Skip to content

People

Org structure, roles, and the people lifecycle. System of record is Employment Hero for employee/leave data; ops-hub's role model (below) governs system access, not employment terms.

Org chart by accountability

TODO: Lumaris is principal-led and deliberately small (per the ISMS scope statement — this concentrates access and key-person risk, which the firm is already aware of). A confirmed org chart wasn't found in the material reviewed; check Shared drives/2. Business Administration/1. Roles and Responsibilities/Lumaris_Business_Operating_Framework_v0.3.docx (a draft business operating framework already exists there) and reconcile it with this file rather than maintaining two versions.

Once confirmed, structure it by accountability, not hierarchy — who owns each function's outcome, not just who reports to whom:

Principal(s)
├── Strategy & client relationships — accountable: [name/role]
├── Delivery — accountable: [name/role]
├── Sales & business development — accountable: [name/role]
├── Finance & operations — accountable: [name/role]
└── People — accountable: [name/role]

System access roles (ops-hub)

These are distinct from job titles — they govern what someone can see in the internal dashboard.

Role Access
director Full access — all views, day rates, margins, P&L. Manages other users' roles.
operations Full access except day rates. Can export data.
delivery_lead Pipeline, all projects, capacity calendar. Revenue visible; margins and day rates hidden.
consultant Own projects and time logs only. No pipeline or finance access.
pending Authenticated, no access yet — a director must assign a role.

Onboarding

TODO: no confirmed onboarding checklist found — draft one with input from whoever last onboarded a consultant or subcontractor. At minimum it should cover: - [ ] Employment Hero record created - [ ] Google Workspace (@lumarisco.com.au) account provisioned - [ ] ops-hub access requested → director assigns role - [ ] Rate card role assigned (for day-rate/margin calculations) - [ ] Security onboarding — see ISMS documentation (Google Drive) for access control and acceptable-use requirements - [ ] Introduced to current engagements they'll be staffed on

Offboarding

TODO: mirror of onboarding — access revocation (Google Workspace, ops-hub, HubSpot/Xero if applicable), asset return, knowledge handoff for any active engagements. Given the firm's key-person-risk profile noted in the ISMS scope, offboarding for anyone holding privileged system access should be treated as higher-risk and reviewed by a principal.