Requirement
Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
Points of Focus
Considers All Structures of the Entity
Requirement: Management and the board of directors consider the multiple structures used (including operating units, legal entities, geographic distribution, and outsourced service providers) to support the achievement of objectives.
Establishes Reporting Lines
Requirement: Management designs and evaluates lines of reporting for each entity structure to enable execution of authorities and responsibilities and flow of information to manage the activities of the entity.
Defines, Assigns, and Limits Authorities and Responsibilities
Requirement: Management and the board of directors delegate authority, define responsibilities, and use appropriate processes and technology to assign responsibility and segregate duties as necessary at the various levels of the organization.
Addresses Specific Requirements When Defining Authorities and Responsibilities
Requirement: Management and the board of directors consider requirements relevant to security, availability, processing integrity, confidentiality, and privacy when defining authorities and responsibilities.
Considers Interactions With External Parties When Establishing Structures, Reporting Lines, Authorities, and Responsibilities
Requirement: Management and the board of directors consider the need for the entity to interact with and monitor the activities of external parties when establishing structures, reporting lines, authorities, and responsibilities.
[P] Establishes Structures, Reporting Lines, and Authorities to Support Compliance With Legal and Contractual Privacy Requirements
Requirement: When establishing structures, reporting lines, and authorities, management considers legal and contractual privacy requirements and objectives.
Explanation
Management must define who reports to whom, who is authorized to do what, and how duties are segregated across the organization, including outsourced providers and other external parties. Auditors care because unclear structures and authorities make it impossible to know who is responsible when controls fail or duties conflict.
