About Risk Access Across Domains

Organization Hierarchy

All risks in the application are linked to an organization. Only users within that organization level or an organization higher in the organization hierarchy can view these risks.

For more information on organization hierarchy, see Managing Organizations and Organizational Hierarchy Best Practices.

Risk Owner and Approver Fields

The application supports sharing risk access to specific users outside of the organization linked to the risk. This action can be achieved by utilizing the Risk Owner and Risk Approver fields. Users assigned as the Risk Owner or Risk Approver will have access to the risk regardless of the organization hierarchy restraints.

The Risk Owner and Risk Approver fields can be completed when creating or editing a risk record. For more information, see Creating a New Risk From the Risk Register and Managing Risks from the Risk Details Screen.

Aligning Your Organization Hierarchy

You can align your OneTrust organization hierarchy with the logical access levels each user wishes to achieve with regards to the risk. To place lower-level restrictions on a risk, we suggest creating a larger, more detailed hierarchy that allows for separating users and risks.

If less restrictions are needed, we suggest leaving the hierarchy at a more simplified, higher level. In the simplified organization structure below, all users are assigned to a geolocation and can see all risks in their organization.

Restricting User Access to Specific Risks

Individual risks cannot be hidden, the best practice for restricting access to specific risks is to assign the risk to a higher level within the organization. This level should include users with a greater set of access.