Roles, responsibilities and authorities
Assign and communicate the roles the BCMS depends on, name who is accountable for conformity and who reports performance to top management, and provide deputies.
01What applies
Top management must assign and communicate the responsibilities and authorities for the roles the BCMS depends on. It must specifically assign responsibility and authority for ensuring the BCMS conforms to the standard and for reporting BCMS performance back to top management. The clause expects the assignment to be communicated, which means the holder knows it, not only that a matrix exists. It also expects the reporting line to be real: a role that reports performance into a forum with no authority does not satisfy the purpose. Deputies are not named in the clause but follow from the continuity principle: a role that stops when one person is unavailable is a single point of failure in the governance.
02Why it matters
In a disruption, ambiguity about authority costs hours. The clause makes the decision rights explicit before they are needed. The conformity and reporting roles are separated on purpose: the person who runs the system should not be the only person who judges whether it conforms, and performance has to reach the level that can act on it.
03What good looks like
Write a one-page responsibility matrix: role, accountability, authority, deputy. Include the response roles, not only the management system roles. Test it by asking three holders to state their authority without looking. Add the deputies to the call tree and to the exercise.
04Evidence an auditor asks for
Ask who can authorise a failover, who can speak to a regulator, and who can commit spend in the first hour. If any answer is 'whoever is around', authority is not assigned.
| Evidence | The record |
|---|---|
| Responsibility matrix | Roles, accountabilities, authorities and deputies, communicated to each holder |
| Conformity role | A named individual accountable for BCMS conformity |
| Reporting line | Evidence performance is reported to top management, with the forum and the date |
05Where it commonly fails
- Roles assigned in a matrix the holders have never seen
- Conformity accountability and performance reporting combined into one unfunded part-time role
- Deputies undefined, so the BCMS has a single point of failure in its own governance
06What to do before the estimate
Build the matrix with a deputy column and a decision-rights column. Send each holder their row and ask them to confirm it.