SOC 2 CC1.3: COSO Principle 3: Management Establishes Structures, Reporting Lines, and Authorities

Create and maintain a current organisational chart showing the reporting structure from the board down through operational levels. Clearly identify key security and IT roles - CISO (or equivalent), IT management, compliance officers, and data owners.

Write detailed role descriptions for all positions with security-relevant responsibilities. Each should specify authority level, decision-making scope, and reporting relationships. Pay close attention to roles involving access to sensitive systems, data classification decisions, and incident response.

Build a delegation of authority matrix documenting who can approve key decisions: system changes, access grants, vendor engagements, security exceptions. Include escalation thresholds and backup authorities for when primary decision-makers are unavailable.

Implement a separation of duties policy that identifies incompatible functions and ensures no single person can both authorise and execute critical transactions. For smaller organisations where strict separation isn't practical, document compensating controls like management reviews or audit logging.

Set up formal reporting lines for security and risk management. The CISO or equivalent should report directly to senior management and ideally have access to the board or audit committee. This ensures security concerns can be escalated without being filtered by operational management.

Document the information flow for security-relevant events - how incidents are reported upward, how policy changes are communicated downward, and how cross-functional coordination works. Review and update the organisational structure at least annually or whenever significant changes occur.