Hi John,
It seems to be a bug in GRC. Before we conclude on this, Can you share screenshot of Access Risk Analysis screenshot with selection criteria of Organization level in User level report.
If Company code is not appearing , implement following SAP note.
1970172 - GRAC_PFCG_AUTHORIZATION_SYNC fills transaction log
Thanks
Mohan