Your NetSuite works. Invoices go out, the books get closed, reports come out. And yet something is wrong: the close keeps taking longer, some reports are no longer reliable, scripts slow down screens, and nobody really knows who has access to what anymore.
This is the case for many NetSuite accounts after a few years of use. Each need was handled as it came, each contributor left their mark, and the account grew without a real overall view.
A NetSuite audit lets you take back control. At SuiteVise, we regularly audit NetSuite accounts, often before taking over a project, expanding to a new country or launching an optimization initiative. Here are the checkpoints we systematically review.
Why and when to audit NetSuite?
A NetSuite audit has three goals: secure (access, data, compliance), make reliable (figures, processes, reports) and optimize (performance, automation, costs).
Some moments are particularly well suited:
- After go-live, once the first months have passed, to fix what was done in a hurry.
- When teams work around the system with Excel, a sign that something isn’t working.
- Before a major change: a new subsidiary, a new country, a new module, a move to SuiteTax, a connection to AI tools.
- Before changing integrators or taking over a struggling project.
- Before a tax inspection or a financial audit, to check the FEC tax audit file and the audit trail.
- Before renewing your NetSuite contract, to align licenses and modules with actual use.
- Regularly, for example every year or every two years, like a vehicle inspection.
The checkpoints, area by area
1. Security, roles and access
- The number of administrators: it should be kept to the strict minimum. It is often the first finding of an audit.
- Roles and permissions: are roles designed by job, with minimum rights? Are custom roles documented?
- Segregation of duties: can the same person create a vendor, enter their bill and pay it?
- Inactive users: do former employees or contractors still have access?
- Authentication: is two-factor authentication in place for sensitive roles?
- Technical access: integration tokens, connected applications, AI connections. Who created them, and are they still in use?
2. General setup and licenses
- Enabled features: do they match actual use? Some enabled “just in case” make the system harder to use.
- Modules and licenses: modules paid for but not used, or users with the wrong licenses?
- Company structure: are subsidiaries, departments, classes and locations consistent and useful for reporting?
- General and accounting preferences: are they consistent with your processes?
3. Finance and accounting
- The chart of accounts: is it clear, free of duplicates, consistent with reporting and local standards?
- Accounting periods: are they closed and locked correctly? Are entries still being posted to old periods?
- The month-end close: how long does it take, and which tasks are still manual?
- Reconciliations: banks, customer and vendor accounts, suspense accounts, intercompany.
- Revenue recognition: are the rules compliant and applied without manual adjustments?
- The audit trail: journal entry numbering, traceability of changes.
4. Tax and localizations
- The tax engine: Legacy Tax or SuiteTax, with a setup consistent with your countries and tax cases.
- Installed localizations: are they up to date, properly installed and correctly configured?
- The FEC (in France): has it been generated and tested recently? Does the chart of accounts comply with the French chart of accounts (PCG)?
- VAT returns: are they produced from NetSuite, or reworked by hand?
- E-invoicing: is the connection to an approved platform in place and working properly?
5. Customizations
- The inventory of scripts and workflows: how many are active, what are they for, who wrote them?
- Unused customizations: fields, forms, records and scripts that are no longer used.
- Technical quality: old SuiteScript versions, scripts without error handling, undocumented code.
- Impact on performance: do some scripts slow down screens or processing?
- Forgotten standard features: do custom developments do what NetSuite can now do out of the box?
6. Integrations
- Mapping of flows: CRM, e-commerce, banks, payroll, billing tools, data warehouses.
- Robustness: are errors detected, reported and handled?
- Technologies used: old APIs or versions that are set to disappear?
- Technical accounts: are they dedicated, secured and limited to what is strictly necessary?
7. Data quality
- Duplicates: customers, vendors, items.
- Incomplete data: VAT numbers, SIREN company numbers, addresses, payment terms.
- Obsolete records: items, accounts or entities that should be made inactive.
- Consistency of master data between NetSuite and connected tools.
8. Reporting and management
- Reports and saved searches: how many exist, which are actually used, which are wrong?
- Dashboards: does each role have the indicators it needs?
- Reliance on Excel: what reworking is done outside NetSuite, and why?
9. Processes and adoption
- Key processes: order-to-cash, procure-to-pay, close. Do they follow the system, or work around it?
- User pain points: a workshop or a few interviews often reveal the real problems.
- Training: are newcomers trained, and is there up-to-date documentation?
10. Governance and change management
- The test environment: is there a sandbox, and is it used before every change?
- NetSuite’s twice-yearly releases: are they anticipated and tested?
- Documentation: are the setup and developments documented?
- The NetSuite owner: who manages the system internally and decides on change requests?
The summary checklist
| Area | Key checkpoint | Risk if neglected |
|---|---|---|
| Security | Number of administrators and inactive users | Uncontrolled access, fraud |
| Security | Segregation of duties | Undetected errors and fraud |
| Setup | Licenses and modules in use | Unnecessary costs |
| Finance | Closing and locking periods | Figures changed after the fact |
| Finance | Reconciliations | Unexplained differences |
| Tax | FEC tested, VAT produced from NetSuite | Tax reassessment, manual reworking |
| Tax | E-invoicing up and running | Regulatory non-compliance |
| Customizations | Inventory and usefulness of scripts | Slowness, costly maintenance |
| Integrations | Error detection and handling | Missing or duplicate data |
| Data | Duplicates and incomplete data | Rejected invoices, wrong reporting |
| Reporting | Reports used and reliable | Decisions based on wrong figures |
| Governance | Sandbox and testing before changes | Incidents in production |
How does a NetSuite audit run?
An effective audit combines analysis of the account with listening to users. Here is our approach.
- Scoping: audit objectives, scope, contacts, read-only access to the account.
- Technical analysis of the account: setup, roles, customizations, integrations, data.
- User interviews: finance, operations, sales, management. This is where workarounds and real pain points come to light.
- Analysis of key processes: from order to cash, from purchase to payment, and the close.
- Findings presentation: a clear report and a presentation to decision-makers.
The deliverables to expect from a good audit:
- Findings for each area, with concrete examples from your account.
- Prioritized risks: what is critical, important or simply desirable.
- A costed action plan, separating quick wins from longer-term work.
- Realistic recommendations that favor standard NetSuite features before any new development.
Depending on the size of the account, an audit generally takes from a few days to a few weeks.
Frequently asked questions
What is a NetSuite audit?
A complete analysis of a NetSuite account: security, setup, finance, tax, customizations, integrations, data and processes. It results in findings and a prioritized action plan.
How often should NetSuite be audited?
Ideally every one to two years, and always before a major change: a new country, a new module, a change of integrator or an AI project.
How long does a NetSuite audit take?
From a few days to a few weeks, depending on the size of the account, the number of subsidiaries and the volume of customizations.
Does an audit disrupt day-to-day business?
No. The analysis is done with read-only access to the account, and user interviews take only a few hours.
Can you audit your own NetSuite account?
Some points can be checked internally, such as inactive users or reports in use. An outside view, however, brings expertise in best practices and a fresh eye on habits that have become invisible.
In short: a health check for your ERP
A NetSuite account is constantly evolving: new needs, new users, new customizations, new obligations. Without regular checks, it builds up weaknesses: uncontrolled access, less reliable figures, slowness, unnecessary costs. An audit lets you take stock, fix the risks and get back a system that truly serves your teams.
Want to know where your NetSuite stands? SuiteVise offers a complete audit of your account: security, finance, tax, customizations, integrations and data, with a prioritized and costed action plan. Let’s take 30 minutes to talk it through.