# Roles And Responsibilities Policy - Source: https://support.icompaas.com/compliance/policy-docs/roles-and-responsibilities-policy - Section: [Compliance](https://support.icompaas.com/compliance) › [Policy Documents](https://support.icompaas.com/compliance/policy-docs) › All policy documents - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Policy Document**·18 mapped controls ## What this policy is Documents who is responsible, accountable, consulted and informed (RACI) for each major function of the security and privacy programmes. ## Why every organization needs one Ambiguous ownership is the root cause of dropped controls. The policy turns 'someone should…' into 'X owns this; Y consults; Z is informed'. ## What a competent Roles And Responsibilities Policy typically contains - Purpose and scope - Roles and responsibilities - Definitions - RACI matrix for security functions - Authority delegation - Segregation-of-duties for sensitive functions - Backup / alternate for each role - Review cadence (typically annual) and version control - Approval, sign-off and effective date ## How iCompaas tracks this policy The icompaas policy-doc producer manages this document through an 8-state lifecycle: `draft` → `generated` → `internal_qa` → `customer_review` → `in_review` → `approved` → `signed` (with `rejected` as a terminal side-state). The producer publishes a `policy_doc_roles_and_responsibilities_policy_signed` compliance finding once at least one document of this kind reaches the `signed` state for the account being assessed; the finding then rolls up into every compliance framework that references this policy (see the table below). ## Compliance frameworks that reference this policy The icompaas [compliance controls library](https://support.icompaas.com/compliance) links every policy document to the controls in each framework that require, evidence, or otherwise rely on it. Below: every control across every framework in the iCompaas catalogue that names this policy as part of its evidence base. Each control links to its own dedicated page with auditor-view content + implementation guidance. | Framework | Control | Title | Component | | --- | --- | --- | --- | | ISO/IEC 27001:2022 | [A.5.2](https://support.icompaas.com/compliance/iso-27001-2022/a-5-2-information-security-roles-and-responsibilities) | [Information security roles and responsibilities](https://support.icompaas.com/compliance/iso-27001-2022/a-5-2-information-security-roles-and-responsibilities) | Organizational controls | | ISO/IEC 27001:2022 | [A.5.3](https://support.icompaas.com/compliance/iso-27001-2022/a-5-3-segregation-of-duties) | [Segregation of duties](https://support.icompaas.com/compliance/iso-27001-2022/a-5-3-segregation-of-duties) | Organizational controls | | ISO/IEC 27701:2025 | [A.1.2.8](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-8-joint-pii-controller) | [Joint PII controller](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-8-joint-pii-controller) | Conditions for collection and processing | | ISO/IEC 27701:2025 | [A.1.5.5](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-5-records-of-disclosures) | [Records of disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-1-5-5-records-of-disclosures) | PII sharing, transfer & disclosure | | ISO/IEC 27701:2025 | [A.2.3.2](https://support.icompaas.com/compliance/iso-27701-2025/a-2-3-2-comply-with-obligations) | [Comply with obligations](https://support.icompaas.com/compliance/iso-27701-2025/a-2-3-2-comply-with-obligations) | Obligations to PII principals (processors) | | ISO/IEC 27701:2025 | [A.2.5.4](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-4-records-of-pii-disclosures) | [Records of PII disclosures](https://support.icompaas.com/compliance/iso-27701-2025/a-2-5-4-records-of-pii-disclosures) | PII sharing, transfer & disclosure (processors) | | ISO/IEC 27701:2025 | [A.3.4](https://support.icompaas.com/compliance/iso-27701-2025/a-3-4-information-security-roles-responsibilities) | [Information security roles & responsibilities](https://support.icompaas.com/compliance/iso-27701-2025/a-3-4-information-security-roles-responsibilities) | Security considerations | | ISO/IEC 27701:2025 | [A.3.11](https://support.icompaas.com/compliance/iso-27701-2025/a-3-11-incident-management-planning) | [Incident management planning](https://support.icompaas.com/compliance/iso-27701-2025/a-3-11-incident-management-planning) | Security considerations | | ISO/IEC 27701:2025 | [A.3.16](https://support.icompaas.com/compliance/iso-27701-2025/a-3-16-compliance-with-policies) | [Compliance with policies](https://support.icompaas.com/compliance/iso-27701-2025/a-3-16-compliance-with-policies) | Security considerations | | ISO/IEC 42001:2023 | [A.2.3](https://support.icompaas.com/compliance/iso-42001-2023/a-2-3-alignment-with-other-organizational-policies) | [Alignment with other organizational policies](https://support.icompaas.com/compliance/iso-42001-2023/a-2-3-alignment-with-other-organizational-policies) | Organizational controls | | ISO/IEC 42001:2023 | [A.3.2](https://support.icompaas.com/compliance/iso-42001-2023/a-3-2-ai-roles-and-responsibilities) | [AI roles and responsibilities](https://support.icompaas.com/compliance/iso-42001-2023/a-3-2-ai-roles-and-responsibilities) | Organizational controls | | ISO/IEC 42001:2023 | [A.4.6](https://support.icompaas.com/compliance/iso-42001-2023/a-4-6-human-resources) | [Human resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-6-human-resources) | Organizational controls | | ISO/IEC 42001:2023 | [A.6.1.2](https://support.icompaas.com/compliance/iso-42001-2023/a-6-1-2-objectives-for-responsible-development-of-ai-systems) | [Objectives for responsible development of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-6-1-2-objectives-for-responsible-development-of-ai-systems) | Technological controls | | ISO/IEC 42001:2023 | [A.6.2.6](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-6-data-provenance) | [Data provenance](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-6-data-provenance) | Technological controls | | ISO/IEC 42001:2023 | [A.7.5](https://support.icompaas.com/compliance/iso-42001-2023/a-7-5-data-provenance) | [Data provenance](https://support.icompaas.com/compliance/iso-42001-2023/a-7-5-data-provenance) | Technological controls | | ISO/IEC 42001:2023 | [A.9.3](https://support.icompaas.com/compliance/iso-42001-2023/a-9-3-objectives-for-responsible-use-of-ai-systems) | [Objectives for responsible use of AI systems](https://support.icompaas.com/compliance/iso-42001-2023/a-9-3-objectives-for-responsible-use-of-ai-systems) | Organizational controls | | ISO/IEC 42001:2023 | [A.10.2](https://support.icompaas.com/compliance/iso-42001-2023/a-10-2-allocation-of-responsibilities) | [Allocation of responsibilities](https://support.icompaas.com/compliance/iso-42001-2023/a-10-2-allocation-of-responsibilities) | Organizational controls | | ISO/IEC 42001:2023 | [A.10.4](https://support.icompaas.com/compliance/iso-42001-2023/a-10-4-customers) | [Customers](https://support.icompaas.com/compliance/iso-42001-2023/a-10-4-customers) | Organizational controls | 18 controls across 3 frameworks reference this policy. ## About this page This article is part of the iCompaas [Policy Documents](https://support.icompaas.com/compliance/policy-docs) library — one page per signed-document type the icompaas policy-doc producer tracks for customer accounts. The article is intentionally framework-agnostic: a customer signing a policy of this kind gets the same regulatory benefit across every framework that references it. ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): SOC 2 auditors test that policies like this one exist, are approved, and are reviewed on schedule; the guide lists the full set. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 clause 5.2 and Annex A.5.1 require a documented, approved policy set; the guide shows how it fits the ISMS.