A founder I spoke with recently had done the right thing on paper. They had named their operations manager as the person accountable for GDPR compliance, written it in the handbook, and told the team. Then a major client asked the firm to share a dataset that almost certainly included personal data it had not been authorised to transfer. The operations manager said no. The founder, not wanting to lose the contract, said yes. The accountability statement became meaningless in about forty seconds.
The decision right had never moved.
What are decision rights and accountability?
Decision rights and accountability are two distinct governance concepts that work as a pair. Decision rights define who has the authority to make a specific category of decision: pricing, contracts, AI tool adoption. Accountability defines who has to answer for the result and demonstrate they acted reasonably. Keeping these two concepts clearly separate is what makes delegation actually stick in a small firm.
Consultancies such as Burnie Group describe decision rights using frameworks like RACI (Responsible, Accountable, Consulted, Informed), which clarify who holds standing authority for each significant call and who needs to be looped in. The UK Information Commissioner’s Office offers the clearest definition of accountability for a domestic audience: the need to demonstrate compliance with data protection law, not just comply in theory.
That demonstration piece is the part founders tend to underestimate. Accountability is a paper trail as much as a mindset. You need to be able to show, if asked, how a decision was made, by whom, and on what basis.
For a 5 to 50 person services firm, the practical version looks like this:
- Decision rights: who can say yes or no to a given category of choice, covering discounts, new hires, client onboarding, data governance, and AI tool use.
- Accountability: who can produce the reasoning, records, or documentation if a client or regulator later asks why a decision went the way it did.
One without the other creates problems. Accountability without authority produces a team member who is answerable in theory but cannot act without the founder’s sign-off. Authority without accountability produces drift, where people make consequential calls with no obligation to document or answer for them.
Why does the pairing matter for your business?
The pairing matters because you can appoint accountability without giving someone the authority to act. In founder-led firms, this is the typical failure: the team member is answerable in theory but overruled in practice. The FCA built its Senior Managers and Certification Regime precisely to close this gap, requiring named individuals to hold both the responsibility and the genuine authority to discharge it.
Financial services firms regulated by the FCA have worked through this since SM&CR was extended to all FCA-regulated firms in 2019. Under the regime, each prescribed senior management function must be mapped to a named individual who takes on a statutory duty of responsibility under the Bank of England and Financial Services Act 2016. Industry interviews published by Oxford Law Blogs in 2024 found that the regime led to more conscientious decision-making and clearer documentation of processes. The researchers noted this happened not primarily through fear of enforcement, but because people finally understood what they were genuinely responsible for.
You do not need to be regulated to learn from this. The same logic applies at the owner-managed level. If you name someone as accountable for a business area but continue to override their decisions, you have created accountability in name only. The result is a team member who cannot act with confidence and a founder who has built the appearance of delegation without the substance.
Where will you actually encounter this in a UK services firm?
For a UK services firm of 5 to 50 people, you will encounter this most sharply in three areas: data protection under UK GDPR, regulated activities covered by the FCA or SRA, and decisions about AI tools that touch client information. Each of these areas has a regulator that will ask you to name a person who is both authorised to act and answerable for the outcome.
Under UK GDPR, the ICO’s accountability framework expects organisations to assign senior responsibility for data protection, document how decisions are made, and embed governance into everyday processes. That means someone in your firm must be able to show which decisions they own, how they made them, and what records they kept.
For FCA-regulated firms, SM&CR formalises this through statements of responsibilities and a responsibilities map. For solicitors’ practices, the SRA applies a risk-based approach that expects authorised decision-makers under a published schedule of delegation. That is, at its core, a decision rights map with accountability attached.
AI adoption is bringing this into focus for firms that had no prior regulatory exposure. The UK government’s Ethics, Transparency and Accountability Framework for Automated Decision-Making recommends that any organisation using AI to support decisions identifies a senior responsible owner, assesses impacts and risks, and ensures appropriate human oversight is in place. The NCSC’s guidance for boards reinforces the same point for cyber risk: the board should own it, which means knowing who makes security decisions and who answers for them.
For firms serving clients in the EU, the AI Act adds a further layer. High-risk AI systems require defined accountability, risk management documentation, and human oversight. Even for lower-risk use cases, the direction of travel is clear: regulators across the UK and Europe expect someone to be explicitly responsible and able to produce evidence of it.
When does this need to be formal, and when can you keep it light?
The level of formality you need depends on what you do and the size of the decisions at stake. If your firm is FCA-regulated, formally documented statements of responsibility are not optional. If you run a 10-person consulting firm with no direct regulatory obligations, a one-page decision table and a clear conversation with your team is usually enough to get the benefit without the bureaucratic overhead.
Research on SM&CR surfaces a useful caution: increased documentation can create administrative burden without improving culture if it is disconnected from how people actually work. For small teams, over-engineering a governance structure produces documents nobody reads and a founder who ends up overriding them anyway.
A lighter approach that still delivers the benefits: list 15 to 20 recurring, significant decisions across pricing, contracts, staff, data, and technology. Name one role as accountable for each. Set a clear threshold above which the decision escalates to the founder. Write it on a single page and share it with the team. This gives your people clarity, gives you confidence that outcomes can be traced, and satisfies the basic standard the ICO expects.
Where the stakes are higher, or where a regulator will inspect your governance arrangements, you need more: brief notes on how high-risk decisions were made, records of who approved new suppliers or AI tools, and a culture where significant calls are documented at the moment they are made. This does not mean committees and approval chains. It means brief, consistent record-keeping at the decisions that matter.
What should you read alongside this?
Decision rights and accountability do not sit in isolation. They work best when paired with a decision rights framework that maps the full picture across your firm (a companion post on this site covers what a decision rights framework is and how to build one for a small business), clear role descriptions, and a documentation habit that lets your team demonstrate their reasoning when a client or regulator asks.
A RACI matrix is a useful complement: it clarifies who is Responsible, Accountable, Consulted, and Informed on specific tasks and projects. The decision rights framework handles who has standing authority for recurring decisions; RACI handles how those decisions get executed day to day.
One question worth putting to your leadership group: can each person in a senior role clearly name which decisions they own, and what they would do if they were uncertain? If the honest answer is that they would ask the founder, the structure is not yet working. A half-day spent building a decision rights and accountability map with your senior team is often the most practical starting point. The ICO’s accountability guidance and the FCA’s statements-of-responsibility approach both give you a clear template to adapt, even if you are not directly regulated by either body.
