Appearance
Tenant Settings
Configuration that shapes how your tenant behaves, beyond users, workflow and integrations.
Reporting currency
The tenant's default reporting currency, validated against ISO 4217 three-letter codes.
| Behaviour | Detail |
|---|---|
| Inheritance | New incidents inherit it unless specified otherwise |
| Historical invariance | Changing it preserves existing records' currencies; nothing is silently converted or restated |
| Aggregation | Mixed currencies are never summed. Metrics isolate per currency and flag that mixed currencies are present |
Requires settings.manage.
Changing the reporting currency does not restate history
An incident recorded in one currency stays in that currency. This is correct — a loss that occurred in a currency did occur in that currency, and converting it at today's rate would produce a figure nobody could reproduce.
The consequence is that a tenant that changes currency will have a mixed-currency loss dataset, correctly flagged as such.
Taxonomies
Where: Administration, then Taxonomies (/settings/taxonomies).
Taxonomies are classification trees used to tag governed entities. They give you a consistent vocabulary for filtering and reporting across modules.
| Action | Permission |
|---|---|
| View taxonomies and entity tags | taxonomy.read |
| Create and maintain taxonomies and terms | taxonomy.manage |
Tagging is authorised by the target entity, not by the taxonomy
Applying a tag to a control requires control.update; applying one to a risk requires risk.update. taxonomy.manage governs the trees, not the act of tagging.
This means a taxonomy administrator cannot tag records they could not otherwise edit.
Requires the Compliance Core entitlement.
Designing taxonomies
Fewer trees, used consistently, beat many trees used partially. A taxonomy applied to 30% of records is worse than no taxonomy, because filters built on it silently exclude the other 70%.
Avoid encoding organisational structure. Departments and units belong in organisational units, which drive permission scoping and workflow resolution. A department taxonomy will drift from the org unit tree.
Avoid encoding status. Records have statuses. A taxonomy term that duplicates one will disagree with it.
Risk methodology
Where: Administration, then Risk Methodology (/settings/risk-methodology).
Impact and likelihood scales, the scoring matrix, appetite thresholds and review cadence.
Requires risk.methodology_manage and the Risk Management entitlement.
See Risk Methodology for the substance.
Where settings take effect
| Setting | Takes effect |
|---|---|
| Reporting currency | On new records; existing records are unchanged |
| Taxonomy terms | Immediately, on tagging |
| Risk methodology | On the next derivation sweep for existing records; immediately for new |
| SLA policy | On new work; existing work is reclassified against the new policy |
| Workflow bindings | On new workflow runs only |
Two settings reclassify existing records; three do not
Risk methodology and SLA policy change how existing records are read. Currency, taxonomy and workflow bindings do not.
Before changing either of the first two, understand how many records move. A board that sees the count of Critical risks halve between quarters will ask whether exposure fell or the ruler changed.
Permissions
| Action | Permission |
|---|---|
| View tenant settings and policies | settings.read |
| Edit tenant settings and policies | settings.manage |
| View and manage taxonomies | taxonomy.read / taxonomy.manage |
| Configure risk methodology | risk.methodology_manage |
| Configure SLA policy | sla.configure |
| Capture requirement deadlines | deadline.configure |
Example
A bank's taxonomy set.
| Taxonomy | Applied to | Terms | Coverage |
|---|---|---|---|
| Control category | Controls | 14 | 100% |
| Risk category | Risks | 9 | 100% |
| Business line | Risks, incidents, engagements | 6 | 94% |
| Data classification | Assets | 4 | 100% |
What was removed during a review: a "Control owner department" taxonomy with 22 terms, at 61% coverage. It duplicated the organisational unit tree, had drifted from it in eight places, and every filter built on it was quietly excluding two-fifths of the register.
Department filtering now uses the governed owner's organisational unit, which is maintained in one place and used by workflow resolution as well.
Troubleshooting
"A taxonomy filter returns fewer records than expected." Coverage is partial. Untagged records are excluded from a tag filter.
"I cannot tag a record." Tagging requires the target entity's update permission, not taxonomy.manage.
"Risk ratings did not change after updating the matrix." Run the derivation sweep.
"Currency change did not restate historical incidents." Correct. Historical currencies are preserved.