Assigning User Roles
Introduction
Overview
Before using SCOPE, users must be assigned user roles, which is done by completing the digital SCOPE Access Request Form. This section provides general guidance on navigating the process for assigning user roles. Please note that each Country Office faces unique challenges with different numbers and types of staff available, and will need to develop a plan for assigning users roles accordingly.
External parties (e.g. UNUnited Nations agencies, NGOs, governments) can also be assigned user roles with restricted access if they request SCOPE services and seek to access SCOPE. In this case, the user form is provided as an annex to the SCOPE Service Agreement with further reference in the Service Level Agreement.
SCOPE user roles should be aligned with the Country Office staffing structure and business processes, which should include appropriate segregation of duties and delegation of authority for performing SCOPE functions. Country Offices should contact RB/HQ CBT focal points for support in setting up office structures and business processes.
Who is responsible for assigning user roles?
Country Office Management and Heads of Units are normally responsible for deciding which staff members will perform which roles in SCOPE, in accordance with their terms of reference.
The Country Office SCOPE Focal Point is responsible for coordinating the approval of SCOPE Access Request Forms.
The SCOPE Service Desk is normally responsible for activating user accounts in SCOPE.
Why is assigning user roles important?
SCOPE is a beneficiary management system digitising a number of work flows that need to be completed by separate users with varying levels of access and responsibilities. SCOPE serves to digitise existing processes in which the segregation of duties is essential. It is therefore crucial that Country Office staff members receive the correct user role assignments needed to complete all necessary processes in SCOPE.
What do I need to do before assigning user roles?
Before assigning roles using the SCOPE Access Request Form you should first determine and clarify the relevant work flows to allow the segregation of duties to be fulfilled by staff members in your Country Office. For external partners, you will need to obtain the User Form that is attached to the SCOPE Service Agreement.
Where can I learn more?
For more information on SCOPE user roles, log in to the WFPWorld Food Programme VPN and click here. For more information on how to submit your request online through WSS, click here.
User roles available in SCOPE
Before assigning roles you should first determine and clarify the relevant work flows to allow the segregation of duties to be fulfilled by staff members in your Country Office using SCOPE. The tables below list all of the user roles you can request accounts for in order to fulfil those duties. Note that the duties staff members need to fulfil will vary depending on circumstances in each Country Office and its goals. For example, if you are using POS terminals, then you will need a staff member to have a POS Terminal AssignerManages POS Terminals. Assigns POS terminals to retailer. user account in SCOPE.
In compliance with the WFPWorld Food Programme Guide to Personal Data Protection and Privacy, any user accessing personal data needs to be appointed in strict accordance to the principle of specified purpose and necessity. It is therefore important that for each appointed user role the Country Office is able to demonstrate the purpose that such a user intends to achieve through his or her data access and processing. Refer to the WFP Guide to Personal Data Protection and Privacy for further information.
Management profile / Regional BTO
|
User Role |
Description of Duties |
|---|---|
| GuestCan view Projects, Beneficiaries, and Intervention details. Has read only-access. |
Has read-only access and views the following:
|
Programme profile
|
User Role |
Description of Duties |
|---|---|
| Country AdminManages Projects, Interventions, Foodnet users, POS Commodities, Administrative areas, Currencies, Locations, Partners, Manage Delivery Mechanisms |
Manages the following:
|
| Intervention Admin |
|
| Field OfficerManage Enrolment (Re-Enrol, Verify, Add, Edit, Suspend), Verifies conditionality data, Manage Recipient Candidate and Alternate, Manage Cards (barcode/smart) |
|
| EnrollerEnrol, re-enrol and Bulk Enrol beneficiaries | Enrols, re-enrols and bulk enrols beneficiaries |
| Enrolment Verifier | Verifies enrolments |
| Enrolment Approver | Approves enrolments |
| Distribution PlannerPlans distribution, Manage conditionality track data file, Create Distribution List, Add Cash transfer distribution, Upload conditionality data |
|
| Distribution Plan VerifierVerifies distribution plan | Verifies distribution plans |
| RegistrarManage Beneficiaries (Register and Enrol), Bulk Enrol, Bulk Suspend, Edit Enrolment, Manage Recipient Relation, Manage Fingerprints |
|
| Retailer Settlement ViewerCan view retailer settlements and retailer transactions. This role must be selected if any other settlements role is selected. | Views retailer settlements and retailer transactions. This role must be selected if any other settlements role is selected. |
| Programme Officer (Delivery mechanism)Views the Payment Advice File uploaded by the FSP, Processes Registry File, Can view Enrolments. |
|
| AnthropometricAdds and views Bio/Anthropometric data for attendance tracking | Adds and views biometric / anthropometric data for attendance tracking |
| Attendance TrackingViews recipient relations as well as performs voucher redemptions on Offline Workstation. | Views recipient relations as well as performs voucher redemptions on Offline Workstation |
| Payment List CreatorCreates payment list, View Cycle, View Distribution List |
|
| Admin Areas Viewer | Can only view the administrative areas structure |
| Restricted Front End Access | Cannot view restricted beneficiary data such as names, document types and numbers |
Finance profile
|
User Role |
Description of Duties |
|---|---|
| Payment List VerifierVerifies payment list | Verifies payment lists |
| Payment List ApproverApproves payment list | Approves payment lists |
| FSPR (Delivery mechanism)Downloads/Uploads Payment Advice File for 3rd party service provider. | Downloads / Uploads the PAFPayment Advice File for the 3rd party service provider |
| Retailer Settlement Payer | Confirms that the bank transfer is done in WINGS |
Logistics / Procurement profile
|
User Role |
Description of Duties |
|---|---|
| Retailer Settlement CreatorProduces Invoices for Retailer settlement. | Produces invoices for retailer settlement |
| Retailer Settlement VerifierVerifies invoices from SCOPE for Retailer settlement. | Verifies invoices from SCOPE for retailer settlement |
| Retailer Settlement ApproverApproves invoices for Retailer settlement in SCOPE so payment can be made through WINGS. | Approves invoices for retailer settlement in SCOPE so payment can be made through WINGS |
| Retailer AdminManages Retailers as well as Default Retailers (Create/Edit) | Manages retailers as well as default retailers (create / edit) |
Technical / IT profile
|
User Role |
Description of Duties |
|---|---|
| Setup WorkstationDownloads data from SCOPE Online to Offline Workstation. | Downloads data from SCOPE Online to Offline Workstation |
| POS Terminal AssignerManages POS Terminals. Assigns POS terminals to retailer. | Configures, manages and maintains POS terminals, assigns POS terminals to retailers |
| Redeem VoucherRedeems vouchers on the Offline Workstation (attendance tracking) | Redeems vouchers on the Offline Workstation (attendance tracking) |
| Cache Config | Sets up cache build so that data can be downloaded from SCOPE Online to SCOPE Offline |
| Barcode AdminManages bar-code cards (Add/Delete/Edit/Reprint) | Manages barcode cards (add, delete, edit, reprint) |
| Sync VoucherSynchronizes vouchers on the offline workstation. Upload OWS Voucher Redemptions. | Synchronizes vouchers on the Offline Workstation, uploads OWS voucher redemptions. |
| UploaderUploads registration data collected Offline | Uploads registration data collected offline |
| FMS Fleet & Device ManagerManages mPOS fleets and devices on Powersync – only for COs using mPOS | Manages mPOS fleets and devices on FMS (only for COs using mPOS) |
Voucher and persons adjudication profile (compliance)
|
User Role |
Description of Duties |
|---|---|
| Voucher Adjudicator | Manages vouchers under adjudication (can review and cancel transactions, release or block vouchers) |
| Deduplication Adjudicator |
|
| Deduplication Adjudicator Supervisor |
|
| Deduplication Identity Officer | Views duplicated identities, filters and downloads CSV files |
| Deduplication Identity Manager | Views duplicated identities, views household details, deactivates duplicated identities |
| Deduplication Summary | Views deduplication summary and errors screens |
| Deduplication Administrator |
Views the following:
Downloads CSV files |
Business intelligence profile
|
User Role |
Description of Duties |
|---|---|
| BI User | Accesses anonymized data in the data warehouse & reports |
| BI Special UserAccess to not anonymized data in the Data Warehouse & Reports – Max. 2 per CO | Accesses non-anonymized data in the data warehouse & reports ( max 2 per CO) |
| BI Data Quality UserAccess to Data Quality tools & Data Quality Reports – Max. 2 per CO | Accesses data quality tools & data quality reports (max 2 per CO) |
Note: The Business Intelligence profile is allowed a maximum of two users per Country Office due to the high sensitivity of the data that can be accessed. (This number is negotiable where justified.)
Segregation of duties
Once you have determined which duties need to be fulfilled in SCOPE and the user role accounts this will require, you must assign user role accounts to the staff members in your Country Office.
Based on WFPWorld Food Programme's rules and regulations (RACI), SCOPE employs a segregation of duties (SoD) policy to ensure that each process is performed by a different unit (based on the function) and that within each unit only certain users can perform certain tasks.
To comply with the segregation of duties policy, a Country Office should assign each user role to a different member of its staff, except where circumstances specifically require staff members to perform multiple user roles, and this should be justified on a case-by-case basis and approved by the Country Director. The risks associated with one staff member having multiple user role accounts that conflict with the segregation of duties include:
- Weakened data security and data protection
- Increased chance of errors
- Possible user collusion with CPs, retailers and service providers
For a full explanation of the Cash and Voucher Business Process Model, log in to the WFPWorld Food Programme VPN and click here to explore the RACI (Responsible, Accountable, Consulted, Informed) matrix. The RACI matrix describes who is responsible for each step in the overall business process and outlines the segregation of duties during this process.
Exemptions to the segregation of duties
As each Country Office is in a unique situation, there are circumstances where WFPWorld Food Programme's rules allow for exemptions from the segregation of duties, to which SCOPE reflects. The most common example is a shortage of staff in a Country Office, forcing it to assign more than one user role to an individual staff member's account.
Individual members of staff can only have user roles that conflict with the segregation of duties with the explicit endorsement of the Country Director (CD), Deputy Country Director (DCD) or Regional Director (RD). During an audit exercise, the Country Office is required to respond by citing or attaching SCOPE Access Request Forms as endorsed by the CD, DCD, or RD.
SCOPE user roles for partner agencies
If WFPWorld Food Programme partner agencies use SCOPE to manage and process their interventions on the basis of a services agreement on the access and use of SCOPE(template to be requested from LEG), then the staff members of the partner user will require access to SCOPE. SCOPE user roles can be assigned to non-WFPWorld Food Programme staff members in a similar way as to WFPWorld Food Programme staff members, in accordance with the provisions of the services agreement.
Instructions
Assigning user roles
Once the Country Office Management and Heads of Units have assigned user roles to staff members in accordance with the segregation of duties, the Country Office SCOPE Focal Point must apply for the user role accounts to be activated.
To apply for a new or modified SCOPE user role account to be activated, perform the following steps:
-
Access the SCOPE Access Request Form in your web browser.
-
Complete the form.
Assigning user roles that contradict the segregation of duties
If the Country Office Management and Heads of Units intend to assign user roles to staff members in a way that contradicts the segregation of duties (for example where assigning more than one user role to an individual could present a violation of the segregation of duty rules of WFPWorld Food Programme), the Country Office SCOPE Focal Point must apply for an exemption with an exceptional access request.
To apply for an exemption with an exceptional access request, perform the following steps:
- Complete the SCOPE Access Request Form.
- Download the SCOPE SoD Exceptions Form. To download the PDF, click here.
-
Complete the form. Ensure the relevant sections are signed by the user and the user's supervisor or Head of Unit.
Ensure the CD checks the correct box for the amount of time the exceptional user role account should be active. The maximum period is three months. Also, ensure the CD signs the form.
In the absence of the CD, the DCD, RD, or DRD can complete and sign the form in accordance with applicable delegation of authority policies.
-
Send both forms together to the SCOPE Service Desk who will activate the user role account.
Note: User roles that contradict the segregation of duties automatically expire after three months. If you need an extension, you must re-submit both the SCOPE Access Request Form and the SCOPE SoD Exceptions Form.
Assigning user roles to partner agencies
If WFPWorld Food Programme partner agencies intend to use SCOPE to manage and process their interventions, and the parties have agreed on a services agreement on the access and use of SCOPE (which shall include the template of the SCOPE Partner Agency User Form), the Country Office SCOPE Focal Point must apply for the user role accounts to be activated.
To apply for a new or modified SCOPE user role account for an external partner's user to be activated, perform the following steps:
-
Download the SCOPE Partner Agency User Form. To download the PDF, click here.
-
Complete the form. Ensure the relevant sections are signed by the user and the user's supervisor or Head of Unit, and the requesting agency’s country representative.
Also ensure the CD signs the form. In the absence of the CD, the DCD, RD, or DRD can sign the form in accordance with applicable delegation of authority policies.
-
Send the form to the SCOPE Service Desk who will activate the user role account.
Troubleshooting
When staff members leave my CO, how do I make a request to revoke their user access to CO data?
Contact SSD by sending an email to scope.servicedesk@wfp.org and list the users you want to revoke user access to CO data for.