# GP Controller Series: Keys to Role Management

- URL: https://dynamicaccounting.net/gp-controller-series-keys-to-role-management/
- Date: 2018-11-27
- Topics: Install, Upgrade & Admin, Payables & Receivables
- Type: original article

Security around an ERP system is a key area and yet a lot of GP companies have users with excessive privileges. You really want to avoid having to make statements like Costo did:

> “The weakness relates to general information technology controls in the areas of user access and program change-management over certain information technology systems that support the Company’s financial reporting processes. The access issues relate to the extent of privileges afforded users authorized to access company systems.”
>
> https://normanmarks.wordpress.com/2018/10/06/costco-reports-a-material-weakness-in-internal-control-but-is-it-really/

So how do you fix this in GP? There are a lot of pieces, but we’ll hit the highlights and include plenty of resources.

1. **Control/Limit/Eliminate ‘**sa**‘ & ‘**Dynsa**‘ users, and don’t assign the ‘**Power User**‘ role.** Once the system is up an running, ‘sa’ is really only recommended for installing additional modules and running the GP Utilities APPLICATION (not utilities in GP). Everything else can be done with other permissions. Dynsa is required to exist and own the database. There is no reason for a user to need it. The Power User role simply provides too much access and creates a risk of both intentional and accidental issues. [Fastpath’s Minimizing the Use of ‘](https://www.gofastpath.com/blog/fastpath-white-paper-minimizing-the-use-of-sa-in-microsoft-dynamics-gp)sa’ whitepaper is a great resource for addressing this.
2. **Rebuild & reassign roles in GP.** The roles in GP are designed to complete a process from beginning to end. This works great for testing and violates segregation of duties principles across the board. An AP clerk should not be able to create a vendor, enter a voucher, and process payment without additional controls, but that is what the AP Clerk role allows. The tasks are a great starting point, but they need to be reassigned into new roles. [Fastpath’s free Security Matrix is a good tool to start the role rebuilding process with.](https://www.gofastpath.com/gp2016-security-matrix-0)
3. **Identify mitigating controls.** There are a number of features in GP that can be used as mitigating controls when changing security is not an option. Workflow is a great example. An AP Clerk could be allowed to create vendors, but before the vendor is final, it needs to be approved by a supervisor using GP’s built-in workflow.
4. The first three will significantly improve security. They’ll take some time, but not a lot of additional money. The last step is looking across roles to see where multiple role assignments may have created new segregation of duties conflicts. This is really hard to do without a paid tool. [Fastpath’s Assure tool is the best option for complete segregation of duties management.](https://www.gofastpath.com/by-erp/microsoft-dynamics/dynamics-gp)

Links to all the posts in this series can be found at [https://dynamicaccounting.net/gp-controller-series-index/](/gp-controller-series-index/)