User groups are the way RiskManager determines what users are able to see. Trainings, policies, and documents (all of which we refer to as courses) are assigned to a user group, and then any user placed in that user group can see those courses.
Additionally, you can use user groups to filter reports. For example, if you had a user group named "Arlington Building", you would be able to view a report for only your staff who work at the Arlington Building.