Admin
Configures organizations, membership and access for the assurance workspace.
Can
- Manage Organizations, business units, team members, Users
- View Assessments, Risks, Controls, operation receipts
- Professional Services GRC
- Roles and permissions
Who can do what in Professional Services GRC
Assign preparation, remediation and independent judgment to named people.
How permissions work
Name the owner
Assign each assessment, risk, control and corrective action to the person responsible for its next step.
Separate review
The retest reviewer must differ from the corrective action owner.
Check scope
Confirm organization membership before assigning assessment work.
Review evidence access
Use Internal and Shared deliberately for assessment attachments.
Who can do what
| Role | Organization | Risks and Controls | Assessments | Testing and Evidence | Findings and Remediation | Assurance Reviews |
|---|---|---|---|---|---|---|
| Admin | Edit | Edit | Edit | View | View | — |
| Assessment Owner | View | View | Edit | Edit | View | Edit |
| Control Owner | — | Edit | View | Edit | Edit | — |
| Assessment Tester | — | View | View | Edit | Edit | Edit |
| Remediation Owner | — | — | View | — | Edit | — |
| Independent Reviewer | — | — | View | View | Edit | Approve |
Each role in detail
Assessment Owner
Scopes assessments and coordinates tests and client reviews.
Can
- Manage Assessments, assessment tests, client control reviews
- View business units, Controls, record attachments, Findings
Starts on: Assessment Schedule
Control Owner
Maintains risk-linked controls and supports test preparation.
Can
- Manage Risks, Controls
- View Assessments, assessment tests, Findings
Starts on: Active Controls
Assessment Tester
Records control test outcomes and raises findings with supporting evidence.
Can
- Manage assessment tests, Findings, record attachments
- View Assessments, Controls, Risks
Starts on: Assessment Schedule
Remediation Owner
Owns corrective work, due dates and evidence after a finding is raised.
Can
- Manage corrective actions
- View Findings, Assessments, Retests
Starts on: Remediation in Flight
Independent Reviewer
Reviews assurance revisions and retests corrective work independently.
Can
- Manage review decisions, Retests
- View Assessments, assessment tests, Findings, corrective actions, record attachments, client control reviews
Reviews and approves
- Approve client control reviews
Starts on: Assessment Schedule
Set up Professional Services GRC your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.