How to Audit a BCM RACI and Find Ownership Gaps

A BCM RACI should show who does the work, who has authority over the outcome, who must provide input, and who needs the result. To audit it, test more than the letters. Confirm that each accountable role can make the required decision, every handoff has a completion condition, and the workflow leaves evidence behind.

A matrix can look complete while ownership is still unclear. The problem usually appears when a BIA needs approval, a plan moves into review, an exercise finding needs an owner, or an unresolved issue requires escalation.

What a BCM RACI Audit Should Prove

RACI stands for responsible, accountable, consulted, and informed. The Project Management Institute describes a RACI chart as a responsibility-assignment matrix that states the roles of participating groups and can inform communication requirements.

The four letters are straightforward:

• Responsible: Performs or coordinates the work.
• Accountable: Owns the result or decision and ensures the work is completed.
• Consulted: Provides input before the decision or deliverable is completed.
• Informed: Receives the result or decision.

No source reviewed for this article establishes RACI as a universal BCM requirement. It is a governance tool. ISO 22301:2019 provides the current published framework for establishing, operating, monitoring, reviewing, maintaining, and improving a business continuity management system. A RACI can help an organization assign work within that system, but the organization must determine the appropriate roles and authority.

BCMMetrics practitioner guidance uses three questions to test whether a BCM RACI can work in practice.

Authority

Can the accountable role make or obtain the decision required by the row?

If a plan owner is marked accountable for approving a recovery strategy but does not control the required budget, technology, facility, or supplier decision, the matrix overstates that role’s authority. The row may need a different accountable role or an explicit escalation path.

Handoff

What exactly moves from the responsible role to the reviewer, approver, or next owner?

“BIA complete” is too vague if the next role does not know whether it is receiving raw inputs, a validated analysis, a recovery recommendation, or an approved decision. Name the deliverable and the condition that makes it ready.

Evidence

What record proves that the work and decision occurred?

Evidence might be an approved BIA, a current plan version, a review record, an exercise result, a corrective-action closure, or a documented exception. A calendar entry or meeting invitation is not enough when the claimed outcome is approval or closure.

A RACI is not clear because every cell is filled. It is clear when the next person knows what they are receiving, what they must decide, and what record they must leave.

Eight Checks for Finding BCM Ownership Gaps

Use these checks on one activity at a time. Do not start by debating every role across the entire program. A small number of broken rows usually exposes the broader design problem.

Check the Work and Accountability

1. Does each row describe one outcome or decision?

Rows such as “business continuity” or “plan management” are too broad. Separate the work into observable outcomes such as approve program scope, validate BIA inputs, review plan changes, approve the plan, record exercise findings, and close corrective actions.

2. Is there one accountable role?

Two accountable roles often mean the organization has not resolved who makes the final decision. A committee may provide oversight, but the row should still identify the role that owns the outcome under the organization’s governance rules.

The accountable role may also be responsible in a small team. That is different from having no identifiable decision owner.

3. Does the accountable role have actual authority?

Test the letter against the decision. Can this role approve the plan, accept an exception, commit resources, return incomplete work, or escalate beyond its authority? If not, the row assigns responsibility without decision rights.

For financial institutions, the FFIEC Business Continuity Management booklet provides a sector-specific example of authority distribution. It states that boards and senior management govern BCM by defining responsibilities and accountability, assigning resources, reviewing performance, and addressing weaknesses. Other organizations should follow their own governance and applicable requirements.

4. Can the responsible role perform the work?

Avoid assigning “the business,” “IT,” or “management” as if each were one working role. Name the role expected to act. Then confirm that the person filling it has access to the information, time, competence, and support required.

If an accountable role cannot approve, reject, fund, or escalate the work, the matrix has assigned a letter, not authority.

Check Participation and Handoffs

5. Are consulted and informed assignments selective?

Marking every function as consulted creates broad routing and slow decisions. Consult a role when its input can materially change the work or decision. Inform a role when it needs the result but does not need to shape it beforehand.

6. Does every handoff have an acceptance condition?

For each move between roles, define:

• the deliverable being transferred
• the event that starts the handoff
• the completion condition
• the receiving role’s next action or decision
• the due date or response expectation
• the record that will show acceptance, return, approval, or escalation

This is where many apparently complete RACIs fail. The letters say who participates, but not when the work is ready to move.

Check Evidence and Lifecycle Coverage

7. Does completion produce evidence?

Match the evidence to the claim. If the status is “reviewed,” retain the review result and any required changes. If it is “approved,” retain the approval and current version. If an action is “closed,” retain the closure basis and any retest or plan update required.

The UK Government Project Delivery guidance is not BCM-specific, but it makes two useful governance points. Roles and decision participation can be documented in a RACI, and the governance framework should remain usable, maintained, and proportionate rather than becoming an unwieldy document.

8. Does the matrix cover the full operating cycle?

Many RACIs end when a plan is approved. The matrix should also address exercise design, results, corrective actions, plan updates, exceptions, and periodic review. It should identify the boundary where program governance hands control to the incident or crisis structure.

Review the matrix when the organization changes roles, authority, plan scope, systems, suppliers, facilities, or reporting requirements. Use role titles in the matrix and maintain current assignees and backups in the appropriate roster.

Test One Handoff From Beginning to End

An ownership audit becomes more useful when the team walks through a real record instead of reviewing the matrix in isolation.

Take one recent plan update and reconstruct the path:

1. What change triggered the update?
2. Who decided that the plan needed work?
3. Who edited the affected content?
4. Which specialists validated dependencies or procedures?
5. Who reviewed the completed changes?
6. Who had authority to approve the new version?
7. What happened to unresolved issues?
8. Where are the review, approval, and current version recorded?

Compare the actual path with the RACI. If work moved differently, decide whether the process failed or the matrix is wrong. Do not preserve a theoretical assignment when the organization has a different legitimate decision path.

Run the same test with an exercise finding. Follow it from discovery to assignment, corrective action, plan change, approval, and closure. A matrix that works for drafting but loses ownership after an exercise is incomplete.

For the detailed draft-to-approval process, see Review and Approval Workflows for BC Plans. For the broader role model used by smaller teams, see BCM Roles and Handoffs for Small Continuity Teams.

Sample BCM RACI With Handoffs and Evidence

The following example assumes a small central BCM function coordinating distributed plan owners and specialist contributors. It is illustrative. Titles, approval authority, independence requirements, and participation must be adapted to the organization.

Role key:

• ES: Executive sponsor
• BCM: BCM program owner
• PO: Business-unit or plan owner
• FC: Functional contributors, such as IT, facilities, HR, legal, communications, procurement, or supplier management
• DA: Designated approver
• IA: Internal audit or independent assurance

The letters do not complete the design. Add a companion handoff record so each row can be executed and checked.

Activity	Handoff or completion condition	Evidence to retain
Approve policy, scope, and priorities	BCM submits the defined scope and policy for executive decision	Approved policy, scope record, decision date
Set method, templates, and schedule	Method and required outputs are approved and issued to owners	Current method, templates, calendar, change record
Complete BIA inputs	Plan owner confirms business inputs are complete and ready for BCM review	Completed BIA, owner confirmation, unresolved-question list
Validate dependencies	Functional contributors confirm or correct the dependencies assigned to them	Validation record, corrections, exceptions
Approve recovery strategy	Plan owner submits a recommendation with feasibility input and unresolved constraints	Approved strategy, decision record, accepted exception if applicable
Draft or update plan	Required content is complete and the plan is placed into review status	Draft version, change log, open-item list
Review plan	Required reviewers finish validation and comments are resolved or assigned	Review record, resolved comments, remaining issues
Approve plan	Designated approver accepts the plan or returns it with required changes	Approval record, current approved version, return reason if rejected
Set exercise objectives	Scope, participants, success criteria, and reporting expectations are approved	Exercise plan, objectives, participant list
Conduct exercise	Results are recorded against objectives and findings are assigned	Exercise results, findings, owners, target dates
Resolve findings and update plans	Closure criteria are met and affected plan changes are reviewed	Corrective-action record, approved plan update, retest evidence when required
Decide exceptions or resources	BCM submits the issue, options, consequences, and recommendation to the authorized role	Decision, risk acceptance, approved resource action, or escalation record

Where the BCM RACI Ends and Crisis Response Begins

The program RACI governs preparation and upkeep. It should not become a substitute for the incident or crisis command structure.

Before activation, the BCM RACI can assign responsibility for maintaining response plans, validating contacts, defining escalation criteria, scheduling exercises, and addressing findings. Once a disruption activates the response structure, authority should follow the approved incident or crisis plan.

The handoff should state:

• which event or decision activates the response structure
• who declares activation
• which role receives the current situation and relevant plans
• where incident decisions and actions will be recorded
• when unresolved recovery work returns to normal governance or corrective-action management

Do not assume that the program owner becomes the incident leader. That may be appropriate in some organizations and wrong in others. The approved response structure should decide.

For deeper guidance on crisis-team composition, backups, decision rights, and escalation, see MHA Consulting’s guide to setting up a crisis-management team.

Connect the Matrix to the Planning Workflow

A RACI may be maintained as a simple table. The harder question is whether the work behind it can be followed from draft through review, approval, exercise, and update.

Test the supporting workflow with these questions:

• Can the responsible role find the current plan and required template?
• Can reviewers see what changed and what input is expected from them?
• Can the approver identify unresolved issues before making a decision?
• Can the program owner see which plans are in draft, review, complete, or approved status?
• Can exercise findings be connected to corrective action and plan updates?
• Can the team retrieve the record that supports each completed handoff?

BCM Planner supports the records behind this workflow. Teams can create, edit, store, and share continuity plans, manage plan status, support review and approval activity, create exercise templates, and record results. The RACI still belongs to the organization. BCM Planner does not decide who should be accountable or what authority a role has.

The most useful BCM RACI is not the one with the most detail. It is the one that reflects real authority, tells people when work is ready to move, and leaves enough evidence to confirm what happened.

Start by auditing one plan update and one exercise finding. Fix the rows that do not match the actual decision path. Then use the Business Continuity Planning Checklist to confirm that the matrix covers the planning activities and records your program expects.