I know that NetSuite has excellent security and has done a great job in limiting access based on users.  One hole that I found has been with internal IT or Admins.  For example, we want to have someone who is designated to be an admin assistant for NetSuite. Their role would be to manage the roles associated with line employees and line managers.  An issues arises because this person would need access to create and edit role, but they would be able to assign access to people and themselves greater than their initial role.

For example this admin needs to be able to customize and edit roles as our company grows, and people change roles.  The issue is this person should never have access to certain transactions, list, and reports.  Yet they can assign these roles to other and themselves.