What roles/privs give access to update/add users in HCM?

Summary

We are working with Internal Audit to provide them information on who can update users

Content

Our understanding is IT-Security manager role is required to add/update users and roles. However there are some other roles like HR Specialist, Line Manager roles that do have the ability to get to Manage User Account screen for the employees they have access to. So need to have a thorough understanding of what gives a user access to user accounts.

Any help on this is appreciated!