Four letters and one rule
R responsible does the work. A accountable owns the outcome and answers for it; exactly one per activity. C consulted contributes before the decision. I informed hears about it afterwards. The one rule that makes the matrix useful: a row with two A's is a dispute waiting to happen, a row with none is an orphaned activity. The template flags both automatically.
The thirteen activities
| Activity | Accountable | Responsible |
|---|---|---|
| Approve BCM policy and tolerances | Board | CEO |
| Business impact analysis | CEO | BCM manager, activity owners |
| Risk assessment and single points of failure | CEO | BCM manager, IT |
| Select continuity strategies and budget | CEO | BCM manager |
| Write and maintain continuity plans | BCM manager | Activity owners, IT |
| Supplier continuity requirements | Procurement | Procurement |
| Exercise programme | CEO | BCM manager, activity owners, IT, communications |
| Incident detection and escalation | BCM manager | Activity owners, IT |
| Crisis decisions | CEO | CEO, BCM manager |
| External communication and regulator notification | CEO | Communications |
| Post-incident review and corrective actions | CEO | BCM manager, activity owners, IT |
| Internal audit of the BCMS | Board | Internal audit |
| Annual management review | CEO | CEO, BCM manager |
Two placements provoke argument every time, and both are deliberate. The Board is accountable for the policy and for internal audit, nothing else: accountability for operations belongs to the executive. And the BCM manager is accountable for plans and escalation but responsible for almost nothing alone: the function coordinates, the owners deliver.
Download the template
Download the template. RACI sheet with 13 activities and nine roles, filled in as a starting point, and a check column that flags rows without exactly one accountable role. Xlsx.
Download xlsx (resilience-raci-matrix.xlsx)
Rename roles to match your structure; add activities for sector requirements such as CBUAE reporting. No registration, no forms. Need it adapted to your organisation or a full programme: see how we work.
Using the matrix
- Fill it in a one-hour workshop with the people named, not for them; disagreements in the room are the point.
- Attach it to the BCM policy as an appendix and to each role's job description as a line.
- Review it after every reorganisation and every incident where "it was not clear who should" appears in the review.
- Use it in the internal audit: the auditor samples three activities and asks the accountable person what they did last quarter.
Frequently asked questions
What is a RACI matrix in business continuity?
A table that assigns, for every activity of the business continuity management system, who is responsible for doing it, who is accountable for the outcome, who is consulted and who is informed. It replaces "management is responsible" with names and a single accountable role per activity.
Who should be accountable for business continuity?
The CEO or an equivalent top executive for the programme as a whole; the Board for the policy, tolerances and independent assurance; activity owners for their own plans. The BCM manager coordinates and is accountable for the method, not for every outcome.
How many roles should a RACI matrix have?
Seven to ten. Beyond that the sheet stops being readable in a meeting; group roles rather than list every department.
What is the difference between responsible and accountable?
Responsible does the work and can be several people; accountable owns the result, approves the work and answers for it, and must be one person per activity.