Hi Paul,
As you said "
2. Yes and the user who will do the firefighting (i.e Firefighter) has been assigned the SAP_GRAC_SPM_FFID which is also set in parameter is 4010. "
Where is this user ID created? If Firefighter is centralized, this user(end user to use Firefighter ID) should be existing in GRC and this role will not be available in GRC box.
Check your Users assignment. As Salman said, Only FFID should be in backend, other users should be in GRC box.
Check the parameter of centralize firefighter which system it is pointing and ask user to login to that system.
Regards,
Sabita