Assurance Platform

Controls Library

ITGC and application controls mapped to NetSuite mechanisms — every entry flagged by source authority. This is control coverage, not a SOX attestation.

NetSuite release change control (PG-8)

NetSuite ships two mandatory releases per year (Release 1 / Release 2). Each is tested in the Release Preview account against documented test plans before the production upgrade; weak release change management leaves residual IT SoD risk that must be monitored via audit-trail reports.

Oracle-primary and auditor-authoritative entries are verified against primary sources; synthesized entries are defaults to source/validate before relying on them (PRD_AUDIT §13.8.4).