NetSuite SOX Compliance Guide: Controls and Audit Trails

By Louis Balla, Chief Revenue Officer, Nuage. Updated October 2026.

NetSuite SOX compliance means setting up and running NetSuite so the financial controls your auditors test actually hold. Oracle covers the platform’s own controls with independently audited SOC 1 Type 2 and SOC 2 Type 2 reports. Your company owns the controls inside your account, including user roles, approvals, period locks and the evidence you keep for auditors.

This guide explains which NetSuite controls auditors test and what our team finds when it assesses them in client accounts. It ends with how to have audit evidence ready before fieldwork starts.

What is NetSuite SOX compliance?

The Sarbanes-Oxley Act of 2002 sets financial reporting rules for U.S. public companies. Two sections drive most of the work in an ERP:

• Section 302: the CEO and CFO certify each periodic report and the disclosure controls behind it.
• Section 404: management assesses internal control over financial reporting every year, and for many public companies the outside auditor also reports on those controls.

Companies preparing to go public work toward the same controls. These are the terms you will hear from auditors:

• Internal control over financial reporting (ICFR): the processes that give reasonable assurance your financial statements are reliable.
• IT general controls (ITGCs): controls over the systems that hold financial data, mainly user access and change management. In NetSuite, that covers who holds which role and how customizations and settings get changed.
• Segregation of duties (SoD): no single person controls a financial transaction from start to finish. A user who creates vendors should not also approve payments to them.
• System notes: NetSuite’s record of who changed a field on a record and when, with the old and new values (Oracle’s System Notes Overview).
• Shared responsibility: Oracle’s audited reports cover the platform. Your auditors test the controls you configure in your own account.

How does NetSuite support SOX compliance?

NetSuite includes the native features most SOX controls are built on. Oracle states that NetSuite is externally audited to SOC 1 Type 2 and SOC 2 Type 2 standards and maintains ISO 27001 certification. Your auditors will typically request Oracle’s SOC 1 report for the platform layer and then test your configuration themselves.

The features your controls rest on:

• Roles and permissions: each user gets a role that grants the permissions their job needs. NetSuite’s standard roles are a starting point, and custom roles narrow them further.
• Two-factor authentication (2FA): NetSuite requires 2FA for Administrator and other highly privileged roles, and an account can turn on a feature that requires 2FA for all employee roles.
• Approval workflows: journal entries, vendor bills and purchase orders can route through approval steps, and the record keeps a workflow history of the states it passed through.
• System notes and the Login Audit Trail: system notes record changes to records. The Login Audit Trail tracks user logins and the tokens used for token-based authentication.
• Period close locks: the Period Close Checklist locks payables, receivables and payroll (if you use it) before a period closes, and system notes record changes to close tasks.
• Sandbox accounts: where your account includes a sandbox, changes can be tested there before they reach production.

Auditors test whether these features are turned on and how they are configured in your account. Ask your NetSuite account team which of them, such as sandbox accounts, your subscription includes.

How do audit trails work for payments and other transactions in NetSuite?

An auditor testing payments traces each one back to an approved vendor bill and checks who was allowed to release it. They also check whether anyone changed the vendor’s bank details along the way. In NetSuite, that trail comes from four places:

• The bill’s approval history, from an approval workflow. Our guide to NetSuite approval workflows covers how to set them up.
• System notes on the vendor record, which show who changed payment details and when.
• The role of the user who created the payment, which shows whether that person was supposed to be able to release it.
• Period locks, which restrict posting into a period that has already been reported.

A saved search over vendor record changes, reviewed each month, turns those system notes into a control someone performs and signs off.

Period locks protect a period only once someone runs them. An account assessment at an engineering services firm found that no accounting period had been fully locked across receivables, payables and payroll since August 2023, about 36 months. Our recommendation was to reinstate a monthly lock of all three sub-ledgers and lock the historical periods. Our NetSuite month-end close guide covers where the locks fit in the close.

How to set up segregation of duties in NetSuite

1. Map duties to roles. List the tasks in each financial process and give each role only the permissions those tasks need. Extra access granted “just in case” is a common source of SoD conflicts.
2. Start from standard roles. Customize only where a job needs it, so there are fewer roles to review.
3. Find the conflicting combinations. Common pairs are creating vendors and approving payments to them, entering journal entries and approving them, and administering roles while also posting transactions.
4. Add compensating controls where a small team can’t split duties. A manager’s monthly review of that user’s transactions, or a second approver, gives auditors a control to test.
5. Give integrations their own credentials. Run each integration under a dedicated service account with only the permissions it needs, so access does not depend on an employee who might leave.
6. Review access on the cadence your auditors expect. Keep the access report and the reviewer’s sign-off as evidence.

How should you run user access reviews for SOX in NetSuite?

An access review shows an auditor that someone looked at who holds which role and signed off on it. There are two common designs, and either can satisfy auditors when each review is dated and someone independent can check it.

• Exported report and spreadsheet review. Export users and roles on a set cadence, such as quarterly, compare them with your conflict list and circulate the file for sign-off. It is simple to start. It reflects the account only on the day of the export, so a role granted between reviews goes unseen until the next one. Keep one signed version of the file, with the reviewer’s name and the date, as the record.
• Request and approval before each role change. Route every access request through a documented approval before the administrator changes a role, and keep the approval with the change. Quarterly certification then confirms that the approvals match the roles users hold. This design takes more setup and leaves less to find at review time.

Team size and how often roles change should decide between them. A team with a few finance users and stable roles can run the exported report well. As users, custom roles and subsidiaries grow, the exported report takes longer each cycle and the request-and-approval design starts to pay off.

Keep the conflict list and exceptions documented

Start the conflict list with the high-risk pairs described earlier, such as creating vendors alongside approving payments to them. Give it an owner and review it whenever roles, subsidiaries or processes change, and log each change to the list so auditors can see when and why it changed. Where a small team cannot separate duties, record the exception with its reason, a time limit and the compensating review, and have someone outside the transaction flow sign it.

What NetSuite compliance issues come up in assessments?

In 2026 account assessments, our team found integration credentials tied to personal user accounts, some belonging to people who had already left, at no fewer than eight client accounts. At one client, 59% of users who could log in held the Administrator role. The fix we recommend is the same each time: move integrations to dedicated service accounts and cut roles back to what each job needs.

Each finding weakens a control auditors test. When an integration runs on a former employee’s credentials, its activity is attributed to someone who no longer works there. When most users hold the Administrator role, many people can change roles and settings that should sit with a few administrators.

The same assessments turn up segregation-of-duties conflicts. At a materials company, our assessment found one user holding a purchasing role alongside an accounting role on a live bank-payment workflow, and we recommended removing the purchasing role to restore segregation of duties. At an aerospace company, the same review flagged two users with conflicting roles and folded the fix into a consolidated roles and permissions review.

Who owns SOX controls in NetSuite?

• Controller or CFO: owns the financial controls and signs off each access review.
• NetSuite administrator: maintains roles and moves changes from sandbox to production under the change process.
• IT or security lead: owns the login policy, including 2FA, and the service accounts integrations run under.
• Process owners, such as the AP manager: perform the approvals and monthly reviews the controls depend on.
• External auditors: test whether each control was designed well and operated through the year.

On a small finance team one person may fill two of these seats. Write down who owns each control so the compensating review has a name on it.

How to prepare for a SOX audit in NetSuite

Auditors look for evidence that controls were designed well and operated consistently through the year. From a NetSuite account, they usually ask for:

• Documented policies for access, financial processes and change management.
• Evidence that controls operated, such as completed approvals and reconciliations.
• System notes and login history for the period under audit.
• User access reports showing who held which role, with proof that someone reviewed them.
• Review and approval evidence for each manual journal entry.

For a life sciences company with a quarterly audit cycle, our team pulls the user access and role-change reports each quarter, adds the report-parameter screenshots the auditors ask for, and reworks the report when the controller’s review turns up a role that needs explaining. We have run that cycle at least five times since July 2025, alongside a journal entry approval workflow and a saved search that tracks changes to vendor records.

Scheduled saved searches make this repeatable. One can list transactions approved by the same person who entered them, and another can list role changes since the last review, so issues surface before auditors arrive.

Auditors also test how changes reach production, because customizations such as SuiteScripts and custom fields can change how NetSuite records financial data. Record each change with its business reason and approver, and keep the sandbox test results. Companies with heavy customization sometimes add third-party tools for change tracking and SoD analysis. Ask your auditors what evidence they expect before you buy one. If scripts or AI agents post transactions in your account, our guide to keeping an audit trail when AI is doing the work in NetSuite covers the added controls.

How Nuage approaches NetSuite SOX controls

In recent account assessments and audit support projects, our team has worked through these steps. The order changes with each account.

1. Check who holds the Administrator role and who owns each integration credential. We recommend moving integrations to dedicated service accounts and cutting roles back to what each job needs.
2. Check when each sub-ledger was last locked. Where locks have lapsed, we recommend a monthly lock of receivables, payables and payroll, and locking the historical periods.
3. Check for users who hold conflicting roles. Where one user holds a purchasing role alongside an accounting role on a payment workflow, we recommend removing the purchasing role to restore segregation of duties.
4. Set up the recurring audit evidence. For a client with a quarterly audit cycle, we pull user access and role-change reports each quarter with the screenshots the auditors ask for, alongside a journal approval workflow and change tracking on vendor records.

Nuage’s NetSuite experts do this work as part of ongoing NetSuite optimization and managed services.

NetSuite SOX compliance FAQ

Is NetSuite SOX compliant?

SOX requirements apply to your company and the controls you run in NetSuite. Oracle states that NetSuite is externally audited to SOC 1 Type 2 and SOC 2 Type 2 standards, and your auditors can use the SOC 1 report for the platform layer. They still test the controls you configure, including roles, approvals, period locks and change management. Ask your NetSuite account team for the current reports.

Can you achieve SOX compliance in NetSuite without third-party tools?

Yes, for many companies. Native roles, approval workflows, system notes and period locks can support the controls SOX requires, especially in an account with few customizations. As customizations and users grow, manual SoD analysis and change tracking take more time each quarter, and some companies add tools to automate that work. Ask your auditors what evidence they expect before deciding.

What is the first step for SOX compliance in a new NetSuite account?

Get roles and segregation of duties right before go-live. Map the minimum permissions each job needs and check for conflicts, such as one user who can create vendors and approve payments to them. Route vendor bills and journal entries through approval workflows from the first day. Roles are much harder to untangle once users and integrations depend on them.

How do you investigate a change in NetSuite?

Start with system notes on the affected record, which show who changed each field and when, with the old and new values. For logins and token use, check the Login Audit Trail. A saved search over system notes can widen the review to every record one user changed in a date range. Keep the search and its results with the audit file so the review can be repeated.

Does SOX apply to mid-market private companies?

Sections 302 and 404 apply to U.S. public companies. A private company may still adopt the same controls when a lender, investor, acquirer or IPO plan asks for them, and the NetSuite setup is the same: roles, approvals, period locks and retained evidence. If an audit request or a deal timeline is driving the work, ask the requesting party which controls and evidence they expect.

About the author

Louis Balla is Chief Revenue Officer at Nuage, a NetSuite optimization partner that has served 250+ clients since 2011 and holds a 4.9 out of 5 rating on Clutch. The client assessments and audit support in this article are our team’s work.