Roles and Responsibilities

The guidance is designed to make the chain of responsibility visible in audits involving several persons, bodies, suppliers, or technical systems. It prevents titles, software, procedures, or collective wording from replacing identifiable actions and decisions.

It does not require every audit to have a large organisational structure. A simple or independent audit may be conducted by one person, but that person must identify which roles are combined, which limitations result, and which external control may be required.

Clarifying roles and responsibility requires person, office, task, and authority not to be used as synonyms. The same person may hold several functions, and the same title may carry different mandates in different matters.

Every formal audit should document who initiated it, who set the mandate, who finances or facilitates the work, who audits, who reviews quality, who makes any decisions, and who implements and verifies correction.

A role must not be inferred only from a job title. A manager is not automatically an expert auditor, data steward, impartial reviewer, legal decision-maker, or publication officer.

The roles below are functions. They do not always require separate offices or persons, but every function that is actually present in the matter must be identifiable.

The matrix below must be adapted to the particular audit. It is a control instrument, not a requirement that every field be filled by a different person.

The same person may hold several roles, especially in small organisations or independent audits. The combination is not automatically defective, but it must be assessed for concentration of power, impartiality, competence, self-review, and effects on the affected party.

The greater the potential harm, irreversibility, or public effect, the stronger the case for organisational separation or independent control.

In some matters, combining roles may be practically or in principle incompatible with a responsible audit. The audited actor should not alone decide the audit. The original decision-maker should not be the sole reviewer of the appeal. An actor with a substantial financial interest should not alone provide quality assurance.

Incompatibility must be assessed concretely. This document creates no universal legal rule of impartiality; applicable law and professional standards must be identified.

The chain of responsibility must show who initiated, bounded, collected, interpreted, reviewed, decided, implemented, and controlled. Passive and collective formulations must be traced back to identifiable actions.

An expert opinion may carry substantial weight without being binding. The audit must show what constitutes information, professional advice, recommendation, approval, formal decision, implementation, and control.

The decision-maker must show which assessment was independent, which material was relied upon, and how advice was used or departed from.

A signature or digital approval must not automatically be taken to mean that the person wrote the whole document, reviewed every source, endorsed every assessment, or approved public release.

The approval function should be specified, for example: substantively reviewed, methodologically reviewed, legally assessed, administratively approved, approved for publication, or decided within the stated mandate.

Central roles must be assessed for financial interests, personal relationships, organisational ties, earlier participation, prior public positions, outcome-dependent remuneration, and dependence on the commissioning body.

A conflict does not always require automatic withdrawal. Measures may include disclosure, a bounded role, a co-auditor, independent review, a separate decision-maker, or withdrawal.

The role must correspond to actual competence. Methodological, professional, legal, technical, experiential, and decision competence must not be inferred automatically from a single title.

In high-risk domains, the competence boundary and need for external professional or legal assessment must be stated expressly.

A directly affected party should, where relevant and responsible, be told what claim the matter concerns, which material is material, what time limit applies, and how the response was assessed.

Adversarial participation is not a veto. It must not be used to pressure sources, disclose personal data without grounds, or delay the audit indefinitely.

Substantive responsibility for an internal assessment is not automatically authority to publish it. Before release, it must be clear who owns the document, who may approve publication, who assessed privacy and harm, and who may correct, replace, or unpublish it.

The publication officer must distinguish public interest from curiosity, and the audit's documentation needs from authority to make the same material public.

Software and artificial intelligence may serve as recording tools, search tools, analytical assistance, classifiers, text generators, models, or decision support. Technical systems cannot stand as the finally responsible actor.

The record must show who selected the system, controlled inputs, assessed the output, could override it, made the decision, and corrects error. ‘The AI decided’ is not a complete account of responsibility.

The guidance must work without a large administration. Where one person performs several functions, the roles must be named separately, the combination declared, competence boundaries made visible, sources preserved, and counter-material actively sought.

External review should be used where potential harm, public release, irreversibility, or limited organisational independence makes self-review insufficient.

The failure modes below are objects of audit, not automatic findings. They require concrete documentation of role, action, effect, and resistance to correction.

Role clarification can itself become bureaucratic, symbolic, or protective of power. The objections below must therefore be used to examine the guidance itself, not only the audit at hand.

The guidance should be used with R7.1 for mandate and scope, R7.7 for participation, decision, and revision, and R7.8 for publication, privacy, and safeguards. The roles and responsibility matrix may be maintained in the audit record and updated when persons, mandates, or decision paths change.

A new content version is required if roles, mandatory fields, the chain of responsibility, impartiality requirements, or decision logic are substantively altered. Pure design, print, link, or accessibility changes do not trigger a new content version.