You may associate management records with users directly, or you may associate management records with users indirectly through roles. In most cases it's preferable to associate the management record with a role because all users assigned to the role are automatically associated. Also keep in mind that users must already exist in the system before you may associate them with a management record.
So when should you associate users through roles and when should you associate users directly? Consider the following example: Perhaps an employee within your organization is going to serve as a temporary administrator. You want this user to have access to audit results within their region, but you don't want this person to have access to some of the other data made available to users with the ADMINISTRATOR role. Instead, you could associate this person directly with the management record in order to provide access to the audit results. Then, once that user is no longer required to serve as an administrator, you could go back to the management record's USERS tab and remove the user from the record.
At the top management levels, you will probably not have a large number of users. Keep in mind that users have access to audit results and reports within their own record and in all records beneath them in the hierarchy. Typically, only high-level managers and administrators are included in the upper management levels.