1. GRC for Education and Universities
  2. Roles and permissions
Reference

Who can do what in GRC for Education and Universities

Assign preparation, ownership and independent review to the right people.

Who can do what

Permissions by role
RoleRisk and control registerAssessment planningControl testingCampus reviewsFindings and remediationIndependent assurance
AdminEditEdit—Edit—View
Assessment OwnerViewEditEditViewViewEdit
Control OwnerEditEditEdit—Edit—
Campus ReviewerViewViewViewEditViewView
Finding Owner——View—EditEdit
Independent Reviewer—ViewViewApproveEditApprove

Each role in detail

Admin

Maintains organization, membership and access setup.

Can

  • Manage Organizations, business units, team members, Users
  • View Assessments, operation receipts

Assessment Owner

Scopes assessments and coordinates testing with control owners.

Can

  • Manage Assessments, assessment tests, record attachments
  • View Controls, Risks, Findings, campus control reviews

Starts on: Assessment Period Schedule

Control Owner

Maintains assigned controls and supplies testing context.

Can

  • Manage Controls, assessment tests
  • View Risks, Assessments, Findings

Starts on: Active Controls

Campus Reviewer

Records campus control reviews and policy exceptions.

Can

  • Manage campus control reviews
  • View Assessments, Controls, record attachments

Starts on: Assurance Awaiting Decision

Finding Owner

Plans and documents corrective action for assigned findings.

Can

  • Manage corrective actions
  • View Findings, assessment tests, Retests

Starts on: Remediation in Flight

Independent Reviewer

Reviews assessment revisions and independently retests findings.

Can

  • Manage review decisions, Retests
  • View Assessments, Findings, corrective actions, record attachments, campus control reviews

Reviews and approves

  • Approve review decisions, campus control reviews

Starts on: Assessment Period Schedule

Set up GRC for Education and Universities your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

How to get started