Enabling the Three Lines of Defense in Dynamics 365 Finance & Operations - LINE3: Internal Audit Assurance

ENABLING THE THREE LINES OF DEFENSE IN DYNAMICS 365 FINANCE & OPERATIONS - LINE3: INTERNAL AUDIT ASSURANCE

CONTENT Introduction Line 3 Internal Audit in a D365FO-Centric Environment Independent Assurance Through System Evidence Reviewing Transaction and Ledger Integrity Validating Control Execution and Effectiveness Sampling and Testing High-Risk Transactions Auditing Configuration Changes and Access History Leveraging Reporting and Data Extraction Tools A Third Line Scenario: From Audit Request to Finding Conclusion

INTRODUCTION 

The Third Line of Defense within the Three Lines of Defense (3LoD) model is responsible for independent assurance. Unlike Line 1 (which executes controls) and Line 2 (which monitors and oversees), Line 3 evaluates whether the control framework is designed appropriately, operating effectively, and aligned with the organization’s compliance obligations.

In a Microsoft Dynamics 365 Finance & Operations (D365FO) environment, Line 3 does not create workflows, assign roles, or approve transactions. Instead, Internal Audit uses the system’s data, logs, and reports to test and verify that Lines 1 and 2 are performing their responsibilities and that risks are being managed within tolerance.

This article focuses on how internal audit teams can use D365FO’s capabilities—alongside standard audit methodologies—to perform independent reviews and produce evidence-based assurance for stakeholders such as the audit committee, regulators, and external auditors.

LINE 3 | INTERNAL AUDIT IN A D365FO-CENTRIC ENVIRONMENT

Internal Audit’s primary value lies in its objectivity. It operates separately from both operations and compliance functions, ensuring that its assessment is unbiased and evidence-driven. In D365FO, this objectivity is enhanced by the system’s ability to generate immutable records of transactions, changes, and approvals.

Typical responsibilities of Line 3 include:

• Assessing whether controls designed by Line 1 and monitored by Line 2 are functioning as intended
• Reviewing the completeness and accuracy of transaction data
• Identifying process gaps or control weaknesses not previously detected
• Recommending improvements to strengthen the overall control environment

INDEPENDENT ASSURANCE THROUGH SYSTEM EVIDENCE

1. Reviewing Transaction and Ledger Integrity

Internal auditors frequently begin by validating the accuracy and completeness of financial transactions. In D365FO, this involves:

• Using General ledger > Inquiries > Voucher transactions to trace transactions from source documents to ledger postings
• Verifying that subledger entries (e.g., Accounts Payable, Accounts Receivable, Fixed Assets) reconcile to the general ledger
• Checking for manual journal entries that bypass standard workflows

View of subledger journal of a purchase order invoice (Voucher transactions inquiry showing linkage between subledger and ledger entries)

2. Validating Control Execution and Effectiveness

Line 3 evaluates whether preventive and detective controls are consistently applied. This includes:

• Reviewing workflow history to ensure approvals occurred as designed
• Checking whether SoD violations identified by Line 2 were remediated or mitigated
• Confirming that exception handling processes were documented and followed

D365FO’s workflow history logs and exported SoD violation reports are primary data sources for these validations.

View of workflow history screen with an invoice approval chain

3. Sampling and Testing High-Risk Transactions

Internal Audit applies sampling methods (statistical or judgmental) to test transactions for compliance with policy. Examples include:

• Testing a sample of vendor changes to verify proper approval and supporting documentation
• Reviewing high-value payment transactions for dual authorization evidence
• Confirming that purchase orders over threshold values received required managerial approvals

Sampling can be done by exporting data from D365FO using Data Management > Export into Excel or Power BI for analysis.

4. Auditing Configuration Changes and Access History

Unauthorized or undocumented configuration changes can weaken controls. Internal Audit reviews:

• Database Log entries for high-risk tables (e.g., posting profiles, vendor bank accounts)
• Historical user role assignments to detect privilege escalation
• Removal of access for terminated employees

While D365FO’s native tools provide much of this data, external solutions like Fastpath or Guardian may enhance visibility, especially for historical access reporting.

View of database log entries showing a change to a vendor’s bank account.

5. Leveraging Reporting and Data Extraction Tools

To streamline evidence collection, Line 3 can leverage:

• Task Recorder to document test steps for re-performance by external auditors
• Data entities to pull standardized datasets for repeatable audits
• Power BI integration to visualize trends in control exceptions and workflow performance

By using system-generated evidence, Internal Audit reduces reliance on manual screenshots or user attestations, improving both efficiency and credibility.

A THIRD LINE SCENARIO: FROM AUDIT REQUEST TO FINDING

Imagine Internal Audit is performing a quarterly review of vendor master data changes:

1. Audit extracts vendor bank account changes from the Database Log for the last 90 days.

2. A sample is selected focusing on changes made outside normal business hours.

3. One entry shows a bank account change by a user whose role assignment was supposed to be temporary.

4. Further investigation reveals the role removal was delayed, allowing the user to make changes after their project ended.

5. Audit issues a finding recommending stricter monitoring of role deactivations and improved coordination between HR and IT.

This example illustrates how Line 3 moves beyond detection—providing recommendations that close process gaps and strengthen Lines 1 and 2.

CONCLUSION

The Third Line of Defense in D365FO is not about running the business or overseeing it—it’s about independent validation that both are working as intended. By leveraging D365FO’s inquiry screens, workflow histories, database logs, and data exports, Internal Audit can perform efficient, evidence-based reviews without disrupting daily operations.

When Lines 1 and 2 perform their roles effectively, Line 3’s job becomes one of confirmation and continuous improvement—ensuring that the organization’s control environment is not only compliant, but resilient.

This completes the three-part series on enabling the Three Lines of Defense in Dynamics 365 Finance & Operations. Together, these articles provide a blueprint for embedding operational control, compliance oversight, and independent assurance into your ERP system.

Enabling the Three Lines of Defense in Dynamics 365 Finance & Operations - LINE2: Risk and Compliance Oversight

ENABLING THE THREE LINES OF DEFENSE IN DYNAMICS 365 FINANCE & OPERATIONS - LINE2: RISK AND COMPLIANCE OVERSIGHT

CONTENT Introduction Line 2 Risk and Compliance Oversight in D365FO-Centric Organizations Governance Through Monitoring: A Functional View Oversight of Security Role Changes and Privilege Escalation Monitoring Segregation of Duties Violations and Exception Approvals Evaluating the Effectiveness of Workflow Controls Analyzing Field-Level Configuration Changes Performing Periodic Risk Reviews and Reporting A Second Line Scenario: From Oversight to Intervention Conclusion

INTRODUCTION 

The purpose of the Second Line of Defense within the Three Lines of Defense (3LoD) framework is not to execute business controls, but to ensure that those controls are functioning consistently, remain aligned with risk tolerance, and are subject to ongoing review. In Microsoft Dynamics 365 Finance & Operations (D365FO), Line 2 does not directly perform journal postings, approve transactions, or assign user roles—that’s the job of Line 1. Instead, Line 2 is accountable for designing policy frameworks, overseeing access governance, monitoring control adherence, and responding when execution deviates from expected behavior.

This article explains how D365FO supports Line 2 professionals—compliance officers, internal control owners, and risk managers—in supervising control environments without directly interfering with operational workflows. It is written for readers who already understand D365FO’s built-in features such as role-based access, segregation of duties (SoD), workflow approvals, and audit trails. Instead of re-explaining these tools, we focus on how Line 2 uses them for governance and monitoring purposes.

LINE 2 | RISK AND COMPLIANCE OVERSIGHT IN D365FO-CENTRIC ORGANIZATIONS

Line 2 functions as the system’s compliance backbone, tasked with embedding internal control principles into application governance. These responsibilities include:

• Establishing risk-aligned access policies
• Defining SoD rules and exception handling criteria
• Monitoring workflow effectiveness across departments
• Reviewing audit trails and configuration changes
• Providing structured guidance to Line 1 users
• Liaising with auditors and reporting on internal control health

In D365FO, these tasks can be performed using native capabilities—augmented where necessary by ISV tools like Fastpath, RSM Guardian, or custom Power BI dashboards. Line 2 does not need to rely on external documentation or manual audits. Instead, the ERP system itself becomes the control environment, enabling real-time oversight of daily operational activity.

GOVERNANCE THROUGH MONITORING: A FUNCTIONAL VIEW

While Line 1 users rely on D365FO to execute controls, Line 2 uses the same system to oversee them. Below, we explore how this oversight manifests in the application.

1. Oversight of Security Role Changes and Privilege Escalation

Access provisioning is handled by IT or business operations (Line 1), but Line 2’s responsibility is to monitor whether those assignments adhere to policy.

In practice, this involves:

• Reviewing changes in user role assignments on a regular cadence
• Identifying users who have gained elevated privileges outside of standard provisioning processes
• Investigating any deviation from the principle of least privilege

While D365FO does not natively provide historical change tracking for user-role assignments, organizations often implement supporting tools or audit reports to capture this activity. Alternatively, Database Log can be enabled to track changes in the underlying security tables.

2. Monitoring Segregation of Duties Violations and Exception Approvals

Line 2 does not create SoD rules—that’s a shared responsibility between compliance and system administrators. But Line 2 governs how these rules are enforced and how exceptions are handled.

Typical activities include:

• Reviewing SoD violation reports and understanding the business context behind them
• Approving or rejecting temporary access exceptions requested by Line 1 users
• Validating that approved exceptions have compensating controls in place (e.g., increased monitoring or dual approval)

The objective is not to prevent the business from operating efficiently, but to ensure that risk-acceptance decisions are conscious, documented, and periodically re-evaluated.

3. Evaluating the Effectiveness of Workflow Controls

While Line 1 users initiate and participate in workflows (e.g., invoice approvals, vendor edits), Line 2 has a supervisory role to play: Are those workflows functioning as intended?

Key evaluation points include:

• Are workflows consistently routing to the correct approvers?
• Are approvals happening within expected timeframes?
• Are any steps being auto-approved due to escalation thresholds?
• Is there evidence of override behavior (e.g., approval by system administrators)?

These checks are often performed using the Workflow history log in D365FO or through exported workflow datasets analyzed in Power BI.

4. Analyzing Field-Level Configuration Changes

Control failures are not always transactional—they often begin in setup and master data. A well-designed workflow or SoD policy can be rendered ineffective if a key configuration setting is changed.

Line 2’s responsibility is to track changes to sensitive fields and ensure that:

• Only authorized users are making changes to configuration records (e.g., vendor bank account, posting profiles)
• All changes are traceable and explainable
• Recurring or off-hours changes are flagged for further review

D365FO’s Database Log feature supports this type of oversight. When enabled for the appropriate tables, it records the user ID, timestamp, and before/after values for each change.

5. Performing Periodic Risk Reviews and Reporting

Line 2 is accountable for translating system data into actionable risk insight. This typically includes:

• Monthly or quarterly reports on SoD exceptions, workflow behavior, and sensitive field changes
• User access reviews for high-risk roles (e.g., system administrators, finance approvers)
• Assessment of policy violations and recurring control issues
• Recommendations to IT or Line 1 leaders for control remediation or enhancement

Tools like RSM Guardian or Fastpath streamline this process by aggregating control data into prebuilt dashboards. However, even without ISVs, D365FO’s native data entities, export functions, and logging capabilities enable meaningful review cycles—if structured properly.

SAMPLE SCENARIO: FROM OVERSIGHT TO INTERVENTION

Consider this common use case:

A temporary SoD exception was approved last month, allowing a user to both create and approve vendors.

During a monthly review, Line 2 notices that this exception is still active—even though the stated expiration date has passed.

Further investigation reveals the same user submitted and approved three vendors, one of which was used in a high-value payment.

Line 2 flags the issue, revokes the role combination, and recommends a retrospective review of the payment by Internal Audit.

This type of oversight intervention highlights the true value of Line 2 in D365FO—not just spotting violations, but ensuring controls remain active, relevant, and risk-aligned.

CONCLUSION

The Second Line of Defense brings structure, oversight, and assurance to the control environment. In Dynamics 365 Finance & Operations, Line 2 professionals are not responsible for day-to-day transactions—but they are accountable for ensuring that the system itself enforces compliance principles.

By continuously monitoring role changes, SoD conflicts, workflow behavior, and audit logs, Line 2 can enforce risk policies without disrupting operations. The end result is a governance model where compliance is embedded within the ERP—not layered on top of it.

The final article in this series will focus on Line 3: Internal Audit, where we examine how independent assurance can be delivered using D365FO’s data and reporting capabilities.

Enabling the Three Lines of Defense in Dynamics 365 Finance & Operations - LINE1: Operational Management

ENABLING THE THREE LINES OF DEFENSE IN DYNAMICS 365 FINANCE & OPERATIONS - LINE1: OPERATIONAL MANAGEMENT

CONTENT Introduction Why the Three Lines of Defense Matters in D365FO LINE 1 Operational Management in D365FO Role-Based Access Control Segregation of Duties (SoD) Enforcement Workflow Approvals in Core Processes Field-Level Audit and Setup Change Monitoring Sample Scenario Conclusion

INTRODUCTION 

As regulatory expectations increase and ERP systems take a central role in financial reporting, organizations are under pressure to demonstrate effective governance within their core business applications. In the context of Microsoft Dynamics 365 Finance and Operations (D365FO), aligning system capabilities with the Three Lines of Defense (3LoD) framework has become a practical way to structure risk and control activities.

The Three Lines of Defense model is a well-established framework used to separate responsibilities for risk ownership, compliance oversight, and independent assurance:

• First Line: Business operations responsible for executing controls
• Second Line: Risk and compliance functions that guide and monitor control performance
• Third Line: Internal audit functions that provide independent assurance

This article explains how D365FO can support all three lines of defense by leveraging built-in features such as workflow approvals, segregation of duties (SoD), security role configuration, audit trails, and external monitoring tools. It is written for consultants, compliance professionals, and ERP stakeholders who are responsible for strengthening internal controls, especially in regulated environments (e.g., SOX-compliant organizations).

By the end of this article, you will understand how to map D365FO features to each line of defense, what implementation activities to prioritize, and how to structure your environment to meet both compliance and operational needs. Screenshot indicators are included throughout the article to help you illustrate the guidance using your own sandbox data.

WHY THE THREE LINES OF DEFENSE MATTERS IN D365FO

Modern regulators and auditors expect ERP environments to reflect the Three Lines of Defense (3LoD) model:

• LINE 1: Operational Management owns risk and executes controls.
• LINE 2: Risk & Compliance oversees, advises, and monitors.
• LINE 3: Internal Audit provides independent assurance.

Dynamics 365 Finance & Operations (D365FO) offers native functionality—augmented by common ISV tools such as Fastpath or RSM Guardian—to embed each line directly in the application. Implementing these capabilities up-front reduces external audit findings, accelerates SOX readiness, and lowers the cost of ongoing compliance.

LINE 1 | OPERATIONAL MANAGEMENT IN D365FO

The First Line of Defense is composed of operational users—those in finance, procurement, inventory, or accounts payable—who are responsible for executing daily business processes and applying system controls as part of their regular duties. These are the people who create journals, submit purchase orders, manage vendors, and approve transactions.

In Dynamics 365 Finance and Operations, these users can directly perform their responsibilities in a way that enforces preventive and detective controls, ensuring they own the associated risks while remaining compliant with internal policies and external regulations.

Let’s explore how this works in practice.

Role-Based Access Control: D365FO uses a security model based on the roles, duties, privileges, which allows you to strictly limit user access to only those tasks they are responsible for. This means each user can be aligned with the specific business function they perform—such as AP clerk, GL accountant, or procurement manager—without having unnecessary access to sensitive or conflicting tasks.

For example, an accounts payable clerk can be granted access to create and edit invoices, but not post journals or create vendors.

By enforcing least privilege access, this model helps organizations meet the core requirement of Line 1: enabling business users to operate efficiently while containing access risk. 

System administration > Security > Assign users to roles

Segregation of Duties (SoD) Enforcement: While access control is about what a user can do, SoD is about what combinations of access should not exist. D365FO provides built-in SoD rules and conflict-checking tools that help prevent users from having access to incompatible duties—such as being able to both create a vendor and approve a payment.

The system allows you to:

• Define SoD rules between duties (e.g., "Vendor master maintenance" and "Vendor payment approval")
• Check for violations when assigning roles
• Enforce review and approval workflows for exceptions

SoD enforcement supports Line 1 by preventing control failures at the point of access assignment and ensuring business users are only responsible for the right set of tasks.

System administration > Security > Segregation of duties > Segregation of duties rules

Workflow Approvals in Core Processes: To ensure operational users follow proper approval paths before high-risk actions are taken, D365FO includes a Workflow engine for many key transaction types, such as:

• Vendor edits
• Purchase requisitions and purchase orders
• General ledger journal entries
• Expense reports
• Vendor invoice journals
• Vendor payment journals

Workflow ensures that a second individual reviews and approves key actions before the transaction is posted or finalized—enabling proper oversight without relying on manual follow-up. This is a critical component of Line 1, as it ensures controls are built into business processes, not applied reactively.

For example, a workflow can require that any purchase order over $25,000 must be approved by a finance manager, even if submitted by an authorized clerk. You can find this end-to-end scenario here.

Accounts payable > Setup > Accounts payable workflows

Field-Level Audit and Setup Change Monitoring: In many control environments, configuration data is just as sensitive as transactional data. The Database Log in D365FO allows you to track changes to high-risk fields—for example, when someone changes a vendor's bank account number or modifies the posting profile for a journal.

This capability supports Line 1 by creating transparency and accountability for operational teams responsible for configuration or master data. Once enabled, the database log tracks:

• Who changed the field
• When it was changed
• What the old and new values were

Although this feature is often reviewed by the second or third line, its purpose is to empower operational users to self-monitor and prevent unintentional misconfigurations.

Enable database logging for a critical table such as VendBankAccount and show the change log after a test update.

System administration > Setup > Database log > Database log setup

Sample Scenario: Let’s walk through an end-to-end example that shows how Line 1 is supported in a real-life AP process:

1. Vendor clerk initiates a vendor change request via the Vendor changes workflow.

2. Workflow routes the request to an AP supervisor for approval.

3. The clerk creates a vendor invoice journal and submits it into Journal approval workflow.

4. The invoice is posted only after a second-level approver signs off.

5. Security roles and SoD rules ensure the same user cannot both create a vendor and approve their invoices.

6. Any change made to vendor bank info is recorded in the Database Log.

Each of these activities is completed by a business user—not the compliance or IT team—meaning risk is being managed where it originates: within business operations.

CONCLUSION

Operational users are the first line of defense in managing risk within Dynamics 365 Finance and Operations. As shown in this article, D365FO provides native capabilities—such as role-based security, segregation of duties enforcement, workflow approvals, and field-level logging—that enable these users to execute controls effectively as part of their daily responsibilities. Embedding such functionality directly into core processes ensures that risks are addressed where they originate: within business operations.

This article is the first in a three-part series on enabling the Three Lines of Defense in D365FO. The next installment will focus on Line 2: Risk and Compliance, and how system capabilities can support oversight, guidance, and control monitoring activities.