Roles and the roles panel
A role is always granted at a level of the tree — the group root, a company, a division or a team. It acts at that level and reads the levels beneath it. The roles panel shows every grant, and a revoked role stays in the history.
Who may do it: the Entity Risk Manager for their own entity; the administrator for every entity. Every user can open the roles panel to see their own roles, read-only. See Roles and permissions.
Grant a role
Section titled “Grant a role”- Open the roles panel and choose Grant role.
- Choose the person from the staff register.
- Choose the role — for example Risk Champion, Reviewer, Approver, Entity Risk Manager, Executive / RMC, HR, team head or BCP head.
- Choose the level of the tree where it is granted: the company, a division or a team.
- Choose Save. The role takes effect at the person’s next screen, and the grant is recorded with who granted it and when.
Revoke a role
Section titled “Revoke a role”- Open the person in the roles panel.
- Choose the role and Revoke.
- The role ends at once. The grant and the revocation stay in the person’s role history, with who did each and when.
To give the role back, grant it again; the history shows both periods.
One person, several roles
Section titled “One person, several roles”- One person can hold several roles, at several levels and in several companies of the group, under one sign-in.
- Each role keeps its own scope. A person who is Approver for one division and Risk Champion for a team acts as each only where that role is granted.
- A person with roles in several companies switches company from the header.
The operator in BCP Core is delegated by the BCP head, not granted here — see Command and operation.
What the system does or refuses
Section titled “What the system does or refuses”- A role acts only where it is granted. A role at a parent company reads what its subsidiaries have reported up and never acts on their records (Subsidiary-Independence).
- Revoked roles are kept. The history cannot be edited or deleted.
- Buttons follow the role, and the database refuses an act the role does not allow, whatever the screen shows.
- Every grant and revocation is recorded in the audit log.