Why Use a Governance Responsibility Matrix?
A committee charter or delegated-authority schedule can establish who has authority in general, yet still leave uncertainty about a particular process. For example, a business leader may own a risk, an actuary may assess its financial effect, and a risk function may monitor exposure. Without an activity-level assignment, it may be unclear who makes the decision, who carries it out, who must be consulted, and who provides assurance.
A governance responsibility matrix makes those assignments visible. It does not replace the approval limits and delegated authorities established by governance documents. Instead, it translates them into responsibility assignments for defined activities. A useful matrix describes the work at a sufficiently specific level and shows how the business, actuarial, risk, compliance, and internal audit functions participate.
Four Duties, Kept Distinct
Use the matrix to answer four different questions. A person or function can have more than one duty in a process, but each assignment should be made for a clearly stated activity and should be consistent with the organization’s governance arrangements.
- Decision (D): Who has the authority to make or approve the specified decision? The decision authority must be identified by reference to the applicable delegation or reserved authority.
- Execution (E): Who performs the approved work, such as preparing an analysis, implementing a control, or placing a transaction? Execution does not, by itself, confer approval authority.
- Consultation (C): Whose input must be sought before the decision or action? Consultation supports the decision-maker but does not transfer the decision right.
- Assurance (A): Who assesses whether governance, controls, or processes are suitably designed or operating as intended? The matrix should state the scope of the assurance assignment and preserve the independence required for that work.
In a typical arrangement, business leaders own and manage risks in their activities; actuarial, risk, and compliance functions provide specialist work, oversight, or monitoring within their mandates; and internal audit provides independent assurance. These descriptions are not interchangeable. For example, a risk function’s monitoring does not make it the owner of a business decision, and internal audit should not be assigned to operate a control that it may later audit.
For compact examples below, the columns are Business, Actuarial, Risk, Compliance, and Internal Audit. “—” means no assigned duty for that activity. The matrix code should always be accompanied by a scope description when the assignment might otherwise be ambiguous.
Building the Matrix in a Defensible Order
Start with activities, not job titles. A row such as “manage product risk” is too broad to show who approves a product, who validates a model, or who monitors results. Split a process into decisions and supporting work where the responsible functions or authorities differ. Then assign the duties and check that they fit established governance.
Write a specific action or decision, such as “approve a change to the reserving methodology,” rather than a broad label such as “reserving.”
Use the relevant charter, delegation, or reserved-decision rule. Do not infer authority merely from technical expertise or involvement in preparing the work.
Identify who carries out the work and whose input must be obtained. State what is being executed or consulted on, especially when several functions contribute.
Specify the subject and timing of assurance. Do not make an assurance function responsible for operating the activity it is expected to assess independently.
Check for unassigned decisions, conflicting authority, unclear execution, missing specialist input, and assurance that is not independent. Record assumptions or boundaries that affect the assignment.
A Simple Consistency Test
For an activity that requires one decision under the applicable governance arrangement, let \(n_D\) be the number of decision-authority assignments in its matrix row. A complete assignment ordinarily requires \(n_D=1\). This is a diagnostic for the defined decision, not a rule that an entire process can contain only one decision-maker. If the process contains separate decisions—for example, technical approval and commercial approval—give each a separate row or otherwise define each decision explicitly.
Why is this useful? If \(n_D=0\), the matrix does not identify who can make the decision. If \(n_D>1\) for a single decision, it may be unclear whether either authority can approve, whether both must agree, or whether their authority applies to different aspects. Splitting genuinely distinct decisions into separate activities resolves the ambiguity; assigning two decision-makers to one undefined decision does not.
There is no equally simple requirement that every row contain exactly one executor, consultant, or assurance function. Several functions may execute different parts of the work or provide necessary consultation. The matrix must nevertheless clarify their respective scopes and avoid implying that advice or assurance is a substitute for the authorized decision.
Worked Example: Approving a Hypothetical Reinsurance Renewal
A hypothetical insurer plans to renew a catastrophe reinsurance contract. The renewal is within the business leader’s documented approval authority. The business team negotiates and places the contract; actuarial staff estimate its effect on modeled losses; the risk function assesses the effect on the insurer’s risk profile; compliance reviews relevant contractual and regulatory requirements; internal audit provides independent assurance over the renewal control process after the event. Build assignments for the renewal decision and the supporting work.
Method. Separate the approval decision from the analysis, placement, compliance review, and assurance. Confirm that the stated business authority is the authorized decision-maker for this renewal; do not treat the functions contributing analysis as co-approvers.
| Activity | Business | Actuarial | Risk | Compliance | Internal Audit |
|---|---|---|---|---|---|
| Approve renewal within documented authority | D | C | C | C | — |
| Prepare loss and coverage analysis | E | E | C | — | — |
| Negotiate and place approved contract | E | C | — | C | — |
| Review renewal control process independently | — | — | — | — | A |
Step 1: Identify the decision. The row “Approve renewal within documented authority” has one D, assigned to Business. Therefore \(n_D=1\). Actuarial, Risk, and Compliance are consulted on defined aspects, but their input does not turn them into additional decision authorities.
Step 2: Assign execution. Business executes the placement. Business and Actuarial prepare the analysis, with their separate contributions made clear in the process documentation. The matrix could be made more detailed by splitting that row into “prepare loss estimate” and “compare contract options” if those are managed as distinct activities.
Step 3: Preserve assurance independence. Internal Audit is assigned independent review of the control process, not negotiation, selection, or placement. This avoids making Audit responsible for work it is later expected to assess.
Check. The renewal decision has one decision authority, the placement has an identified executing function, and the assurance assignment is separate from operating the renewal. The common mistake avoided is giving Actuarial or Risk a D merely because its analysis is important to the decision.
Worked Examples: Different Activities, Different Assignments
Worked Example: Governance for a Hypothetical New Product
A hypothetical insurer is considering a small commercial property product. Under its documented delegation, the business leader approves the product launch within stated limits. Actuarial staff develop and test the pricing basis; Risk assesses the effect on aggregate exposure; Compliance reviews applicable product and conduct requirements; Business implements the approved product. Internal Audit is assigned an independent review of launch controls after implementation. Construct a matrix that keeps product approval separate from technical work and launch implementation.
Method. Define distinct rows for launch approval, pricing work, implementation, and independent control review. Assign each decision based on the given delegation, then assign the execution, consultation, and assurance roles.
| Activity | Business | Actuarial | Risk | Compliance | Internal Audit |
|---|---|---|---|---|---|
| Approve launch within delegated limits | D | C | C | C | — |
| Develop and test pricing basis | C | E | C | C | — |
| Implement approved product and controls | E | C | C | C | — |
| Review launch controls independently | — | — | — | — | A |
Step 1: Check launch authority. The launch-approval row has one D: Business. The stated delegation is the basis for that assignment; technical contribution alone does not authorize Actuarial to approve the commercial launch.
Step 2: Separate technical work from launch. Actuarial executes development and testing of the pricing basis. Business executes implementation after approval. Consultation of Risk and Compliance is shown on the relevant rows, so those functions’ input is not confused with operational execution.
Step 3: Check assurance. Internal Audit assesses launch controls independently rather than designing or implementing them. The review’s scope is controls, not a retrospective substitution for the business decision.
Check. Each decision row has one authorized decision-maker; other functions’ roles are visible without implying co-approval. The common mistake avoided is assigning the product launch decision to Actuarial because actuarial pricing work is central to the product.
Worked Example: Changing a Hypothetical Reserving Methodology
A hypothetical insurer proposes changing a reserving methodology. The Chief Actuary has documented authority to approve technical reserving methodology changes. Actuarial staff analyze and implement the approved method. Risk is consulted about the effect on risk reporting, Compliance reviews relevant requirements, Business supplies claims information and uses the resulting reserve information, and Internal Audit independently reviews change controls. Assign the responsibilities while keeping technical approval distinct from implementation and assurance.
Method. Treat approval of the technical methodology as a specific decision and distinguish it from executing the change and reviewing the controls. Use the stipulated authority rather than assuming that the business owner or audit function is the decision-maker.
| Activity | Business | Actuarial | Risk | Compliance | Internal Audit |
|---|---|---|---|---|---|
| Approve technical methodology change | C | D | C | C | — |
| Analyze and implement approved methodology | C | E | C | C | — |
| Provide claims information and use reserve outputs | E | C | — | — | — |
| Review change controls independently | — | — | — | — | A |
Step 1: Locate the decision right. The Chief Actuary’s documented authority supports the single D in the technical approval row. Business is consulted, but its provision of claims information and use of the output do not make it the technical approver.
Step 2: Distinguish approval from implementation. Actuarial executes the approved methodology change. Business executes its separate task of providing claims information and using reserve outputs. If the matrix is used operationally, the specific systems or deliverables should be named in the activity descriptions.
Step 3: Keep assurance separate. Internal Audit reviews the change controls without selecting or implementing the methodology. Its A assignment describes independent review, not technical approval.
Check. Technical decision authority, implementation, business inputs, and independent assurance are separately identifiable. The common mistake avoided is marking Actuarial as both the decision-maker and executor without distinguishing the two duties; in this case, the assignments are different rows and the authority is expressly defined.
Interpreting and Maintaining the Matrix
A completed matrix is useful only when its labels have stable meanings and its activities match actual governance. A letter in a cell is not self-explanatory if different readers interpret “consulted” as optional notification or “assurance” as approval. Document the meaning of each code, identify the role or level that holds the authority, and describe the scope of specialist input and assurance.
Check the matrix against charters, delegation schedules, and the established mandates of the functions. If a matrix appears to conflict with those documents, do not resolve the conflict by silently choosing a new owner. Clarify the activity and authority with the appropriate governance owners, then update the matrix and related documentation consistently.
Review assignments when responsibilities, processes, systems, or delegations change. A technically correct matrix can become misleading if a decision moves to a different authority but the row remains unchanged. Likewise, combining several activities into one row can hide that different decisions have different authorities or that an assurance role has become involved in operating a control.
Common Matrix Errors
- Confusing expertise with authority. A specialist may provide essential analysis or consultation without holding the decision right.
- Combining distinct decisions. Separate technical, commercial, and control decisions when they have different authorities; do not force them into one ambiguous row.
- Using “consulted” as a substitute for clarity. State whose input is required and what issue it addresses. Consultation does not automatically mean veto power.
- Assigning assurance over one’s own work. A function that operates or owns a control should not be presented as independent assurance over that same work.
- Treating the matrix as a source of authority. A matrix records assignments; it cannot override a charter, reserved decision, or delegation.
Check Your Understanding
For each hypothetical situation, identify the assignments or diagnosis requested. Use the stated authority; do not infer a decision right from expertise alone.
- A hypothetical insurer’s delegation authorizes its business leader to approve a small portfolio change. Actuarial prepares the loss analysis, Risk reviews concentration, and Compliance reviews relevant requirements. Who should receive D, and which functions are consulted? (Answer: Business receives D; Actuarial, Risk, and Compliance are consulted.)
- A hypothetical organization assigns Internal Audit to design and operate a control, then marks Internal Audit A for assurance over that control. What is the governance problem, and what should the matrix distinguish? (Answer: Independence is impaired; assign control design and operation to an appropriate operating function, and reserve Internal Audit’s A for independent review.)
- A matrix has one row, “Approve and implement a model change,” with D assigned to Actuarial and D assigned to Business. The charter gives Actuarial authority for technical model approval, while Business has authority for operational adoption. How should the row be corrected? (Answer: Split it into technical model approval with Actuarial as D, and operational adoption with Business as D; assign execution and consultation separately.)
- A hypothetical insurer’s Compliance function reviews a proposed policy wording for regulatory requirements; the business leader has delegated authority to approve the product. Compliance is marked C, and Business is marked D. Is this assignment inconsistent, and why? (Answer: No; Compliance advises on requirements while Business holds the stated product decision authority.)
- A reserving change is approved by the authorized actuarial leader and implemented by Actuarial staff. The matrix also assigns Internal Audit to A for an independent review of the change controls, but does not say what Audit reviews. What clarification is needed? (Answer: Specify the control-review scope and keep Audit out of approval and implementation; the A assignment is assurance, not a second decision.)