Who may change stock records: access rights for the storeroom

When a stock record is wrong, the first question is who touched it. In many storerooms the honest answer is: anybody. There is one shared login, a spreadsheet open to everyone and a key hanging on a nail. No bad intention is needed for trouble to start. The storekeeper changes a quantity to make life easier, the buyer edits a code, the accountant cancels a document, and a month later nobody can explain a difference. Access rights are not a sign of distrust. They are a way of making things explainable.

Start with three questions

1. Who can change a stock record in 1C, ERP or a spreadsheet? Write down names, not job titles.
2. Can you tell who changed this record? Does the system keep the user, the date and the change?
3. Who approved it?

If any answer is "we don't know", that is your first finding. The first two questions can be answered by one person opening the system's change log, and half an hour is often enough. It also shows quickly whether logging is switched off, or that a plain spreadsheet keeps no history at all.

Separate receiving, issuing and adjusting

Build the permission table with activities in the rows: receiving, issuing, stock adjustment, count entry, editing item master data (code, unit, name), cancelling or backdating documents, view only and account administration. The principles are these.

• The person who receives goods does not adjust stock.
• The person who entered the count does not process the resulting adjustment.
• Editing item master data is a separate permission held by few people.
• Cancelling or backdating a document needs a second approver, and closed periods are locked.
• Account administration sits outside the storeroom.

For illustration, assume a team of six. Storekeepers A and B, working different shifts, receive and issue. The warehouse supervisor approves adjustments but does not enter them. An accountant processes approved adjustments. The buyer has view access only, one named person edits item master data and the IT officer administers the accounts.

Shared logins and leavers

• One account per person. A shared login makes the log meaningless.
• When someone leaves or changes job, disable the account the same day. Check accounts that have not been used for a long time as well.
• Use administrator accounts only for administration, not for daily work, and do not leave passwords on sticky notes.
• Physical access follows the same principle. Record in a key register who holds the storeroom keys, and log visitors and contractors. However strict the system permissions are, goods can still leave through the door.

Small teams: compensating checks

If two storekeepers must do everything, compensate with checks. A supervisor or manager who does not enter transactions reviews the daily list of changes and adjustments, counts ten items of their own choosing by surprise each week, and inspects cancelled documents each month.

A quarterly review in five steps

1. Export the list of users and their permissions from the system.
2. Compare it with HR's list of current employees.
3. For each user, ask the line manager whether the permission is still needed.
4. Remove unneeded accounts and permissions, and record the date and who confirmed.
5. In the log for the last quarter, look at who made adjustments, the large ones, cancelled documents and changes made outside working hours.

For illustration, suppose a review of 25 accounts finds 4 leavers' accounts still active, 3 accounts with the right to adjust that do not need it, and 7 changes made after 8 pm. Start by looking at those 7.

Summary

The purpose of dividing permissions is not suspicion, but being able to say who did what when a difference appears. One person should not both receive and adjust, every account should carry a name, and the list should be reviewed every quarter. Smart Inventory's warehouse audit examines receiving and issuing records, location control, document flow and access rights to find why differences arise, and proposes improvements.