Failure To Assign Clear Owners For Actions - The Accountability Gap

This is the failure that regulators call "Nobody owns the outcome". An action item, risk, or control is created, assigned to a committee, a department, or "jointly", and dies because no single named human is Accountable for completion with deadline and escalation.

Organisations routinely treat responsibility and accountability as interchangeable, assigning the latter to committees, shared functions, or cross-departmental working groups that have defined roles but no singular authority to act.

RACI transforms process maps from activity charts into governance tools. When RACI is layered, each step becomes owned and each control becomes enforceable. Each control step had a named owner, deadline and escalation path.

RACI is useful: Responsible (does work), Accountable (owns outcome), Consulted, Informed. It has two common failure modes. Teams confuse Responsible with Accountable, assigning both to a team rather than a person, which dissolves accountability.

1. What Does Failure Look Like?

• Minutes: "Action: Risk and Ops to look into limit breach" - No name, no date.
• Committee Ownership: Counterparty Oversight Committee [CPOC] at Credit Suisse owns Archegos risk - meaning nobody owns it.
• Two Owners = No Owner: "John and Sarah accountable for collateral threshold update" - ServiceNow principle: Two names in accountable slot is same as none.
• Consulted Overload: 10 people in Consulted, decision never made.

2. Why It's a Regulatory Offence

Under UK Senior Managers & Certification Regime [SM&CR]:

Every holder of a senior management function has a duty of responsibility, and can be held accountable if they did not take reasonable steps to prevent or stop a breach in their area.

There is a statutory duty of responsibility on senior managers under which they are accountable if they fail to take reasonable steps [including proper training and oversight] to prevent regulatory breaches.

For the first time, senior managers are criminally responsible for their reckless decision making, or their reckless failure to monitor decisions taken by others, which cause a financial institution to fail - Section 36 Financial Services Act.

Under Delaware law - Caremark duty: Board must establish reporting system and monitor mission-critical risks. Failure = breach of loyalty.

3. Case Laws and Enforcement

Case A: Adesokan v Sainsbury's Supermarkets Ltd [2017] EWCA Civ 22

Regional Operations Manager responsible for 20 stores, 26 years service.

Issue: Head Office sent email requiring Talkback Procedure implementation. Stores did not comply, created compliance risk.

Adesokan failed to take active steps to remedy, assumed HR/Store Managers owned it.

High Court and Court of Appeal: Failure to take active steps to remedy situation did amount to gross misconduct amounting to gross negligence which was tantamount to gross misconduct and A was summarily dismissed. A was responsible for ensuring successful implementation.

Principle: If you are Accountable, you cannot delegate accountability by assuming someone else will do it. You must own outcome. Silence = negligence.

Case B: In re The Boeing Company Derivative Litigation - 2021 WL 4059934, Del. Ch. Sept 7, 2021

Two 737 MAX crashes Oct 2018, March 2019 - 346 deaths.

Shareholders sued board under Caremark: Directors breached oversight duty by insulating themselves from safety problems and ignoring red flag warnings.

Court findings:

Delaware Court of Chancery ruled Boeing directors must face shareholder charges that they breached oversight duty by insulating themselves from safety problems with new 737 MAX and ignoring red flag warnings of deadly stability defects

Board settled Caremark claim for $225 Million and later $237.5 Million - alleging Board breached fiduciary duties of oversight and monitoring of mission-critical airplane safety

Why failure to assign owner mattered:

• No board committee was assigned safety ownership. Audit Committee focused on financial risk, not engineering safety.
• MCAS system changes: Engineering owned design, but no single owner assigned for safety assessment action after Lion Air crash. FAA communication owned by no one.
• Court: Plaintiffs adequately pled board failed to establish needed reporting system and turned blind eye to safety concerns.

Principle: For mission-critical risk, board must assign clear owner and reporting line. Committee with no safety expertise ≠ ownership.

Case C: Wyelands Bank - PRA Fine £118,808 on CEO - 2023 & Sonali Bank UK - FCA £76,400

PRA fined former CEO for various regulatory breaches, including that he failed to take reasonable steps to ensure business for which he was responsible was controlled effectively

FCA published Decision Notice imposing fine of £76,400 on former CEO of Sonali Bank for acting without due skill, care and diligence and for being knowingly concerned in breach by SBUK of its obligations to maintain effective AML systems

CEO claimed AML owned by MLRO. Regulator: As SMF1, CEO is ultimately accountable owner for ensuring effective AML control, even if day-to-day responsible is MLRO. Failure to assign clear action owner for AML remediation was reasonable steps failure.

Only third enforcement action concluded successfully against senior manager for breaching Individual Conduct Rules.

Case D: Wells Fargo - OCC AA-EC-2016-66

Sales practices failure - Who owned sales misconduct risk?

• Community Bank owned sales targets
• Risk function owned oversight
• Neither owned combined outcome of "sales practices within risk appetite"

Result: OCC found deficiencies and unsafe or unsound practices in risk management and oversight of sales practices. Board had no single accountable owner for sales conduct risk until 2016 consent order forced creation of Sales Practices Oversight owner.

Case E: Credit Suisse / Archegos - CPOC Ghost Committee

Internal report noted recurring ghostly character is CPOC, the Counterparty Oversight Committee, a fancy committee that...

Credit Suisse determined Archegos was overleveraged, called for more collateral, Archegos said "can we talk later?" and that was that. No single named owner was assigned action "Force margin call / liquidate" with deadline. Action remained open 10 days until $5.5bn loss.

4. How to Fix - Enforceable Ownership Standard

Single Name Rule: Every action must have ONE Accountable person - format: Name, not function. RACI matrix: Accountable slot = single person.

SMART + RACI: Action = Verb + Outcome + Owner + Deadline + Escalation Path. Example: " Sarah Khan to reduce CSA threshold from $10m to $2m for Counterparty X and update Murex by 5pm 5-Nov-26, escalate to CRO if legal refuses."

Statement of Responsibilities: For SM&CR firms, map every critical risk to SMF holder.

Minutes Test: Board minutes must record: Who raised red flag, Who owns mitigation, When due.