p>Analyzing access this way usually reveals that a large share of conflicts can simply be removed, because the person no longer needs the access.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_Fix_Them_in_GP\"><\/span>How to Fix Them in GP<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Redesign_roles_around_real_jobs\"><\/span>Redesign roles around real jobs<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Create roles that match how your team actually works, such as AP Clerk, AP Supervisor, Credit Controller and GL Accountant, rather than relying on the standard roles, which are often broader than needed. Keep vendor maintenance and customer maintenance in their own roles, so they can be given to a small number of people.<\/p>\n<p>This level of customization is normal and recommended. Microsoft&#8217;s default roles are a starting point, not a final design.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Remove_POWERUSER_from_everyday_users\"><\/span>Remove POWERUSER from everyday users<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No regular finance user should have POWERUSER. Replace it with proper roles. Keep administrative accounts separate from personal accounts used for daily work.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Use_batch_approval\"><\/span>Use batch approval<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>GP can require batch approval before posting in many modules. This means one person enters the batch and another approves it, creating a clear review step.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Use_Workflow_for_approvals\"><\/span>Use Workflow for approvals<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>GP&#8217;s built-in Workflow module can require approval for payables transactions, purchase orders, general ledger batches and new or changed vendors. Approvals are recorded in GP, which gives auditors clear evidence. Our article on Dynamics GP modules you may own but not use explains Workflow in more detail.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Turn_on_Activity_Tracking_and_audit_trails\"><\/span>Turn on Activity Tracking and audit trails<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Activity Tracking records logins, file access and posting activity. Field-level audit trails can record who changed sensitive fields, such as vendor bank details or credit limits, and when. Use these sparingly on the fields that matter, as excessive tracking can affect performance.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Close_the_obvious_gaps\"><\/span>Close the obvious gaps<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li>Remove or deactivate leavers promptly.<\/li>\n<li>Replace shared logins with named users.<\/li>\n<li>Restrict sa to IT administrators and protect its password.<\/li>\n<li>Review access every quarter or every six months, and keep evidence of the review.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"When_the_Team_Is_Too_Small_to_Separate_Duties\"><\/span>When the Team Is Too Small to Separate Duties<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Many GP customers have finance teams of two or three people. Full segregation is not always possible, and auditors understand that. What they expect is compensating controls, such as:<\/p>\n<ul>\n<li>A manager reviewing a monthly report of new and changed vendors and customers<\/li>\n<li>Independent review of the payment run before it is released<\/li>\n<li>A senior person reviewing all journals above a set value<\/li>\n<li>Bank reconciliations reviewed and signed off by someone else<\/li>\n<li>Regular review of the Activity Tracking or audit trail report<\/li>\n<\/ul>\n<p>The key is that the review is documented. A control that happens but leaves no evidence is, from an auditor&#8217;s point of view, a control that did not happen.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"A_Note_on_Licensing\"><\/span>A Note on Licensing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some organizations share logins to save on GP license costs. This is understandable, but it undermines segregation of duties completely, because nobody can tell which person carried out a transaction. If concurrent licenses are tight, it is usually better to review user counts with your partner than to share accounts. Our Dynamics GP pricing team can help.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Looking_Ahead_to_Business_Central\"><\/span>Looking Ahead to Business Central<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If your organization is planning a <a href=\"https:\/\/www.nevastech.com\/services\/dynamics-gp-to-business-central-migration\">Dynamics GP to Business Central migration<\/a>, this is an excellent moment to get security right. User permissions do not migrate automatically, so you will design them afresh in <a href=\"https:\/\/www.nevastech.com\/solutions\/microsoft-dynamics-365\/microsoft-dynamics-365-business-central\/\">Dynamics 365 Business Central<\/a>. The SoD matrix you build for GP today becomes the blueprint for your Business Central permission sets.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_Nevas_Technologies_Can_Help\"><\/span>How Nevas Technologies Can Help<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Nevas Technologies has worked with Dynamics GP since version 7.0 and regularly helps clients prepare for audits. We can:<\/p>\n<ul>\n<li>Review your GP security and produce a clear conflict report through our <a href=\"https:\/\/www.nevastech.com\/solutions\/microsoft-dynamics-erp\/microsoft-dynamics-gp\/dynamics-gp-support\">Dynamics GP support<\/a> services<\/li>\n<li>Redesign roles and tasks around your team&#8217;s real responsibilities<\/li>\n<li>Set up Workflow, batch approval, Activity Tracking and audit trails<\/li>\n<li>Train your administrators on security management with <a href=\"https:\/\/www.nevastech.com\/solutions\/microsoft-dynamics-erp\/microsoft-dynamics-gp\/dynamics-gp-training\">Dynamics GP training<\/a><\/li>\n<li>Bring older systems onto a supported version with a <a href=\"https:\/\/www.nevastech.com\/solutions\/microsoft-dynamics-erp\/microsoft-dynamics-gp\/dynamics-gp-upgrade\">Dynamics GP upgrade<\/a><\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Summarizing_the_Key_Points\"><\/span>Summarizing the Key Points<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Segregation of duties means no one person controls a sensitive process from start to finish.<\/li>\n<li>Top conflicts: vendor maintenance with payables, customer maintenance with cash receipts, journal entry without approval, and POWERUSER access.<\/li>\n<li>Find conflicts by listing users, roles and companies against a simple conflict matrix.<\/li>\n<li>Fix them with focused roles, batch approval, Workflow, audit trails and regular access reviews.<\/li>\n<li>In small teams, use documented compensating controls.<\/li>\n<\/ul>\n<p>With a clear security design and a few well-chosen controls, your next audit can be a much more comfortable conversation.<\/p>\n<p>If you would like a segregation of duties review of your GP system, contact Nevas Technologies and our GP specialists will be glad to help.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"What_is_the_most_common_SoD_finding_in_Dynamics_GP\"><\/span>What is the most common SoD finding in Dynamics GP?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Users who can both maintain vendors and process payables, followed closely by everyday users with the POWERUSER role.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Can_Dynamics_GP_prevent_conflicting_access_automatically\"><\/span>Can Dynamics GP prevent conflicting access automatically?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>GP does not block conflicting role combinations on its own. You need to design roles carefully and review assignments regularly.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_can_I_track_changes_to_vendor_bank_details\"><\/span>How can I track changes to vendor bank details?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Use field-level audit trails on the relevant fields and, where possible, Workflow approval for vendor changes.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_often_should_GP_access_be_reviewed\"><\/span>How often should GP access be reviewed?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Most auditors expect at least an annual review, and many organizations review quarterly or every six months, with documented evidence.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Few things make a finance director more uncomfortable than an audit management letter that says: &#8220;Segregation of duties within the ERP system is inadequate.&#8221; It is one of the most common findings for organizations running Dynamics GP. Not because GP lacks the tools, but because security was often set up quickly during implementation, with broad &#8230; <a title=\"Segregation of Duties in Dynamics GP: The Conflicts Auditors Look For\" class=\"read-more\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/\" aria-label=\"Read more about Segregation of Duties in Dynamics GP: The Conflicts Auditors Look For\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":3174,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-3173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dynamics-gp"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Segregation of Duties in Dynamics GP: Audit Conflicts<\/title>\n<meta name=\"description\" content=\"The segregation of duties conflicts auditors look for in Dynamics GP, and how to fix them with security roles and controls.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Segregation of Duties in Dynamics GP: Audit Conflicts\" \/>\n<meta property=\"og:description\" content=\"The segregation of duties conflicts auditors look for in Dynamics GP, and how to fix them with security roles and controls.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/\" \/>\n<meta property=\"og:site_name\" content=\"Nevas Technologies Insights\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-28T08:59:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/10\/Segregation-of-Duties-in-Dynamics-GP.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1672\" \/>\n\t<meta property=\"og:image:height\" content=\"941\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"John Solomon\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"John Solomon\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Segregation of Duties in Dynamics GP: Audit Conflicts","description":"The segregation of duties conflicts auditors look for in Dynamics GP, and how to fix them with security roles and controls.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/","og_locale":"en_US","og_type":"article","og_title":"Segregation of Duties in Dynamics GP: Audit Conflicts","og_description":"The segregation of duties conflicts auditors look for in Dynamics GP, and how to fix them with security roles and controls.","og_url":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/","og_site_name":"Nevas Technologies Insights","article_published_time":"2026-10-28T08:59:28+00:00","og_image":[{"width":1672,"height":941,"url":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/10\/Segregation-of-Duties-in-Dynamics-GP.png","type":"image\/png"}],"author":"John Solomon","twitter_card":"summary_large_image","twitter_misc":{"Written by":"John Solomon","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#article","isPartOf":{"@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/"},"author":{"name":"John Solomon","@id":"https:\/\/www.nevastech.com\/blog\/#\/schema\/person\/4999a5a32569d9cb02ceb097d8bb6f9f"},"headline":"Segregation of Duties in Dynamics GP: The Conflicts Auditors Look For","datePublished":"2026-10-28T08:59:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/"},"wordCount":1717,"publisher":{"@id":"https:\/\/www.nevastech.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#primaryimage"},"thumbnailUrl":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/10\/Segregation-of-Duties-in-Dynamics-GP.png","articleSection":["Dynamics GP"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/","url":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/","name":"Segregation of Duties in Dynamics GP: Audit Conflicts","isPartOf":{"@id":"https:\/\/www.nevastech.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#primaryimage"},"image":{"@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#primaryimage"},"thumbnailUrl":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/10\/Segregation-of-Duties-in-Dynamics-GP.png","datePublished":"2026-10-28T08:59:28+00:00","description":"The segregation of duties conflicts auditors look for in Dynamics GP, and how to fix them with security roles and controls.","breadcrumb":{"@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#primaryimage","url":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/10\/Segregation-of-Duties-in-Dynamics-GP.png","contentUrl":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/10\/Segregation-of-Duties-in-Dynamics-GP.png","width":1672,"height":941,"caption":"Segregation of Duties in Dynamics GP"},{"@type":"BreadcrumbList","@id":"https:\/\/www.nevastech.com\/blog\/segregation-of-duties-in-dynamics-gp-the-conflicts-auditors-look-for\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.nevastech.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Segregation of Duties in Dynamics GP: The Conflicts Auditors Look For"}]},{"@type":"WebSite","@id":"https:\/\/www.nevastech.com\/blog\/#website","url":"https:\/\/www.nevastech.com\/blog\/","name":"Nevas Technologies Insights","description":"Nevas Technologies Insights","publisher":{"@id":"https:\/\/www.nevastech.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nevastech.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nevastech.com\/blog\/#organization","name":"Nevas Technologies Insights","url":"https:\/\/www.nevastech.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nevastech.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2022\/09\/nevas-tech-logo.png","contentUrl":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2022\/09\/nevas-tech-logo.png","width":171,"height":50,"caption":"Nevas Technologies Insights"},"image":{"@id":"https:\/\/www.nevastech.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nevastech.com\/blog\/#\/schema\/person\/4999a5a32569d9cb02ceb097d8bb6f9f","name":"John Solomon","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/01\/Gemini_Generated_Image_85xsyk85xsyk85xs.png","url":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/01\/Gemini_Generated_Image_85xsyk85xsyk85xs.png","contentUrl":"https:\/\/www.nevastech.com\/blog\/wp-content\/uploads\/2026\/01\/Gemini_Generated_Image_85xsyk85xsyk85xs.png","caption":"John Solomon"},"sameAs":["https:\/\/www.nevastech.com\/"],"url":"https:\/\/www.nevastech.com\/blog\/author\/nevas_blog_author\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/posts\/3173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/comments?post=3173"}],"version-history":[{"count":2,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/posts\/3173\/revisions"}],"predecessor-version":[{"id":3177,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/posts\/3173\/revisions\/3177"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/media\/3174"}],"wp:attachment":[{"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/media?parent=3173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/categories?post=3173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nevastech.com\/blog\/wp-json\/wp\/v2\/tags?post=3173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}