Organization and access

An assessment needs an accountable organization, a business unit and an owner before anyone can make sense of its review history. The App Administrator maintains these records. The Control Owner then selects the organization and counterparty business unit for each assessment. This keeps work for one operating group from being mixed with another group’s queue. Operations Overview gives the team a place to spot recorded exceptions that need attention.

Organizations carries the name, code, active state, time zone and currency. Business units adds a name, code, contact and eligibility note under an organization. Agree what the code means before importing historical units. A renamed unit should retain its identity so older assessments still point to the same party. The contact helps an owner resolve a question; it does not replace the accountable owner on the assessment.

• Membership. team members links a person to a user and organization, with an active state, role name and time zone.
• Business context. A business unit belongs to an organization and can be selected as the assessment counterparty.
• Assignment. Each assessment links to an owner, organization and counterparty; its status and revision show where the work stands.

Decide which organizations may share an App Administrator and which must be administered separately. Define who can activate a business unit, who confirms its contact and eligibility note, and how an inactive unit should be treated on a new assessment. Preserve existing references on older work even when a unit stops taking new assignments.

Map each team member to the correct user before opening the first live review. Auditor has read access to assigned evidence and reports. The Control Owner prepares operational records. The Independent Assurance Reviewer makes independent decisions. Administrator membership does not supply that decision authority. Give Assessment Tester access only to the dated checks and attachments that role needs.

Take a planned assessment for a particular business unit and period. The App Administrator checks the organization’s code, time zone and active state, then confirms that the business unit sits beneath it. The Control Owner selects that unit as counterparty and assigns an active team member as owner. The reviewer opens the assessment and can tell which organization owns it, who prepared it and where its supporting records belong. If the wrong unit was selected, correct the draft before review rather than treating a contact name as a substitute for a reference.

• Active Business Units — Find the current units, their organizations and the contacts needed to resolve scope questions.
• My Assessments — Follow work assigned to the current owner by status and period.

Use assessment preparation after membership and business units are ready. The roles page helps rehearse access for each person.