You have to work with your external auditors that would have SoD rules list. Then you translate it into NetSuite permissions/ permission levels. As far as I remember, Strongpoint folk used to work in the big 4 auditing firms and they had the list. If you are a public company, you have to work with your auditors on the SoD list because they will be auditing it after all. Otherwise try to google it