How to use this template
- Start with one system or use case from the portfolio register.
- Adapt the R/A/C/I codes and enter named people or role titles.
- Keep exactly one A in every row. Multiple As dilute accountability.
- The DPO remains an independent consulted input — do not merge the DPO with the Data owner or the decider.
- Complete the decision rights, evidence, escalation path and expected response time.
- Have the affected people approve the matrix before the first dispute or incident.
RACI in four sentences
RR — Responsible: does the work.
AA — Accountable: owns the outcome and remains answerable for it.
CC — Consulted: provides input before the decision.
II — Informed: receives an update after the decision.
7-stage × 7-role matrix
The codes are a starter baseline. Adapt them in a workshop, but keep exactly one A per stage. Use the second field in each cell for a person or role title.
| Stage / activity | Sponsor / committee | Business owner | Technical owner | Data owner | Security | Compliance / risk | Legal |
|---|---|---|---|---|---|---|---|
| 1. Intake and inventory | A | R | R | C | C | C | I |
| 2. Triage and scope | I | A | R | C | C | C | I |
| 3. Data use, privacy and role review | I | R | C | A | R | C | C |
| 4. Design and procurement | I | A | R | C | C | C | C |
| 5. Build, evaluation and acceptance | I | A | R | C | C | C | I |
| 6. Go-live | A | R | R | C | C | C | C |
| 7. Operate, change and retire | I | A | R | C | C | C | I |
Decision rights — who may say GO, GO WITH CONDITIONS or STOP
RACI allocates responsibility for work. This table clarifies the mandate for a specific decision, the required input and evidence, and the escalation path.
| Decision | Decider | Input required | Evidence required | Escalation | Decision time |
|---|---|---|---|---|---|
| 1. Admit a use case to discovery | Sponsor / committee | Business and technical owners | Problem statement and register entry | Executive sponsor / committee | Before work starts |
| 2. Approve scope, roles and review plan | Business owner | Technology, data owner, security, compliance and legal | Scope brief and draft RACI | Sponsor / committee | Before solution selection |
| 3. Approve data use and access | Data owner | DPO, security, compliance / risk, legal and technical owner | Sources, lawful basis, access, retention and data flow | Compliance / sponsor | Before data is used |
| 4. Select supplier, model and architecture | Business owner | Technology, procurement, security, compliance and legal | Options, TCO, contracts and security requirements | Sponsor / committee | Before purchase commitment |
| 5. Accept PoC criteria and evaluation results | Business owner | Technical owner, domain users, compliance and security | Golden set, thresholds, results, limitations and remediation plan | Sponsor / committee | Before production decision |
| 6. Make the production decision | Sponsor / committee | Owners, security, compliance and legal | Evidence Pack, open risks, rollback plan and monitoring | Higher decision authority | Before production release |
| 7. Approve a material change, stop or retirement | Business owner | Technology, data owner, security, compliance and legal | Change impact, incidents, evaluations and migration plan | Sponsor / committee | At change threshold or incident |
Allowed decision outcomes: GO · GO WITH CONDITIONS · STOP. Record conditions, remediation owner and due date in the Evidence Pack.