Key Users

The Key Users analytic test is designed to scan one or more fields for specific usernames. You can manually enter usernames to filter journal entries entered or approved by specific users and refine results using exact or partial matching and case-sensitivity controls.

This analytic test can be used to identify:

Specific user audit trails.
Journal entries posted by terminated or former employees.
Entries entered or approved by senior users outside normal workflows.
Entries entered or approved by users with unexpected or unauthorized access.
Entries approved by users without the appropriate authorization level.
Entries posted by users who do not typically create journal entries, such as IT administrators.
Transactions associated with specific users during an investigation period.

Fields used for analysis

The following fields are required for this analysis:

Reference field(s) – Unique field(s) that are used to create a unique transaction ID such as the Entry ID field for the general ledger dataset. These columns are not part of the result but are used to identify the transactions that are part of the result. This field is already defined in the test and cannot be modified.
Username fields(s) – The character fields searched for the specified username. At least one of the following fields must be selected: Entered By or Entry Approved By.

Parameters

The following parameters must be set to run this test:

Enter user name – Enter the username you want to search for. You can search for an exact match or partial match based on the match type you selected.
Select Match Type – Select whether the values have to match exactly. If you do not select to identify only exact matches, partial matches are also identified.
Case-sensitive matching – Select whether matching is case sensitive.
Create column for matched user – Create an additional column that will list the usernames for which matches were found for this configuration.
Select Field(s) – Select one or both user fields to scan: Entered By, Entry Approved By.

Test configurations

The only configuration available for this test is Key Users. You can duplicate this configuration and modify the description, labels and purpose fields to create custom configurations.

Technical specifications

When you run the Key Users analytic test, the following occurs:

The test scans the selected user fields for the specified usernames.
Matches are identified based on the configured match type (exact or partial) and case sensitivity setting.
Journal entries where a match is found are flagged and displayed in the results.
If Create column for matched user is set to Yes, an additional column is added to the results listing the matched username for each flagged entry.