Business Central SOX compliance, configured and evidenced

What Business Central SOX compliance really covers

Auditors look at two layers. IT general controls cover who can get into the system and how changes reach production. They also cover how you manage operations such as backups and batch jobs. Application controls cover what the system forces inside a process. One example is that a purchase invoice above a limit cannot post without approval.

Software alone cannot make a company compliant, and no partner can promise an audit outcome. So what we do is map each control in your control matrix to a specific Business Central feature or step. Then we close the gaps. We also document the setup, so the control owner can explain it without us.

Business Central SOX compliance: access and duties

The classic finding is one person who can create a vendor, enter its invoice and pay it. We design permission sets by duty, assign them through security groups and test combinations for conflicts before go-live. Only a very small number of named administrators hold the SUPER permission set. They do not post transactions.

In turn, we keep access clean over time. We set up a regular access check. Each manager confirms their team's permissions. Joiner, mover and leaver changes follow a written request and approval. Business Central's effective permissions page shows why a user can or cannot do something.

Change log, field monitoring and approvals

Nobody can edit or delete posted entries in Business Central. Every ledger entry records the user and date. For master data and setup, we switch on the change log for sensitive tables. Examples are vendor bank accounts, posting groups and general ledger setup. So each change shows the old value, the new value and who made it.

Field monitoring adds an email alert when chosen high-risk fields change. Approval workflows put a second person in front of purchase documents and payment journals. They do the same for general journal batches and new vendors or customers. Allowed posting dates, set for the company and per user, stop entries landing in closed periods.

Controlling changes to the system itself

Auditors want to see that no change reaches production untested or unapproved. In Business Central, changes are extensions with version numbers. We keep their source in a repository and build them through a pipeline. Next, we test them in a sandbox. Then we install them in production, but only after the business owner approves in writing.

Microsoft's own updates follow a similar path on your side. We test each major release in a sandbox and keep the results. Then we schedule the production update in the admin center. The list of who may install extensions or alter environments is short and documented. It stays separate from the people who develop the changes.

Business Central SOX compliance evidence for auditors

When testing begins, auditors ask for populations and samples. They want all users with their permissions. Next come all changes to a table in a period. Last come all journal entries above a threshold with their approvers. We prepare saved views and reports that produce these lists on demand. So the system answers requests, instead of someone rebuilding lists by hand.

For Business Central online, Microsoft runs the data centers. It also publishes independent control reports for its cloud services on the Service Trust Portal. Your auditors can rely on those for the infrastructure layer. Your own part is the setup and steps described on this page.

Business Central SOX compliance questions

Is Business Central SOX compliant out of the box?

No ERP is. Compliance belongs to the company, not the software. Business Central has the features you need to build and prove controls. These include permissions, approvals, change logs and a posted ledger nobody can alter. Still, someone must set them up, use them and test them. A control only counts once a person owns it, runs it on time and keeps proof that it ran. So we help you name owners, write short steps and decide what proof to keep. That way your auditors see controls that work in daily use, not only on paper.

Does the change log slow the system down?

It can if switched on for everything. We limit it to setup and master data tables that matter for financial reporting. We avoid high-volume transaction tables. They already keep their own history through ledger entries. That keeps performance and storage under control.

Can Business Central detect segregation of duties conflicts automatically?

Not as a standard feature. We check permission sets against a conflict matrix. For this, we use exported permission data. For larger firms, AppSource solutions can watch for conflicts all the time. We recommend one only when the user count justifies it.

We are preparing to go public. When should this work start?

Early, well before the first period your auditors will test. Controls need to run for a while before anyone can rely on them. Redesigning permissions in a live system is slower than building them right at the start.

Do you work with our external auditors?

Yes. We join walkthroughs to explain how a control works. Also, we provide the listings they request. And we adjust the setup when they raise a finding. We do not perform the audit or give an opinion on your Business Central SOX compliance.

Related control and security pages

Business Central SOX compliance builds on features explained elsewhere on this site. These pages go into the audit trail, security design and permissions. They also cover the approval workflows that act as automated controls. For the product detail, see Microsoft Learn: auditing changes in Business Central.