Key concepts

Six ideas explain how Risk Core behaves: the entity tree, roles granted at a level of it, personas, reporting periods, values the system computes, and seven product rules.

The entity tree

Every company is modelled as a tree: group → subsidiary → division → team. A company outside a group is a tree with one company at the root. Divisions and teams come from the organisation structure, which is entered once and used by both modules.

A role is granted at one level of the tree. It acts at that entity, reads the levels beneath and never sees a sibling company.

A role is granted at a level

A role is always granted at a node of the tree — the group root, a subsidiary, a division or a team.

• The role acts only at the entity where it is granted.
• It reads the levels beneath that node.
• A role at a parent company reads what its subsidiaries have reported up and never acts on a subsidiary’s records.
• One person can hold several roles, at several levels and in several companies, under one sign-in.

The full rule set is in Roles and permissions.

Personas

Each persona has its own set of screens. A button appears only when the role allows the action, and the database refuses the action regardless of the screen.

Module	Personas
ERM Core	Risk Champion · Reviewer · Approver · Entity Risk Manager · Executive / RMC · Group RM · Group Reader · Administrator
BCP Core	Staff · Team head · Line executive · HR · BCP head · Operator

Where each persona starts is in Your roles and where to start.

Reporting periods

• Only the group root opens a year. Every company in the group then works in that year, so every report consolidates.
• RCSA runs in cycles. Roll-forward copies risks, scores and controls into the next cycle.
• Loss events are reported monthly. Each company files its month, including a formal nil return when there were no losses. The period freezes when the RMC accepts it.
• The BIA is approved once a year, and each approval creates a new version.

Computed, never typed

Scores, tiers, rating bands and statuses are derived by the system from the inputs. A user cannot type them: the residual score, the materiality tier of a loss event, the KRI band and the criticality tier of a BIA activity are all computed. Codes are issued by the system too — CM-RISK-2026-001, LE-2026-0001, KRI-CM-001.

The seven product rules

Each rule is explained once, in Product rules.

1. Down-Only Visibility — a company sees itself and the companies beneath it, never a sibling.
2. Subsidiary-Independence — a parent reads a subsidiary’s reported records and never acts on them.
3. Report-Up-Only — the only link between companies is each company reporting to its parent.
4. Reported-Then-Visible — the parent sees a record only after the company has validated it.
5. Group advisory is display-only — a parent’s BCP advisory never changes a subsidiary’s level and never pushes to its staff.
6. Computed, never typed — scores, tiers, bands and statuses are derived.
7. Who-filed is stamped — every record and step carries its author and time; history is append-only.