Who Owns the Duty Now? A Post-Restructure Control Map for UK Compliance
UK reorganisations rarely fail because the new structure is obviously wrong. They fail quietly, when a regulatory duty remains on the books but no current role carries it. A team is merged, a head of function leaves, a shared service absorbs a process, and the obligation register still points to a department that no longer exists. The result is an orphaned obligation: a duty that survives in policy, contract or law, but not in anyone's live accountability.
As of 12 November 2026, compliance teams are operating in an environment where cost pressure, technology change and role consolidation continue to reshape organisational charts. The control question is not whether the new structure looks sensible. It is whether every regulatory duty can still be traced to a named owner who can explain the trigger, produce the evidence and escalate the failure.
Why the risk is easy to miss
A duty is not a job title. It is a bundle of triggers, actions, records and deadlines. A restructure may leave the legal obligation unchanged while removing the role that understood when the obligation bit. Common examples include statutory returns, breach reporting, complaints handling, financial crime checks, outsourcing oversight, training attestations and regulatory correspondence. Each has a cadence and an evidence trail. If the cadence is lost, the obligation does not disappear; it simply becomes late, incomplete or invisible until a regulator, auditor or customer asks for proof.
The danger is compounded because restructures often produce reassuring artefacts: a new org chart, a revised intranet page, a handover note and a list of role descriptions. None of these proves that a duty has an owner. A handover note may record what the departing person did without transferring the authority, access or calendar reminders that made it happen. An intranet page may describe a process that no team now performs. A role description may mention regulatory oversight in general terms while omitting the specific return, notification or attestation that carries legal risk.
Scope the audit around duties, not departments
Start with the obligation register, but do not rely on it alone. Build a working list from multiple sources: statutory and regulatory requirements, licence conditions, returns calendars, policy attestations, contract schedules, audit actions, complaint logs, training records and access permissions. Include internal commitments that have become de facto regulatory controls, such as committee approvals, second-line reviews and outsourcing oversight meetings.
Group the list by duty rather than by team. A single team may hold twenty duties; a single duty may depend on three teams. The audit should identify the accountable owner, the operator and the evidence holder. These are not always the same person. The accountable owner answers for the duty at board or executive level. The operator performs the task. The evidence holder can produce the record on request. If any of the three is missing, the duty is not fully owned.
Trace each duty to a living owner
A living owner is a current named role and, where possible, a current named person. A shared mailbox, a committee name or a departed role is not enough. Test ownership by asking the proposed owner to describe the trigger, the last time the duty was performed, where the evidence sits and what happens if it fails. If the owner cannot answer without searching old notes, the duty should be marked at risk rather than owned.
Use HR and identity data to check role changes, leavers, interim appointments and delegated authorities. Compare the obligation list with the current organisation chart, but do not stop there. Access permissions are a useful tell: if a leaver's account still holds the only route to a regulatory portal, the duty may be orphaned in practice even if the new chart looks complete. Contracts and outsourced arrangements also need checking. A supplier may still perform the activity while the retained oversight duty has quietly fallen between two internal teams.
Red flags after a restructure
- The accountable owner is recorded as a team, a committee or a former role rather than a current named post.
- A duty appears only in a leaver's handover notes or in an intranet page last reviewed before the reorganisation.
- A shared mailbox receives regulatory correspondence but no one can explain who triages it or by when.
- A role title has changed, but delegated authority, system access and committee terms of reference have not.
- An outsourced activity continues, but retained oversight, challenge and escalation are no longer assigned.
- Training completion, attestations or return calendars are tracked by a team that no longer exists.
- Committee papers refer to abolished roles as decision-makers or approvers.
- A regulatory portal, filing account or notification route is accessible only through an individual's credentials.
These flags should not be treated as administrative tidying. They are evidence that the control environment may no longer match the organisation's legal and regulatory obligations.
A one-page mapping template
The audit does not need a forty-tab workbook to start. A one-page duty-owner map can be enough to expose gaps and prioritise remediation. Record one line per duty and keep the language specific.
| Field | What to record | Test |
|---|---|---|
| Duty ID | Short reference linked to the obligation register | Can it be matched to a source requirement? |
| Obligation and source | Statute, rule, contract, licence condition or internal control | Is the source current and applicable? |
| Trigger and frequency | Event, deadline or reporting cycle | Does the owner know when it bites? |
| Accountable owner | Current named role and person | Does the role exist today? |
| Operator | Team or person performing the task | Is the task in someone's live objectives? |
| Evidence location | System, folder, portal or register | Can the last record be produced quickly? |
| Last verified | Date ownership and evidence were tested | Is the date within the audit period? |
| Status | Owned, at risk or orphaned | Is the status supported by evidence? |
| Remediation | Interim owner, permanent owner, action and deadline | Is there a named executive sponsor? |
Escalate through a remediation log, not a report
A post-restructure audit should end in a board-level remediation log, not a narrative report that is read once and filed. The log should show the duty, the risk if it remains unowned, the interim arrangement, the permanent owner, the deadline and the evidence required to close the item. Prioritise duties with statutory deadlines, vulnerable-customer impact, financial crime exposure, data protection obligations or direct regulatory notification requirements.
Board oversight should be concise. A single page showing orphaned duties, at-risk duties, owners, dates and escalation points is more useful than a detailed appendix that obscures the decision. Closure should require evidence, not assurance. Re-test a sample after ninety days to confirm that the new owner can actually operate the duty.
Make it part of change control
Finally, add the duty-owner check to the events that create the risk: reorganisations, senior leavers, TUPE transfers, shared-service migrations, outsourcing changes, system replacements and role retitling. A short compliance sign-off in the change process is cheaper than a post-hoc reconstruction. The test is simple: before the new structure goes live, can every regulatory duty be traced to a current named owner, a known evidence location and a working escalation route? If not, the reorganisation is not complete.
