Responsibility Matrix

1) Purpose and value

The RACI matrix makes roles and decision points transparent at every step of the process, reduces operational risks and speeds up approvals.

• eliminate "gray areas" and duplication of efforts;
• Enforce policies and control requirements
• simplify auditing through provable role assignments.

2) Terms and options

R (Responsible) - performs the work/task.
A (Accountable) - bears ultimate responsibility, approves the result (one per task).
C (Consulted) - consults, engages before decision (two-way communication).
I (Informed) - is notified after the decision (one-way communication).

• RASCI: adds S (Support) - operational support for the performer.
• DACI: D (Driver), A (Approver), C (Contributor), I (Informed) - emphasis on the driver.
• RAPID: Recommend, Agree, Perform, Input, Decide - useful for product solutions.

3) RACI design principles

1. One A per task is unequivocal accountability.

2. As much R as needed, but avoid "R for all."

3. C - in fact, and not "just in case" (otherwise we slow down the flow).
4. I - address: we inform those whose actions depend on the result.
5. DoA/SoD connection: Powers and separation of duties should not conflict with RACI.
6. Versioning: RACI changes → PR/review/hash receipt → publication.

4) Where to apply

Incidents and crisis (information security/payments/privacy).
DSAR/retention/deletion of data.
VRM/onboarding and partner audits.
Releases and compliance gates in CI/CD.
Marketing and responsible advertising.
Payment disputes/chargeback.
BCP/DR exercises and Legal Hold.

5) Roles (sample dictionary)

Board/Комитет, CEO/ExCom, Head of Compliance, Legal/DPO, Risk Office, Internal Audit, CISO/SecOps, CTO/Platform, Data Governance, Payments/Finance, Vendor Management, Marketing/PR, Support/Operations, HR/L&D, Product/Engineering, Regional Leads.

6) Examples of RACI matrices

6. 1 Privacy incident (data breach)

6. 2 DSAR Access/Delete

6. 3 Critical vendor onboarding (VRM)

6. 4 Compliance Gate Release

7) DoA/SoD and Policy Communication

DoA (Delegation of Authority): A must have DoA approval authority.
SoD (Separation of Duties): R and A at critical steps are not combined with the execution of payments/admin actions.
Policies/Standards: Each row of the matrix references control approvals and SOPs.

8) RACI creation and modification process

1. Remove the current process (E2E diagram, decision points).
2. Define roles from the dictionary, coordinate with domain owners.
3. Fill in RACI at step/decision level, check for collisions with DoA/SoD.
4. Validate in practice (table-top/simulation).
5. Approve and publish to repositories (Git), include in wiki/portal.
6. Relevance support: triggers - change of organizational structure, Jurassic updates, audit/incident result.
7. Versioning and evidence: PR history, hash receipts, WORM archive.

9) Metrics and dashboards

RACI Coverage:% of key processes with fresh matrix.
Single-A Compliance: Percentage of tasks with exactly one A (100% goal).
C/I Noise Ratio: extra matching/notifiable (↓ trend).
Time-to-Decision: median of RACI step matching.
SoD Conflicts: Identified and closed conflicts by role.
Audit-Ready: share of matrices with binding to policies/controls/SOP and evidence.

Dashboards: Process Map + RACI overlay, Lead Time per RACI step, Org Heatmap (coordination bottlenecks).

10) SOP (standard procedures)

SOP-1: RACI Design

Process mapping → draft matrix → DoA/SoD verification → pilot/simulation → Committee approval → publication.

SOP-2: Quarterly Review

Collect organizational/policy changes → revise matrices → PR updates → read- & -attest for affected roles.

SOP-3: Trigger Incident

As a result of the incident - RACI adjustment (for example, A/C gain, R disaggregation) → SOP/controls update → retest.

SOP-4: Training

Micro-course on matrix reading and cases; required for A/R roles.

11) Templates

11. 1 RACI Table (Markdown)

Шаг процесса      Описание      R      A      C      I      Контролы/SOP
---    ---    ---    ---    ---    ---    ---
P-01      Прием запроса      Support      Head of Compliance      Legal/DPO      Product      SOP-DSAR-001, CTRL-DSAR-SLA

11. 2 YAML artifact (policy-as-code binding)

yaml process: "DSAR"
version: "1.3.0"
steps:
- id: P-01 name: "Intake & Verify"
R: ["Support"]
A: ["Head of Compliance"]
C: ["Legal/DPO"]
I: ["Product"]
controls: ["CTRL-DSAR-SLA","CTRL-PII-MIN"]
sop: ["SOP-DSAR-001"]
evidence: ["hash://evidence/dsar/intake-log.csv"]
meta:
owner: "Policy Owner - Privacy"
review_date: "2026-01-31"

11. 3 RACI Change Card

Justification (incident/audit/legal update)

Old/New Role Assignment

Impact on DoA/SoD

Training/Communication Plan

Links to PR/Hash Receipts

12) Integrations

Policy Repository - Links from matrices to control claims.
GRC: version storage and read- & -attest.
HRIS/LMS Role Profiles → Training for A/R.
ITSM/Jira: reconciliation tasks and SLAs on RACI steps.
CCM: auto-checks for A/R in activity metadata (e.g. admin logs, releases).

13) Antipatterns

Two or more A's per problem.
"R for all" and "C/I for show" → overload of channels and delays.
RACI with no connection to DoA/SoD and controls.
Disposable matrix without revisions and versioning.
Screenshots instead of live artifacts (no provability).
Lack of training for A/R → "paper" compliance.

14) Maturity model (M0-M4)

M0 Ad-hoc: roles are not fixed, reconciliations are chaotic.
M1 Basic: RACI on key processes, manual updates.
M2 Managed: DoA/SoD communication, repository, quarterly revisions, read- & -attest.
M3 Integrated: YAML matrices, PR process, linkage to controls/CCM and ITSM-SLA.
M4 Continuous Assurance Optimization Recommendations (bottlenecks), SoD AutoChecks, Lead Time Analytics, and what-if.

15) Related wiki articles

Corporate governance framework

Delegation of Authority Matrix (DoA) and Segregation of Duties (SoD)

Continuous Compliance Monitoring (CCM)

Policy and compliance repository

Cross-departmental checks

Crisis management and communications

Compliance Roadmap

KPIs and compliance metrics

Result

The RACI matrix is not just a table, but a mechanism of controllability: one responsible person for the result, clear performers and participants, a provable connection with powers and controls, regular audits and training. Such a system removes delays, reduces risks and makes audit-ready processes the default.