Preventing Regulatory Responsibilities From Falling Between Functions

01Start with the duty holder, not an org chart

A law may impose a duty on an employing company, licensed operator, accountable professional or governing body. That legal actor is not necessarily the employee who prepares the form or completes the inspection. Record the authoritative source, affected entity and official duty holder before assigning departmental tasks. A RACI chart can clarify work but cannot change liability imposed by law.

For multi-site organizations, legal and corporate compliance should establish a common interpretation where appropriate while identifying location-specific duty holders. A central team may coordinate a filing, but the named regulated entity may need to authorize it. The responsibility record should explain these distinctions so that shared services do not create an accidental gap between who acts and who is legally accountable.

It helps to start with one high-consequence duty, identify the legal entity responsible and then ask which department is capable of acting. This sequence is more reliable than assigning responsibilities according to organizational rank. A corporate policy can allocate work, but it cannot rewrite statutory accountability. Where the legal actor is different from the process performer, record both explicitly and make sure each understands what the other must provide.

In examining who is obligated, the relevant official management-system reference is ISO 37301:2021 — Compliance management systems: requirements and guidance. The operative legal or contractual text remains the source of binding duties for the specific activity and jurisdiction.

02Follow the transaction across teams

Map the obligation from trigger to final evidence. An employee injury may require a site supervisor to secure safety, HR to verify employment details, EHS to establish technical facts and a competent officer to notify the authority. A filing could also depend on finance, procurement or an external laboratory. Draw the workflow around actual data exchanges instead of departmental reporting lines.

Highlight where information might stop: a mailbox no one monitors, an export that excludes temporary workers, a change request that never reaches the license manager. Use one recent completed case and one exception to validate the map. If the last person cannot reconstruct what happened at each interface, the duty is still vulnerable even though every participant says they followed their procedure.

Map the journey in real operating language. For an occupational injury, staff may need to secure the area, preserve facts, obtain medical information and prepare a statutory notification. A chart with columns labeled HR, EHS and Operations is useful only if it specifies the actual handoff inputs, verification and time requirements. Review a case handled outside ordinary office hours; it may reveal gaps hidden by a normal daytime process.

03Separate accountability, performance and assurance

Assign an accountable manager for the complete outcome, performers for discrete tasks, advisers for specialist interpretation and an independent reviewer where needed. Clearly specify who can settle disagreement, approve spending or order immediate containment. Several contributors can be responsible for work, but there should not be an unlimited chain of approvals that prevents a legally time-sensitive action.

Consider role capability and authority. An assigned owner without portal access, a qualified signatory or the ability to obtain technical records cannot discharge the obligation. Put deputies and fallback contacts in place. ISO 37303:2025 offers useful competence-management guidance; it does not make an unqualified employee legally authorized to perform an act reserved to a licensed professional.

Authority matters more than the number of named owners. A technical specialist might be competent to assess an exposure but unable to authorize a reporting submission. Another manager might have budget authority but no right to sign a declaration. A clear design separates these decisions and places urgent actions within reach. Check actual system permissions, deputy arrangements and qualified signatory requirements against the workflow rather than assuming appointment means capacity.

04Design service-level handoffs between functions

Internal service agreements can define inputs, validation, timing, exception routes and completion evidence. For a regulator return, the source-data team may provide a dated, reviewed dataset, while the submitting team records receipt and any subsequent query. The agreement should say what happens if inputs are late, inconsistent or corrected after sign-off. A reminder to “coordinate closely” is not an adequate interface control.

Use a shared obligation ID that follows the entire workflow, while keeping the underlying legal interpretation in its controlled source. This makes it easier to see which gate is waiting and prevents duplicate or conflicting workbooks. Avoid creating so many parallel approval trackers that a person must update several systems before carrying out the underlying regulated activity.

Internal service-level commitments can be much more useful than general cooperation statements. They establish what source data must arrive, how errors are returned and what proves that the final filing was completed. Include exception rules when information is disputed or late. A shared case number lets the teams find the same duty across systems without copying everything into a massive new register. The objective is end-to-end traceability with minimal duplication.

05Escalate ownership conflicts before a deadline

Where departments dispute ownership, invoke a defined interim rule: the designated accountable executive assigns temporary control, legal clarifies the duty holder and the specialists decide what immediate action is safe and lawful. A disputed RACI entry must not prevent containment or a mandated notification. Record the reason for the choice and any legal limitation on delegation.

Escalation should carry a concrete decision request: the obligation, trigger, exposure, responsible entity, options, unresolved information and deadline. Avoid forwarding email chains without a proposed resolution. An executive can then assign budget or authority, ask for counsel or order an operational change. The result should update the process and the responsible parties, not merely close a meeting action.

An interim owner should be established before an ownership dispute becomes a missed deadline. The escalation decision should be framed as a concrete question: who must act, what temporary safeguard is lawful and who can settle the long-term allocation? Preserve the original uncertainty and the decision taken. Email exchanges about a RACI label are not adequate if an environmental discharge or safety event is continuing without proper control.

06Test resilience during absence and change

Role vacancies, reorganizations, new IT systems and outsourcing arrangements can quietly reopen earlier gaps. Trigger a reallocation review when these events affect a critical obligation. Test whether a deputy can locate the source, last return, required input, regulator contact and signatory mechanism. If the route relies on an individual’s private correspondence or undocumented personal knowledge, redesign it.

Use brief scenario testing for high-consequence duties. For example, what happens when a permit exceedance occurs during a night shift while the regular environmental manager is absent? Observe the path from site recognition to authorized decision and evidence preservation. The answer reveals organizational weakness that a role matrix alone cannot show.

Reorganization creates silent risks when the old process owner leaves and the new one inherits only a dashboard. Perform an actual handover demonstration on a critical duty. Ask the deputy to locate the last accepted return, the source law and an emergency contact. If this cannot be done promptly, the handover is incomplete irrespective of the personnel system’s status. Use change events to reopen accountability mappings.

07Measure end-to-end completion

A dashboard showing that every department finished its tasks may conceal an incomplete regulated outcome. Sample obligations through the final acknowledgment, effective control or submitted evidence. Track handoff delays, rework, contradictory data, late escalation and follow-up effectiveness. Compare the source duty with the outcome actually delivered, not the number of boxes marked complete.

Leadership review should highlight recurrent interface failures and authority gaps that local managers cannot solve. Improvements might involve data automation, changes in job design or a single accountable service owner. ISO 37302:2025 supports evaluation of compliance-management effectiveness, while the final legal duty continues to depend on the applicable instrument and jurisdiction.

Review a duty from trigger to official outcome, not just through the departments involved. If a final regulator receipt is missing, an internally complete task chain is insufficient. Look at recurring bottlenecks and rework at each interface; these may justify redesigned system access, a shared data definition or an executive decision about staffing. A good cross-functional governance model allows a reviewer to answer not only who performed work, but whether the regulated result occurred.

Practical Implementation Review

To put the ideas in Preventing Regulatory Responsibilities From Falling Between Functions into operation, begin with the question raised by Start with the duty holder, not an org chart. Then trace one ordinary transaction to the result described by Who verifies. The purpose is to identify what evidence a reviewer would actually see, which specialist or manager could intervene and what uncertainty would remain unresolved.

Use the decision sequence below to brief the relevant process owners. In this subject, Work means who performs, whereas Decision means who authorizes. Examine whether those two conditions work together under normal and exceptional circumstances. Where serious legal exposure may exist, apply the immediate lawful containment and escalation route instead of deferring action to a scheduled review.

1. Source: Who is obligated
2. Work: Who performs
3. Decision: Who authorizes
4. Proof: Who verifies

Closing Perspective

Clear departmental contribution is not enough. The organization needs a named decision owner for the regulated result, tested interfaces between specialist teams and a way to prove the final duty was fulfilled. A reliable handoff is observable in a real transaction, not just in a chart.

For a follow-up assurance review, reopen the actual decision discussed under Test resilience during absence and change and inspect whether its operating result has changed. Keep the record of any new facts, relevant authorizations and outstanding limitations. The distinct issue in this article is who is obligated; the programme becomes credible when that issue can be investigated using ordinary business evidence rather than a declaration of task completion.