Colleen,
I also checked my another instance and it shows up there as an org level, it makes more sense for SAP to have this as an org level because if you have more than 20 company code and each company has their own security administrator they will manage their users administration by user group, being the org level field you can mange this by one role 20 derived roles.You know what I mean.
Regards,
Faisal