...
All users who has access to "Create new" can create new Risks and Risk Groups. The various rights groups are defined in a separete settings named “User groups that can create new Risk groups and Risks from buttons on frontpage“.
All regular users can create Risks, but they can only be linked to risk groups that they have the role as Risk owner or deputy.
Only users with access to the Risk menu, may create new Risk groups / Risks
Only these can edit risk groups: Risk group owner, Substitutes.
These can edit risks: Risk owner.
These can evaluate a risk for the first time (new outcome): anyone who can access the risk home menu.
Even if a person cannot edit a risk, they can enter read mode - find the risk and evaluate it with your relevant outcome.
...