Just to update - we did have the security profiles created as suggested and the tester said it did not work as they expected. I have not taken the time to look into this further. Most likely we are doing something slightly different than what is expected and that could be throwing off the solution.
Thanks for your input.
Sandra