The risks that hurt are rarely on a report. A role whose name says "Sales Support" and whose permission list says "Administrator." A user marked inactive two years ago who still shows up as the last person to modify a vendor bill. One vendor behind 40% of everything you buy. A revenue drop that everyone agrees is possible and nobody has modeled. None of those is a number on a financial statement. All of them are in NetSuite.
The Sonar edition of the prompt library went live this month, and six of the new prompts are for this kind of risk. Three are about who can do what in the account. Two are about where the supply chain has a single point of failure. One asks what happens to the business if the worst quarter arrives.
If you're new to this, Sonar AI is an AI agent that runs inside NetSuite. Every prompt in the library is a playbook that I engineered and tested against live NetSuite data, and you run it inside your own account, against your own records.
Who Can Do What
Role and Permission Surface Map maps every role to its permission set and its active users. The analysis is simple and effective: compute the median permission count for standard roles and for custom roles separately, and flag any role with more than twice the median as an outlier. Where permission levels are available, it weights them, full access counting four times a view, and ranks roles by the weighted score. It also recognizes roles injected by bundles and SuiteApps, because those can't be edited by the customer and the fix is a conversation with the vendor rather than a permission change. The role that sails through audits is the one whose name suggests a narrow job and whose surface is broad. This is the prompt that finds it.
Segregation of Duties Matrix builds a per-user matrix of the transaction types each person has created, approved, or paid, straight from the created-by and modified-by fields on transactions. It carries a pattern library with the conflicts that matter: the same user entering and paying vendor bills, the same user invoicing and receiving customer payments, journals plus disbursements, and the self-modify pattern on high-value transactions. Each pattern is mapped to a COSO component. The prompt never concludes fraud. It flags indicators, and every one goes to a person to investigate.
Inactive User Phantom Activity checks something that surprises people. Marking a NetSuite user inactive removes them from pickers and blocks login through the UI, but it doesn't revoke token-based access, integration credentials, or scheduled scripts running under that identity. So the prompt joins inactive employees to recent transaction metadata and asks whether any of them are still appearing as the creator or modifier of anything. An inactive user in the last-modified field within thirty days is critical. An inactive user who still has access granted is high. A name appearing only as the proxy for a scheduled job is medium, and the fix is reassigning the job. Every finding goes to a person for the revocation itself.
Where the Supply Chain Breaks
Vendor Concentration and Single-Source Risk measures concentration two ways. At the vendor level, it computes a Herfindahl index across spend and applies the standard bands: below 1,500 is low concentration, above 2,500 is high. At the item level, it finds items, GL categories, and spend buckets that come from one vendor only. A single vendor above 35% of spend is critical and goes to a person; 25% to 35% is high. The prompt scopes by vendor subsidiary, since the subsidiary on a transaction isn't exposed to a query, and it says so in the caveats.
Single-Source Risk Identifier takes the single-sourced items from that analysis and scores each one from 0 to 100 on six factors with stated weights: annual spend, item criticality, lead time, substitutability, safety stock coverage, and vendor health. The weights are in the prompt. Criticality and substitutability carry the most, because an expensive item with three qualified alternatives isn't a risk, and a cheap one with no substitute and a twelve-week lead time is. The prompt is explicit that an item with one vendor in NetSuite may have other sources in the market that simply aren't set up, so a high score is a question to ask purchasing, not a verdict. Anything scoring critical gets a mitigation plan and executive visibility, and the plan is flagged for review.
What Happens If
Financial Health Stress Test is the largest prompt in this group and the one I'd hand to a board. It establishes a baseline from the actual financial statements, locks it, and then runs three scenarios against it: a 20% revenue drop, a 15% cost increase, and a supply chain disruption modeled as lost sales, a higher cost of goods rate, slower collections, and a build in inventory. Then it combines them into a stress floor. The rules are the kind that separate a model from a spreadsheet. The baseline is computed once, and every scenario is a delta from it, because baseline drift is the most common way a stress test goes wrong. Nothing is ever divided by a zero or negative denominator; the report says "not meaningful" and explains. And every projected number and every recommendation carries a confidence tag that reflects the strength of the assumption behind it, not the arithmetic.
The mitigation plans are where it earns its place. For each scenario, three to seven actions, each specific enough to start on Monday, with a time horizon, an owner, a quantified cash or P&L impact, and a confidence rating. For the combined stress, the prompt identifies the actions that appear in more than one scenario and flags them as the highest-leverage moves, because an action that helps in three futures is worth more than one that helps in one.
Wrapping Up
I used to think of risk as a finance topic. Most of the risks in this post aren't. They're in the permission tables, the user list, the vendor master, and the assumptions nobody wrote down. The data to find them has been in NetSuite the whole time. What was missing was someone whose job it was to ask, and these prompts don't need it to be anyone's job.
All six are in the paid tier of the Sonar AI Prompt Library, under Risk Management and Controls.