Payroll Processing Platform

Security Authorisation Assessment

SA
Delegate · DEL-004

Risk Owner — Payroll Processing Platform

Delegated Risk Authority — Residual Risk Acceptance. Authority derived from organisational governance, not technical access.

ACTIVE
All authorities
Authority Holder
SM

Sarah Mitchell

Risk Owner

Fictional demonstration data

Authority type

Delegated Risk Authority

Primary decision right

Residual Risk Acceptance

System scope

Payroll Processing Platform

Maximum risk

MEDIUM

Classification

Up to PROTECTED

Valid until

30 June 2027

Authority Source
Delegation instrument

Enterprise Risk Management Delegation Instrument

Instrument

GOV-RISK-2026-01

Delegated by

Chief Risk Officer

Effective

1 July 2026

Expiry

30 June 2027

Decision Rights

Residual Risk Acceptance

Allowed · Yes
Maximum residual risk

MEDIUM

System scope

Payroll Processing Platform

Information classification

Up to PROTECTED

Decision types
Security RiskCyber RiskTechnology Risk
Constraints
  • Cannot accept risk outside assigned system scope.
  • Cannot accept HIGH or CRITICAL residual risk.
  • Cannot self-approve exceptions where the Risk Owner is also Treatment Owner.
Authority Provenance

GOV-RISK-2026-01

Enterprise Risk Management Delegation Instrument

Documented authority
Source type

Governance document

Authority

Chief Risk Officer

Effective

1 July 2026

Expiry

30 June 2027

Evidence

1 supporting artefact

Confidence

HIGH

Documented

Governance instrument of record.

Configured

Set in a system, pending governance backing.

Inferred

Suggested by observation only.

VERIDION never treats inferred authority as sufficient for accountable risk acceptance or system authorisation. Authority must trace to a documented governance instrument.

Authority EvaluationExample · DEC-026

Can this Risk Owner accept DEC-026?

Decision

Residual Risk Acceptance

Risk

MEDIUM

System

Payroll Processing Platform

Classification

PROTECTED

Required authority

Risk Owner

Authority record

DEL-004

Machine evaluation
  • Role matchPASS
  • Decision rightPASS
  • System scopePASS
  • Risk limitPASS
  • Classification limitPASS
  • Validity periodPASS
  • Separation of dutiesPASS

Within Delegated Authority

VERIDION evaluates authority from the governance model. This result does not constitute the decision itself.

View DEC-026
Authority Chain

  1. Chief Risk Officer

    Accountable source authority

  2. Risk Owner

    Delegated holder — Sarah Mitchell

  3. Decision within delegated limit

    MEDIUM or below

Escalation Path
MEDIUM or belowRisk Owner
HIGHAuthorising Officer
CRITICALAuthorising Officer + Executive Risk Authority

Governance authority is part of the VERIDION knowledge graph. A person holds a role, which receives authority through a delegation, which permits a decision right — bounded by scope, limit, classification, validity and separation-of-duties rules. A decision requires that authority.

Person

Sarah Mitchell

holds

Role

Risk Owner

receives authority through

Delegation · GOV-RISK-2026-01

DEL-004

permits

Decision Right

Residual Risk Acceptance

Constrained by

Scope

Payroll Processing Platform

Risk Limit

≤ MEDIUM

Classification

Up to PROTECTED

Validity

Until 30 Jun 2027

Rule

Separation of Duties

Decision

DEC-026

requires authority
Open DEC-026

DECIDE performs the human decision workflow. DELEGATE establishes whether that human possesses the authority to make it.