DESIGNING APPROVAL WORKFLOWS IN DYNAMICS 365 FINANCE WITH A SOX-COMPLIANCE LENS
CONTENT Introduction Why Every SOX Control Framework Must Include Robust Approval Workflows How D365FO Workflow Maps to SOX Control Objectives Control Design Choices That Auditors Will Question Test of Design (TOD) - Configuring a SOX-ready Purchase Order Approval Test of Effectiveness (TOE) - Executing a Sample Purchase Order Workflow Extra: Workflow Escalation: Ensuring Control Continuity Conclusion |
INTRODUCTION
In today’s regulatory landscape, internal controls are no longer optional—they are an operational necessity. For organizations subject to the Sarbanes-Oxley Act (SOX), especially Section 404, demonstrating that transactions are properly authorized, reviewed, and traceable is critical to passing an external audit. Dynamics 365 Finance and Operations (D365FO) offers built-in workflow capabilities that, when thoughtfully configured, can enforce these control requirements directly within the system. This article explores how to design and implement approval workflows in D365FO that satisfy SOX compliance expectations, with a focus on practical configuration guidance, control alignment, and audit-readiness.
WHY EVERY SOX CONTROL FRAMEWORK MUST INCLUDE ROBUST APPROVAL WORKFLOWS
Section 404 of the Sarbanes-Oxley Act (SOX) requires management to assert—and external auditors to attest—that the company maintains effective internal control over financial reporting. In practice that means every financially significant transaction must be:
1. Authorized by the right people,
2. Executed in line with documented policies, and
3. Evidenced so that an auditor can reconstruct who approved what, when, and why.
Dynamics 365 Finance & Operations (D365FO) contains a flexible workflow engine that can satisfy all three conditions—if you design it properly. Approvals, when combined with Segregation of Duties (SoD) rules, prevent the classic “create and approve my own transaction” scenario that violates SOX assertions.
HOW D365FO WORKFLOW MAPS TO SOX CONTROL OBJECTIVES
To effectively support SOX compliance, organizations must align system capabilities with specific control objectives—and Dynamics 365 Finance offers the features needed to do just that.
CONTROL DESIGN CHOICES THAT AUDITORS WILL QUESTION
Even with strong workflow tools, poorly structured configurations can raise red flags during audits; understanding what auditors scrutinize helps avoid preventable issues.
CONFIGURING A SOX-READY PURCHASE ORDER APPROVAL (TEST OF DESIGN - the parts auditors ask for)
The steps below follow a purchase order (PO) scenario because POs hit multiple SOX-sensitive accounts—Commitments, Accruals, and ultimately COGS. Replicate the same pattern for vendor invoices, journal vouchers, or project change orders.
Scenario
- Every PO must be approved by a Procurement Manager who is not the originator.
- POs ≥ USD 25 000 receive a second approval from Finance.
Step 1 Enable change management for POs
1.Navigate to Procurement and sourcing > Setup > Procurement and sourcing parameters.
2.On the General tab, activate Enable change management.
3.Set Allow override of settings per vendor to No to prevent policy bypass.
Step 2 Create a new workflow
1.Navigate to Procurement and sourcing > Setup > Procurement and sourcing workflows.
2.Click New > Select Purchase order workflow.
3.Click Run.
4.Workflow editor is loaded.
5.Workflow editor pops-up.
Step 3 Add approval elements
1.In the graphical editor, drag Approve purchase order onto the canvas.
2.Double click on the approval element.
3.Select the sub-approval step and go to step properties.
Step 4 Approval step configuration
Basic settings: Directives for the approver.
Assignment: Approver assignment.
Select participant.
Switch to Role based tab.
Select User group participants in the type of participant.
Select Purchase order approvals in the participant field.
Let's add another approval step ford the Director review & approval.
Basic settings: Directives for the approver director.
Assignment: Approver assignment. Select the director's name here.
Condition: Indicate if this step will be executed under a certain condition.
According to our scenario, order needs to be approved by the director if purchase order's total amount is equal or greater than $25K.
Save and activate the workflow.
New workflow is ready.
Note that first level approval will be sent to "Purchase order approval" user group. Let's make sure that the user group has the correct users.
Navigate to System administration > Users > User groups
Make sure that approvers are in the correct users.
Navigate to System administration > Workflow > Workflow parameters.
Note: I will not activate this parameter for the demo purpose.
EXECUTING A SAMPLE PO APPROVAL TO DEMONSTRATE EVIDENCE (TEST OF EFFECTIVENESS - the parts auditors ask for)
Go to Procurement and sourcing > Purchase orders > All purchase orders and create a new PO.
I've created a purchase order and submitted it to workflow approval.
Click Workflow > Submit
Enter a justification comment.
Log in as Approver user. In the work items assigned to me section, open the record.
Let's approve the order, again.
AUDIT NOTE: Retrieving evidence is the most important point here. Take necessary screenshots of workflow history that shows approver user IDs, timestamps, comments and system/workflow version - exportable to excel for auditors.
Note that order status is now Complete.
NOTE: Demonstrate at least two additional edge cases
- Requester tries to approve own PO—system throws an error and says submitter cannot be approver;
- Approver misses 1-day SLA—workflow escalates automatically. Details have been explained below.
EXTRA: Workflow Escalation: Ensuring Control Continuity
In a SOX-compliant environment, timeliness of approvals is just as critical as the approval itself. Workflow escalation ensures that if an approver does not take action within a defined time frame, the task is automatically reassigned to another authorized user—typically a control owner.
In Dynamics 365 Finance, escalation is configured within the workflow step properties:
Navigate to the approval step in the workflow editor and find the related step, open the properties.
Under "Time limits", set a duration (e.g., 1 day).
Go to Escalation tab.
My configuration says:
▶️ If the workflow step is not approved in 1 day, then it will be assigned to user admin,
▶️ If the workflow step is not approved in 4 hours, then it will be assigned to user Dadiyaman,
▶️ If the workflow step is not approved in 2 hours, then it will be automatically Rejected.
This mechanism ensures control continuity, avoids bottlenecks, and demonstrates that the organization has safeguards against delayed approvals—an important consideration during SOX audits.
CONCLUSION
Designing effective approval workflows in Dynamics 365 Finance is not just a matter of system configuration—it is a control activity that directly supports SOX compliance. When implemented with a clear understanding of control objectives, approval workflows can enforce proper authorization, support Segregation of Duties, and generate the audit evidence needed to validate financial governance.
This article demonstrated how to design and execute a SOX-compliant purchase order approval process in D365FO, from activating change management to enforcing dual-level approvals and workflow escalation. Each workflow design choice—such as preventing self-approvals, using value-based conditions, or defining time-bound escalation paths—should be mapped back to a specific control objective in your organization’s risk and control matrix (RCM).
Ultimately, the goal is to move beyond simply routing transactions for approval. A properly designed workflow provides assurance to management and auditors that transactions are reviewed by the appropriate personnel, decisions are logged and traceable, and control breakdowns are systematically prevented. With D365FO’s workflow engine, compliance teams can build these safeguards directly into the business process—creating a strong line of defense against financial misstatements and audit findings.
