IT Decision Rights Matrix

The idea behind it

A federated IT model splits technology work between a central IT function and the IT teams inside business units. It sits between a fully centralized model, where one team decides everything, and a decentralized one, where each unit runs its own technology. The model only works if everyone knows which decisions belong where. Peter Weill and Jeanne Ross, in their research on IT governance at MIT, framed governance as the allocation of decision rights and accountability, not as a set of committees.

A RACI matrix records that allocation. For each decision it names who is Responsible for the work, who is Accountable for the final call, who is Consulted before it and who is Informed after. Only one party should hold the A for each decision. Matrices cannot list every decision, so the subsidiarity principle covers the rest. Subsidiarity holds that a decision should be made at the lowest level with the information and accountability to make it well. The principle comes from Catholic social teaching and was written into European Union law by the Maastricht Treaty. In IT it means that decisions affecting one unit stay with that unit, while decisions that create enterprise-wide risk if made inconsistently, such as identity or security policy, go to the center.

What's inside

• Instructions for assigning RACI roles and reading the decision owner column.
• Five decision areas: identity and access, data and residency, tooling, security, and architecture, with five decisions in each.
• For each decision: one RACI letter each for central IT, BU IT, the BU business and legal or risk, the decision owner (the party holding the A), the subsidiarity test result (Central or BU) and a one-line rationale.
• A subsidiarity test of six questions for deciding where an ambiguous decision belongs.
• The Excel version puts the matrix and the subsidiarity test on separate sheets, fills in the decision owner from the A, and highlights any row without exactly one A.

Format: PDF (3 pages) and Excel workbook.

A look inside

Pages 1 and 2 of 3 of the PDF. Select an image to enlarge it.

Who uses it

• CIOs running a federated or hybrid IT model, to settle recurring arguments about who owns a decision.
• Business unit IT leads, to know which choices they can make alone and which need central input.
• Enterprise architects and governance offices, to set guardrails and know where they apply.
• Legal, risk and compliance teams, to see where they must be consulted before an IT decision is made.

When to use it

• A merger or acquisition brings in a business unit with its own IT team.
• A business unit buys a SaaS tool and central IT finds out at renewal.
• Two teams both believe they own the same decision, such as cloud region or data model.
• The organization is moving from a centralized to a federated operating model, or back.
• An audit finds no clear owner for access, data retention or security exception decisions.

How to use it

Start from the filled-in defaults, change the rows that do not match your model, and use the subsidiarity test for decisions the matrix does not list.

1. Read the RACI definitions at the top of the Decision Rights Matrix sheet: R does the work, A makes the final decision, C gives input before, I is told after.
2. Review the 25 pre-filled decisions across the five areas and the decision owner and rationale given for each.
3. Change the RACI entries for any row that does not match how your organization works, using the dropdowns in the Excel version. The Decision Owner column follows the A, and a row without exactly one A is highlighted.
4. Record the outcome in the Subsidiarity Test Result column as Central or BU, and note any agreed exception in the Notes / Exceptions column.
5. Add rows for decisions specific to your organization in the relevant area.
6. For any decision that is disputed or missing, work through the six questions on the Subsidiarity Test sheet and record the answer in the matrix.
7. Have central IT and each business unit IT lead approve the finished matrix, and publish it where both can find it.

You leave with: A matrix that names one accountable owner for each common IT decision, with the reasoning written down, and a test for placing new decisions consistently.

Where it goes wrong

• Giving the A to more than one party, so the decision has no single owner.
• Sending every decision to the center, which slows business units and pushes them toward shadow IT.
• Leaving Legal and Risk off decisions with a regulatory driver, such as data residency.
• Agreeing the matrix once and never revisiting it after reorganizations.

Get the decision-rights matrix

It is free. Enter your work email and we send the download link.

Questions

Read more on this

• Digital Transformation Governance: Steering Committees, PMOs, and Decision Rights
• Data Governance at Scale: Building a Federated Governance Operating Model