People and accounts

The staff register is the single list of people that both modules use. Every account starts there: a person is added, invited by e-mail and sets their own password. A person who leaves is deactivated, and everything they filed stays on record under their name.

Who may do it: HR and the Entity Risk Manager for their own entity; the administrator for every entity. An operator in BCP Core cannot edit the staff list — by design. See Roles and permissions.

Add a person

Open People and choose Add person, or load several people at once through the People sheet (Organisation structure).
Enter the name, the work e-mail, the unit and the position.
Choose Save. The person appears in the staff register, in their unit, and in the call tree and status views of BCP Core.

Invite a person

Open the person and choose Invite.
Risk Core sends an invitation to their e-mail. The person follows the link, sets their own password and enrols an authenticator app — see Signing in.
If the invitation has not been used, choose Invite again to send a new one.

Nobody sets or sees another person’s password. With single sign-on on, the person signs in with their company account instead.

Reset an authenticator

Use this when a person has lost or changed their phone.

Open the person and choose Reset authenticator.
Confirm. At their next sign-in the person enrols the authenticator app again.

The reset is recorded in the audit log.

Deactivate an account

Open the person and choose Deactivate.
Confirm. The person can no longer sign in, and their roles end.

The records the person filed keep their name and time stamps — risks, loss events, observations, check-ins and every sign-off. Ended roles stay in the role history.

What the system does or refuses

One e-mail, one person within a company.
Deactivation never deletes records. Who-filed is stamped and stays (Product rules).
An operator cannot edit the staff list, even while activated.
Every add, invitation, reset and deactivation is recorded in the audit log.