[In this series, we’re looking at quick fixes to improve GP security. ]
The matching principle in accounting requires that a company record expenses in the period in which the related revenues are earned. That means posting transactions in the correct period. Both revenues and expenses can be manipulated by posting them in past or future periods and this results in incorrect financial statements.
Getting the dates right in Dynamics GP can be more challenging than it seems. (We looked at this in our Controller series.) But just as important is maintaining control of fiscal periods.
GP makes it easy to open and close fiscal periods for various modules. Dig deeper and you’ll see that GP actually provides fine grain control for opening and closing individual transaction types. That’s overkill for most organizations.
The key is that there should only be one or two individuals with rights to open and close periods and those users should not be allowed to create or change transactions. Otherwise, it’s just too easy to open a month and post backwards or open next year and push a transaction far into the future.
Fiscal Periods are managed via Administration>Setup>Company>Fiscal Periods. The window is Fiscal Periods Setup and by default its assigned to these roles:
- Accounts Payable Clerk
- Accounting Manager
- Power User
The default task is ADMIN_COMPANY_001*. I would strongly recommend removing this task from the Accounts Payable Clerk role right now. I’ll wait…
Realistically, the Fiscal Periods Setup window should be segregated into a role without transaction access. For example, a role that allows maintaining the chart of accounts and fiscal periods, but not transaction entry, starts to provide a level of effective segregation without imposing a significant burden.
Also, be careful with two other items: access to the Professional Services Tools library and the Allow Posting to History setting in General Ledger setup.
The Fiscal Period Modifier tool included with the Professional Services Tools Library can be used to reopen closed years. Imagine posting transactions 10 years back to hide inappropriate transactions.
Similarly, Allow Posting to History is a setting that allows posting directly to the last closed year if a fiscal period is open for that year. This is a great feature for closing the year while still being able to make final adjusting entries. It’s also dangerous once
Properly managing fiscal periods help keep closed years closed and current year transactions in the right periods.
You can find all of the fixes in this series at GP Easy Security Fixes.