Six entities. Three currencies. One consolidation spreadsheet. And a shared drive link half the company can open.
Most finance controllers have lived this.
The second your financial data leaves the accounting system and lands in Excel, the controls vanish. No role restrictions. No segregation of duties. No audit trail showing who changed cell F47 at 2 a.m. on the Sunday before the board pack went out.
This is not a hypothetical. In 2024, 83% of organizations reported at least one insider attack, and financially motivated privilege misuse drove 89% of those cases (IBM, 2024; Verizon, 2025). Financial services pays the most, at $20.68 million a year in insider threat costs (Syteca, 2025).
So if you run multi-entity consolidation through spreadsheets, the question is not whether ungoverned access creates risk. It is how long until that risk shows up.
Setting up role-based access for financial reporting is not an IT project. It is a finance operations priority. Here is how to do it right.
What RBAC Is, and Why Multi-Entity Teams Need It
Role-based access control (RBAC) restricts system access by a person’s role, not person by person. In multi-entity reporting, it decides who can view, edit, approve, or export financial data for each entity in the group.
Why does it matter more with multiple entities? Because every entity widens the attack surface. New ledgers. New bank accounts. New intercompany transactions. New users who need some level of access. Without RBAC, permissions sprawl.
Teams that consolidate manually spend over 15 days on month-end close, and every manual handoff is a point where access governance breaks (Phoenix Strategy Group, n.d.).
The goal is simple. Every person sees exactly what they need, does exactly what their role requires, and nothing more.
Step 1: Inventory Your Entities, Users, and Data
Before you configure anything, map where you stand. You need three lists.
Entities and their data. Write down every legal entity, subsidiary, and branch that feeds consolidation. Note the jurisdiction, the currency, and any local rules. Singapore’s PDPA, for instance, carries penalties up to S$1 million or 10% of annual turnover, and enforcement looks hard at whether your controls match the sensitivity of the data (DPO Consulting, 2025). For multi-currency groups, currency jurisdiction adds one more layer to scope.
Users and their jobs. List everyone who touches financial data. The FC running consolidation. The external auditor at year-end. Contractors. Board members with reporting access. Anyone in FP&A pulling data for the budget.
Current access. For each system you run (Xero, QuickBooks, NetSuite, Excel, Google Sheets, reporting tools), write down who has access and at what level. This step is usually the most revealing. Most teams find permissions piled up over years with no cleanup.
Step 2: Build Roles Around Function, Not People
The most common RBAC mistake is one role per person. That creates “role explosion,” where you end up with so many roles that access reviews become impossible. Permify (n.d.) does the math: 50 job functions times 20 locations times 10 projects is 10,000 roles.
Build roles around function instead:
- Entity Preparer. Enters and edits transactions in one entity. Cannot approve journals or touch other entities.
- Entity Reviewer. Views and comments on assigned entities. Cannot edit.
- Consolidation Manager. Accesses all entities to consolidate. Runs eliminations and adjustments. Cannot change source entity data.
- Approver. Approves journals, intercompany transactions, and consolidated reports. Cannot approve what they initiated.
- Read-Only Analyst. Views reports and dashboards. No access to underlying transactions.
- External Auditor. Read-only, time-limited, scoped to set entities and periods.
Keep roles broad enough to avoid explosion, tight enough to mean something. For most mid-market multi-entity setups, 6 to 10 core roles is the sweet spot.
Step 3: Bake Segregation of Duties Into the Roles
Segregation of duties (SoD) means no one person controls every stage of a transaction. Whoever starts a payment should not be the one who approves it.
In small teams, this is hard. A solo FC or a two-person team often initiates, approves, and records the same transaction. That is the exact setup SOX and audit best practice forbid (Numeric, n.d.).
Build SoD into the framework, not into goodwill. Pathlock (n.d.), an ERP security specialist, recommends naming the “toxic combinations” of permissions and blocking them before they ever reach a user. The system should never let one role both “create vendor” and “approve payment” for the same entity.
When the team is too small for clean separation, write down your compensating controls. Supervisor review above a threshold. Quarterly access certification. Automated alerts on odd patterns. These are weaker than real separation, but far better than nothing, and the auditor will ask.
Step 4: Scope Permissions to the Entity
This is where many cloud accounting tools fall short. QuickBooks lacks the enterprise audit trails and role controls that multi-entity governance needs (EagleRock CFO, n.d.). Xero has no native multi-entity consolidation, so you cannot scope access per entity inside the platform. Even NetSuite, which offers role-based dashboards, takes real configuration to enforce entity-level permissions across consolidated reporting.
Your design has to account for this data governance gap. If your accounting platform cannot scope access by entity, you need an orchestration layer that sits above your source systems and governs the consolidated view. This is where governed data infrastructure earns its place.
It is also where purpose-built multi-entity platforms pay off. Planir, for example, connects straight to your source accounting systems and enforces entity-level access inside its reporting and budgeting workflows. Every action is logged. Every output is auditable. The FC keeps approval authority over what gets consolidated. The spreadsheet gap closes, and the FC does not have to become a systems administrator to close it (Planir, 2026).
Step 5: Put It All on One Access Dashboard
The most stubborn problem in multi-entity access is the lack of a single view of who can see what. Picus Capital (n.d.) flagged this as a real hole in mid-market finance tooling: run a different accounting system per entity and there is no central way to audit permissions.
Your dashboard should answer four questions at a glance:
- Who has access to each entity? By role, not just by name.
- What can they do? View, edit, approve, export.
- When was access last reviewed? Stale permissions are a top risk.
- What changed recently? New users, changed roles, escalated permissions.
If your tools cannot produce this, build it by hand in a controlled document and review it quarterly at minimum. The average insider threat takes 81 days to detect and contain (Ponemon Institute, 2025). A quarterly review shrinks that window fast.
Step 6: Automate the Reviews
RBAC is not a one-time setup. Roles drift. People move. Entities get acquired or wound down. Skip recertification and your framework rots within months.
Set a fixed cadence:
- Monthly. Review new access grants and role changes.
- Quarterly. Recertify every active role across every entity.
- Annually. Audit role definitions, SoD rules, and compensating controls.
Automate what you can. Flag dormant accounts (no login in 60 days). Alert on permission escalations. Generate auditor-ready access reports. The less manual work it takes to maintain RBAC, the more likely it gets maintained.
Why This Is a Finance Problem, Not an IT One
Multi-entity reporting without access controls is a liability dressed up as a workflow. Every shared spreadsheet, every ungoverned export, every role that mixes incompatible permissions is a line on a risk register no one wrote.
The fix is structural, not cultural. Define roles by function. Enforce segregation of duties in the system. Scope permissions to the entity. Make access visible. Review it on a cadence that catches drift before it turns into a breach.
55% of insider incidents come from negligence, not malice (StationX, 2025). The right RBAC framework turns that number from a threat into a problem you have already solved.
References
DPO Consulting. (2025). PDPA obligations Singapore. DPO Consulting. https://www.dpo-consulting.com/blog/pdpa-obligations-singapore
EagleRock CFO. (n.d.). QuickBooks vs Xero vs NetSuite. EagleRock CFO. https://www.eaglerockcfo.com/blog/startup-financial-tools/quickbooks-vs-xero-vs-netsuite
IBM. (2024). 83 percent of organizations reported insider threats in 2024. IBM Think. https://www.ibm.com/think/insights/83-percent-organizations-reported-insider-threats-2024
Numeric. (n.d.). Segregation of duties in accounting. Numeric. https://www.numeric.io/blog/segregation-of-duties-accounting
Pathlock. (n.d.). Role-based access control (RBAC). Pathlock. https://pathlock.com/blog/role-based-access-control-rbac/
Permify. (n.d.). Role explosion. Permify. https://permify.co/post/role-explosion/
Phoenix Strategy Group. (n.d.). Challenges of multi-entity reporting automation. Phoenix Strategy Group. https://www.phoenixstrategy.group/blog/challenges-multi-entity-reporting-automation
Picus Capital. (n.d.). Beyond borders: The current problem with finance tools for multi-entity companies. Medium. https://picus-capital.medium.com/beyond-borders-the-current-problem-with-finance-tools-for-multi-entity-companies-5cfd2d2ad08d
Planir. (2026). Planir: The complete FP&A platform for mid-market finance teams. Planir. https://planir.app/
Ponemon Institute. (2025). 2025 cost of insider risks global report. Ponemon Institute.
StationX. (2025). Insider threat statistics, facts, and figures. StationX. https://www.stationx.net/insider-threat-statistics/
Syteca. (2025). Insider threat statistics, facts, and figures. Syteca. https://www.syteca.com/en/blog/insider-threat-statistics-facts-and-figures
Verizon. (2025). 2025 data breach investigations report. Verizon.









