The 47-Point NetSuite Optimization Checklist

When a live NetSuite account gets a fresh set of eyes, the pattern rarely changes. It was configured for the business as it looked two or three years ago, nobody has revisited it since go-live, and it has quietly drifted: reports slowed, scripts piled up, a module bought in a renewal never got turned on, and people who left still hold licenses.

None of that is a NetSuite problem. It's a maintenance problem, and maintenance is cheap compared to what it costs to leave it. An hour of a US NetSuite consultant runs $125–$300 depending on the work; a module you're not using runs $6,000–$36,000 a year. The math on a review is not close.

This is the checklist we work from, and you can run most of it yourself in a day. Where a fix needs SuiteScript or a data cleanup at scale, we'll flag it, and you can decide whether to do it in-house, put it on a managed-services retainer, or bring in help for a one-off block.

How the checklist is organized

Forty-seven checks across seven layers. Each layer maps to a place where accounts drift, and each item carries the reason it matters. Work top to bottom; the order roughly follows what pays back fastest.

Layer 1: Financials & the close

If the books are messy, everything downstream is guesswork. Start here. A mid-market close should land in 5–7 business days; when we see it stretch past 10, the cause is almost never "you outgrew NetSuite." It's a specific subledger that doesn't tie to the general ledger, an elimination that was never configured, or a manual step someone added years ago and never removed.

• 1. Periods are locked, and lock is not confused with close. NetSuite lets you lock A/P, A/R, Payroll, and G/L separately per period, and a locked subledger is not a closed period: users with the period-override permission can still post into it. The failure we find most is A/P locked while the G/L is left open, which lets a backdated journal quietly rewrite a number you already reported. Lock each subledger as it reconciles, close fully once G/L is done, and check who holds the override.
• 2. Bank and credit-card accounts reconcile to the G/L, monthly, inside NetSuite. A reconciliation is not "the feed matched." It confirms the cleared balance ties to the G/L account and that every in-transit item is genuinely in transit, not a stuck or duplicated line. Loose auto-match rules on bank feeds will happily clear a duplicated deposit.
• 3. Intercompany transactions are paired and actually eliminate. On OneWorld, auto-elimination posts elimination journals through a designated elimination subsidiary at period end, but only for transactions flagged as intercompany and paired across entities. Unpaired or mis-flagged IC balances never eliminate; they surface as a consolidation residual someone then fixes in Excel. Manual consolidation in a spreadsheet is a symptom that auto-elimination was never configured or that IC pairing is broken.
• 4. Deferred and multi-element revenue runs in ARM, not a spreadsheet. Under ASC 606, a bundled deal (software plus implementation plus support) is three performance obligations, and revenue has to be allocated to each by standalone selling price, then recognized on each one's own pattern: ratable for the subscription, as-delivered for services, at a point in time for delivered goods. Advanced Revenue Management models that as a revenue arrangement, revenue elements, and a fair-value allocation, and posts the schedules automatically. Doing it in a workbook leaves the allocation and any bundled-discount carve-out unauditable, and if you licensed ARM you carry that audit risk while paying for it.
• 5. The chart of accounts hasn't sprawled where a segment belongs. Every natural account added to slice by department, region, or product multiplies rows in every financial report and every elimination. Use segments (department, class, location, and custom segments) for that analysis, and since you cannot delete an account with posted history, inactivate the unused ones.
• 6. Approval routing is on, and pending items aren't hiding accruals. Bills and journals stuck in an approval state distort A/P aging and leave the accrual incomplete at cutoff. Confirm approvals route to someone present at close.
• 7. Budgets are loaded by account, period, and segment. Without a budget in NetSuite there is no native variance reporting, so FP&A rebuilds it in Excel every month and the two versions drift.

Cross-check against the failure patterns we cover in why NetSuite implementations fail. Several of them show up first as a close that won't come down.

Layer 2: Saved searches & reporting

Saved searches are NetSuite's reporting engine and its most common performance sink. A single heavy search on a dashboard portlet re-runs every time the page loads, for every user.

• 8. No unbounded searches on dashboards. A transaction search with no date filter evaluates every line in the transaction table, which on a mature account is millions of rows. Bound every dashboard and portlet search with a relative date range (this fiscal quarter, last 90 days). Oracle's own guidance on slow searches is blunt: constrain the time range, smaller is always better.
• 9. Formula filters sit last, behind indexed native fields. Formula criteria are evaluated row by row before the result set is narrowed, so a CASE WHEN on a joined field forces NetSuite to compute it for every candidate row. Put the selective, indexed native fields first (type, status, posting period, subsidiary, date), and let formulas do only the final narrowing on the rows that survive.
• 10. Dashboards carry the portlets people read, not fifteen they don't. Every reminder, KPI, and list portlet is a separate query fired on load, and a KPI scorecard with period-over-period comparisons runs its search once per range. Trim home dashboards to what people actually open each morning.
• 11. Orphaned searches are inactivated. A search built for a project that ended, or by someone who left, keeps executing if it still sits on a shared dashboard, feeds a workflow action, or drives a scheduled email. Sort by owner and last-run date, and retire the dead ones.
• 12. Reports and searches agree, and you know why when they don't. The same metric returning two numbers usually traces to a definition difference: transaction date versus posting period as the date basis, posting versus non-posting lines, or intercompany included in one and excluded in the other. Reconcile them and name one source of truth.
• 13. Scheduled email searches still have an audience. Daily result emails nobody opens are load on the server and noise in inboxes. Confirm each recipient list is current.
• 14. Heavy analytics live in SuiteAnalytics Workbook or a warehouse, not a live search. Multi-year trend and board reporting belongs on the analytics data source (a Workbook, or SuiteAnalytics Connect into a warehouse), not a real-time saved search scanning the transaction table on every refresh.

Layer 3: Workflows & scripts

Automation is where NetSuite earns its keep and where it silently rots. SuiteScript (NetSuite's server-side JavaScript engine) and SuiteFlow workflows accumulate over years, and old logic keeps firing long after anyone remembers why. Every execution is metered in governance units, so the real question is whether it works at production volume without hitting a ceiling.

• 15. No two scripts fight over the same record. The standard user-event sequence (beforeLoad, beforeSubmit, afterSubmit) is ordered, but when several afterSubmit scripts and a workflow each re-save the same transaction, they re-trigger each other and produce intermittent, hard-to-reproduce bugs. Map what fires on save for your key record types.
• 16. Scripts stay inside governance limits, and the heavy work is in map/reduce. Usage ceilings are real numbers: roughly 1,000 units for a user-event script and 10,000 for a scheduled script. A plain scheduled script cannot yield, so a large loop terminates mid-run and leaves data half-processed, while map/reduce scripts yield automatically at the 10,000-unit boundary and resume. That is exactly why bulk processing belongs in map/reduce, not a scheduled script or a workflow. Check the execution log for usage-limit errors.
• 17. Workflows do workflow-sized jobs. SuiteFlow is for state and routing, not bulk processing. A workflow that loops records through a saved-search action will hit governance and stall; if it iterates, it belongs in a script.
• 18. Deprecated runtimes are inventoried. SuiteScript 1.0 still executes but receives no new API features and is on borrowed time; even 2.0 is legacy now, with 2.1 the current runtime that supports modern JavaScript. Inventory what runs on which version and plan the migration.
• 19. Error handling and logging are real. A script that catches an exception in afterSubmit and swallows it is a script that corrupts data quietly. Confirm failures are logged (N/log) and that critical scripts raise a notification a human sees.
• 20. Bundle and SuiteApp updates are current. Managed bundles update automatically; unmanaged and third-party bundles do not, and ones untouched for years break on a release upgrade.
• 21. Every customization has a note explaining why it exists. Undocumented scripts are the reason nobody will touch a working system. Require a one-line business reason on each script and workflow.

When the automation layer needs real work, like rebuilding a script or untangling an integration trigger, that's development and integration territory, not a config change.

Layer 4: Roles & security

Access sprawl is the check most companies skip and every auditor asks about. It is also fast to fix.

• 22. Administrator is rare. The full Administrator role should sit with one or two people. We routinely find five, ten, a dozen, including ex-employees. Everyone else gets a scoped role.
• 23. Terminated employees have their access removed, not just their record inactivated. A login still tied to a role is both a security hole and, if it is a full license, money you keep paying, so release access on offboarding and reclaim the seat.
• 24. Roles follow least privilege at the permission level. Standard roles are deliberately broad; a sales rep inherits far more than they touch, and has no business editing the chart of accounts. Build custom roles restricted by permission and level (view, create, edit, full), scoped by subsidiary and department where it matters.
• 25. Segregation of duties holds across the payment path. The person who enters a vendor bill should not also approve it and cut the payment, and, just as important, whoever can edit a vendor's bank details should not also release payments to that vendor. That combination is the classic payment-fraud vector.
• 26. Privileged access uses 2FA-compliant authentication everywhere, including integrations. NetSuite already forces two-factor on the Administrator and every highly privileged role by default and will not let you switch it off, so the real gaps are elsewhere: privileged roles must not authenticate to the API with a username and password (prohibited under the mandatory 2FA policy), so their integrations have to move to token-based auth or OAuth 2.0. Extend 2FA to sensitive finance roles that are not auto-flagged.
• 27. IP restrictions and the login audit trail make sense. Review the login audit for access from places or hours that should not happen, and apply IP rules to privileged and integration roles where policy calls for it.
• 28. Custom roles are documented and owned. A pile of one-off custom roles nobody can explain is how access creeps back after you clean it up. Give each an owner and a reason.

Layer 5: Data hygiene

Dirty data is the root cause behind most "NetSuite is wrong" complaints. The software reports exactly what is in it: if customers are duplicated three ways, so is the revenue.

• 29. Duplicate customers and vendors are merged, and items are remapped. NetSuite's duplicate detection surfaces customer and vendor duplicates, and merging keeps the transaction history under a chosen master. Items are the trap: there is no native item merge, so deduplicating items means remapping open transactions and inventory by hand before you inactivate the loser. Duplicates split reporting, break matching, and inflate every list.
• 30. Inactive records are actually inactive. Old items, customers, and vendors cluttering dropdowns slow data entry and invite mis-keying onto the wrong record. Inactivate aggressively; the history stays.
• 31. Item costing is set, consistent, and not fighting negative inventory. A costing method is chosen per item and effectively locked once transactions post; you cannot flip an item from average to FIFO after it has history without a cleanup. Mixed methods across similar items produce valuations no one trusts, and the classic distributor problem is average-cost items driven negative, where each receipt recomputes a wild unit cost.
• 32. Required fields are enforced where they carry reporting weight. If a field drives a report, make it mandatory at entry; optional fields get skipped, and the gap shows up as a hole in every report that groups by that field.
• 33. Naming conventions are consistent. "ABC Corp," "ABC Corporation," and "ABC" are three records to NetSuite, three rows in every list, and three slices of the same customer's revenue. Standardize and enforce at entry.
• 34. Open transactions are genuinely open. Partially received purchase orders, unfulfilled sales orders, and unapplied customer payments inflate A/R and A/P aging, overstate commitments, and skew every operational report. Close, fulfill, apply, or write them off.
• 35. Subsidiary, class, department, and location tagging is complete. A blank segment is why a P&L by department carries an "unassigned" bucket eating the margin, and incomplete subsidiary tagging breaks elimination and allocation upstream.

Layer 6: Integrations

Every connector to Shopify, Salesforce, a 3PL, or a bank is a moving part that can fail, over-poll, or fall out of sync. Integrations cost $15,000–$50,000 each to build; they cost more than that to ignore once live.

• 36. Nothing polls faster than the data needs. Every SOAP, REST, and RESTlet call consumes governance and concurrency, and a connector hammering NetSuite every minute for data that changes hourly burns headroom the rest of the account needs. Match poll frequency to the real freshness requirement.
• 37. Failed syncs raise an alarm a human sees. The dangerous integration is the one that fails silently and lets two systems drift for a week. Confirm errors surface to a person, not just a log nobody reads.
• 38. Field mappings still match reality. Source systems add and rename fields, and mappings drift behind them. Spot-check that orders, items, customers, and tax land on the right fields, and that a new required field on either side has not started silently rejecting records.
• 39. There is a reconciliation between systems. A daily or weekly count and value check on each side catches drift before finance finds it in the close. Record counts alone are not enough; reconcile amounts.
• 40. Integrations authenticate with token-based auth or OAuth 2.0 on dedicated, scoped roles. A connector running under a named employee's login breaks when that person leaves and almost always over-grants access; it is also non-compliant for privileged roles, where username-and-password API access is prohibited under the mandatory 2FA policy. Give each integration its own scoped role and token.
• 41. Retired integrations are fully turned off. A connector for a tool you stopped using may still be running, still authenticated, still holding a token, and still consuming capacity. Revoke the token and deactivate the role.

Layer 7: Licensing & cost

This is where the checklist pays for itself: licensing drift is money leaving every month for capacity you don't use. Run these before every renewal, and start 90 days ahead because changes take effect at the contract date.

• 42. Every module you pay for is configured and used. Modules run $500–$3,000/month each (SuiteCommerce up to $5,000). A licensed-but-dark module is $6,000–$60,000 a year of pure shelfware, and it is the most common recovery we find. Confirm each is not just enabled but carrying transactions.
• 43. Full users who only enter time are on self-service licenses. Full access is $129–$199/user/month; employee self-service is $10–$25. Staff who only enter time and expense, submit, or approve rarely need a full seat, and reclassifying the wrong-tier users is the fastest license saving there is.
• 44. Licensed user count matches active user count. You pay for provisioned seats, not used ones. Reclaim licenses tied to people who left or changed roles.
• 45. You're not about to trip a service-tier cap by surprise. The Standard tier includes 100 users and 200,000 monthly transaction lines, measured on a rolling six-month average, so a single busy month will not force a jump but sustained growth will. Crossing either cap moves you to Premium (1,000 users, 2,000,000 lines) at a real step up in cost, so track the trailing average yourself.
• 46. The renewal uplift is capped. Renewals rise 5–8% a year by default. A 3–5% cap is achievable and worth six figures over a decade.
• 47. Sandbox and premium-support add-ons still earn their keep. A sandbox at 10–20% of your license subtotal is worth it during active development and questionable when nobody has built anything in a year.

How to run this audit yourself in a day

You don't need us for the first pass. Work in this order; it front-loads the findings that pay back fastest.

1. Morning: money and access. Start with Layer 7 (licensing) and Layer 4 (roles), both pure inspection: pull Manage Users and Billing Information, list active licenses versus active people, and note every module you can't confirm is in use.
2. Midday: performance. Move to Layer 2 (saved searches) and Layer 3 (scripts). Open Customization > Scripting > Saved Searches, sort by owner and last run, and check Script Execution Logs for governance errors.
3. Afternoon: books and data. Finish with Layer 1 (financials), Layer 5 (data hygiene), and Layer 6 (integrations). Check period-lock status under Manage Accounting Periods, run duplicate detection, and review integration logs for silent failures.

Write each finding as a one-line problem plus an owner. You'll end the day with a prioritized list, most of it yours to action (inactivating searches, reassigning roles, right-sizing licenses), with a handful that need a developer or a scoped consulting block.

The five highest-ROI fixes we make in optimization engagements

Across the accounts we're called into, five fixes recur. These are patterns we see in the market, not a promise about your specific account.

Notice the shape: the biggest financial wins are the cheapest to make. It's the reporting and script work, Layers 2 and 3, that takes real hours, and where outside help usually earns its rate.

When to bring in help versus doing it yourself

Honest triage, because not every account needs a consultant.

Do it yourself when the findings are configuration and cleanup: inactivating searches, reassigning roles, merging duplicates, right-sizing licenses at renewal. If you have a capable NetSuite admin, the checklist above is their punch list.

Bring in help when the fix touches SuiteScript, when integrations are failing at production volume, when the close won't come down no matter what you inactivate, or when nobody in-house knows why a customization exists and everyone's afraid to touch it. That's when a scoped block of hours, or ongoing managed services, costs less than the slow bleed of leaving it.

And if you're weighing "the AI can do this now" claims against a straightforward config cleanup, our take on what's actually useful in NetSuite AI separates what pays off today from the demo-ware.

The whole point of a review is to stop paying for what you're not using and to make the account fast and trustworthy again. However you run it, the return on a day's work here is rarely close.

Frequently asked questions

Changelog. July 2026: initial publication with 2026 pricing and licensing benchmarks. Sources: aggregated 2025–2026 partner quotes and published market data; Gartner ERP research; Oracle NetSuite documentation. Oracle does not publish list prices, so figures shown are market ranges.