Objective
Design a finance access model with clear separation of duties and usable day-to-day roles.
Case study 13
Portfolio knowledge project
Fusion Finance Security Roles Model
A practical role design for finance users — job roles, duty separation, period close privileges, and access review rhythm that supports control without blocking work.
Knowledge / portfolio case study only. Not employment history, not a named client engagement, and not a certification claim.
Context
Over-broad access creates audit risk; over-tight access creates workarounds.
Scope
Role catalog for AP/AR/GL/close, SoD checkpoints, access request path, and quarterly review. Not a full IAM implementation.
Approach
List personas → map duties → identify SoD conflicts → propose role bundles → define request/approval → test with sample users.
- 01Persona mapClerk, approver, accountant, closer.
- 02Duty analysisCreate, approve, post, close.
- 03SoD matrixConflicts and mitigations.
- 04Role bundlesUsable packaged access.
- 05Review rhythmQuarterly attestation.
01Persona map
02Duty analysis
03SoD matrix
04Role bundles
Fusion Finance Security Roles Model
Key design decisions
- Prefer fewer well-named roles
- Easier to govern.
- Break glass access is temporary
- Always expire.
- Close privileges are restricted
- Period status is sensitive.
Walkthrough
AP clerk posts invoice but cannot approve → approver cannot create supplier bank change → closer opens/closes periods → review access extract.
Controls
No combined create+approve for high-risk duties; privileged access time-bound; quarterly access attestation.
Oracle modules in focus
Security Console
GL
AP
AR
Deliverables
Persona-role matrix
SoD conflict list
access request form
UAT access scenarios.
Outcomes
Shows control-aware Fusion finance security thinking.