Assign preparation, independent decisions and evidence access to the right people.
The Control Owner maintains the assessment and supporting operational records in the scope they own.
The Independent Assurance Reviewer records decisions on eligible revisions and reconciles evidence independently.
The App Administrator maintains organizations, business units and team membership.
The Auditor reads authorized evidence and reports without taking over preparation or review.
| Role | Policy versions | Assessments | Risks and controls | Control testing | Findings and remediation | Review and evidence |
|---|---|---|---|---|---|---|
| Control Owner | View | Edit | View | Edit | — | Edit |
| Independent Assurance Reviewer | — | — | — | — | — | — |
| App Administrator | Edit | Edit | Edit | — | — | — |
| Auditor | — | — | — | — | — | — |
| Assigned Tester | — | View | View | Edit | View | Edit |
Prepare assigned operational records and execute eligible reviewed actions.
Starts on: Assessment schedule
Review eligible revisions independently and reconcile operational evidence.
Starts on: Policy decision queue
Maintain organization configuration and membership.
Read authorized evidence and reports.
Starts on: Policy acknowledgments
Records assigned control test results, sample details and evidence for assessment review.
Starts on: Assessment schedule
Start free, then use Proto to change fields, steps and approvals before your team goes live.