Best Practices for user permissions within an organization.

SUGGESTED

Working with a medium sized business, approximately 50 employees. 5-6 employees who work in various accounting modules. I am the IT director for this company and the question has come up for who should have full administrative rights within Sage. Currently that is only myself and the owner. I am reluctant to offer that to anyone within the accounting department, including the CFO, as it seems that you leave yourself open to potential problems caused by anyone in the department who may become disgruntled or the potential for fraud. They are the only ones that would know how to get away with anything unscrupulous within the program. Any thoughts on recommended practice or resources would be appreciated.

Parents
  • 0
    SUGGESTED

    Hi kdahlke,

    This may depend on your division of labor and how you want to balance securing the database with users being able to perform tasks that only Administrators can perform.

    One thing I can say from a support perspective is that there are times when it is very handy to have more than one or two administrators, unless you can be diligent with ensuring that one of your two admins is available when needed. We get calls in Support where an administrator level is required to perform a task or make a correction, and that is holding up a billing, a check, or an audit process. If neither admin is available, the only recourse is a time-consuming password reset process that requires an owner signature.

    You may want to also reach out to your Sage Consultant to review your workflow, responsibilities and set to see what would be the best balance for you.

  • 0 in reply to Jesse Gordon

    Thanks for your thoughts Jesse, The only real question in my mind is whether one should ever give an employee within the accounting department administrative rights to grant or remove user privileges for other users within security administration. Seems to me that accounting personnel are the only ones that could ever really abuse privileges within Sage and hide what they did. I certainly couldn't. Thus the check & balance idea of having two people out of the department add or remove those privileges as in the IT staff or owner.

  • 0 in reply to kdahlke
    SUGGESTED

    I will chime in here in that we have a similar setup as you except we bounce between 60 and 80 users so slightly larger.  We consider ourselves a small company though!  In our environment there are two people with Admin access to Sage.  Myself as the IT Director and the CFO.  We find it works pretty well as one of us is usually available and although there are other responsible people in the company we feel that no one else has a birds eye view from the top as to how changes can effect other areas of the program so we keep it just the two of us.

  • 0 in reply to Jeff Rudacille

    Thanks to all for your thoughts. Just wanted to make sure I was thinking through the ramifications of our security decisions.

Reply Children
No Data