User Roles and Segregation of Duties in Odoo
Short answer: User roles and segregation of duties in Odoo control exactly what each person can see, create, approve or pay. Designed properly, no single person can both create a supplier invoice and approve its payment, which is the single most common control weakness auditors flag in growing companies.
Why does this matter beyond fraud prevention?
- It protects honest employees too, by removing situations where one person's mistake has no second check.
- It is usually a specific line item in an external audit or a bank's due diligence review.
- It limits the damage if one account is compromised or a password is shared carelessly.
The classic separations worth setting up
- The person who creates a purchase order should not be the one who approves it above a threshold.
- The person who enters a supplier invoice should not be the one who releases its payment.
- The person who adjusts stock counts should not be the one who approves the resulting write-off.
- Access to change core settings, like tax rates or approval rules, should sit with very few people.
| Task | Done by | Approved or released by |
|---|---|---|
| Purchase order above a threshold | The person who creates it | A different approver |
| Supplier invoice payment | The person who enters the invoice | A different person who releases the payment |
| Stock count adjustment | The person who adjusts the count | A different person who approves the write-off |
| Core settings such as tax rates or approval rules | Very few people | — |
Getting the balance right
Over-restricting access just pushes work back to one overloaded administrator and slows the business down; under-restricting leaves real exposure. The right design usually follows your actual approval limits and org chart, not a generic template, and gets reviewed again as the company grows and roles change.
Frequently asked questions
Can access rules differ by company in a multi-company setup?
Yes, permissions can be scoped per company as well as per role.
Who should be able to change user permissions themselves?
Usually a very small group, often just one or two trusted administrators, since this access controls everything else.
Is this a one-time setup, or does it need revisiting?
It should be reviewed periodically, especially after staff changes, promotions or new approval thresholds.
Close the gap before an auditor finds it
ExtraMile designs user roles and approval structures in Odoo around real segregation of duties.
Ask about user permissions in Odoo or message us on WhatsApp: Egypt · Gulf
This article was drafted with AI assistance and reviewed and edited by Mohamed El-Baddaly, Chairman of ExtraMile Business Solutions.