Managing GRC Roles

The application uses roles-based access control to prevent the misuse of functionality. Features in the application are tied to permissions. If a user does not have permission to utilize a feature, it will not be accessible in the interface. You can assign system default roles to users and create custom roles. For help creating a custom role, see Creating and Editing Custom Roles.

System Default Roles

Audit Management


Role	Description	Additional Access
Audit Manager	The Audit Managers is responsible for managing all aspects of the audit process. Users with this role are fully authorized in the Audit Management module and can create and manage audits, workpapers, and findings as well as configure related audit settings.	If an Audit Manager role would like to access controls, consider adding the following permissions to a custom role: Controls Library View Control Implementations View Details of a Given Control Implementation Control Owner View View all Org Control Implementation To create a custom role, see Creating and Editing Custom Roles.
Auditor	Auditors are responsible for reviewing the audit they were assigned. Users with this role are able to access the Audit Management module and can access and complete work on any audit, workpaper, and finding for which they were assigned.	If an Audit role would like to access additional control details, consider adding the following permissions to a custom role: Controls Library View Control Implementations View Details of a Given Control Implementation Control Owner View View all Org Control Implementation

Policy Management

Note:

The following permissions help restrict document access for Owners, Approvers, and users with custom roles:

View all org policies
View all org procedures
View all org standards
View all org privacy notices

Users granted these permissions can view all organization-wide policies, procedures, standards, and notices. Users without these permissions will only see documents where they are specifically assigned as one of the following:

Owner
Approver
Workflow stage approver
Privacy notice creator


Role	Description
Enterprise Policy Manager	Enterprise Policy Managers are responsible for managing all aspects of policy creation. Users with this role are fully authorized in the Policy Management module and can create, organize, and manage documents.
EPM Policy View Only	EPM Policy View Only users are responsible for viewing policies. Users with this role are able to access the Policy Management module and view policies without the ability to create, edit, delete, or download the policy.
EPM Procedure View Only	EPM Procedure View Only users are responsible for viewing procedures. Users with this role are able to access the Policy Management module and view procedures without the ability to create, edit, delete, or download the procedure.
EPM Standard View Only	EPM Standard View Only users are responsible for viewing standards. Users with this role are able to access the Policy Management module and view standards without the ability to create, edit, delete, or download the standard.
EPM View Only	EPM View Only users are responsible for viewing policies, standards, and procedures. Users with this role are able to access the Policy Management module and view policies, standards, and procedures without the ability to create, edit, delete, or download the documents.
Ethics Policy Manager	Ethics Policy Managers are responsible for creating, organizing, and managing all aspects of ethics policies. Users with this role are fully authorized in the Ethics Policy Management module and also have access and management abilities in Reports and Campaigns.
Ethics Policy Owner	Ethics Policy Owners are responsible for building and editing the policies in which they are assigned. Users with this role are able to access the Ethics Policy Management module and can facilitate policy workflows without the ability to edit workflow stages, edit policy attributes, or bypass approvals.
Policy Attestation Respondent	Policy Attestation Respondents are responsible for reviewing the attestations they were assigned. Users with this role are able to access the Self Service Portal to review, acknowledge, and attest policies.
Policy Owner	Policy Owners are responsible for reviewing the policies they were assigned. Users with this role are able to access the Policy Management module to manage all aspects of a policy and assign controls to a policy.

IT & Security Risk Management


Role	Description
IT Risk Approver	IT Risk Approvers are responsible for reviewing and approving a risk when assigned as the risk approver. Users with this role are able to access the IT & Security Risk Management product and access risks in which they are the approver. Note: This role is mapped to the Risk Approver system attribute.
IT Risk Manager	IT Risk Managers are responsible for managing all aspects of the risk management process. Users with this role are fully authorized in the IT & Security Risk Management module and can create, edit, and manage risks.
Tech Risk & Compliance Admin	Tech Risk & Compliance Admins have access to fundamental capabilities in IT & Security Risk Management, Compliance Automation, and Policy Management products that helps streamline administrative tasks. Users with this role posses managerial permissions across all modules, enabling them to view, create, edit, and delete content.

Note:

Download the IT Risk Management Permission List to view a full list of the current IT & Security Risk Management permissions.