QM-ORG-003 — QM Role Matrix & Deputies

1. Why a 45-person company needs this

Every security process ACME operates names a role: the PSL approves the threat model, the Vulnerability Manager decides triage, a second person authorises a signature. Each of those is a single point of failure attached to a deadline measured in hours.

In a large organisation that is handled by having several people in each function. Here, most roles are one person, several roles sit on the same person, and the difference between a process that works and one that does not is whether a deputy was named before the holiday, the illness or the resignation.

This matrix does three things: names the holder and the deputy for every role, states which role combinations are forbidden, and defines what happens when the holder is unreachable.

2. Role matrix

3. Incompatibility rules

These are the separations every process elsewhere depends on. They are stated once, here, so that a deputy appointment cannot silently break one.

1. No self-approval. No phase, review or gate may be approved by the person who performed the work (SDL-POL-001 §2). This binds deputies too — a deputy who did the work is not an eligible approver, and the approval escalates.
2. Fix developer ≠ sole verifier of that fix (PSM-PROC-003 §2).
3. Release requester ≠ release approver for signing (SDL-STD-025 §3). Enforced by the signing service.
4. The PSL cannot be the sole approver of a risk acceptance they proposed — acceptance at that point requires the Managing Director.
5. Where roles collide on one person for a specific decision, the decision escalates one level, to the Managing Director. It does not proceed with one signature written twice.

The Head of Engineering holds the PSL role and deputises as Vulnerability Manager. That combination is permitted, but rule 5 applies whenever a single case would otherwise need both signatures from that person.

4. Absence and reachability

• Planned absence over three working days: the deputy is notified in writing and the handover is recorded in the QM log. An absence with no notified deputy is not permitted for the PSL, the VM or the Managing Director.
• Unplanned absence: the deputy assumes the role on the first working day. No decision waits for the holder to return.
• The on-call rule covers the 24-hour Art. 14 window: the on-call engineer is reachable outside business hours, and the escalation path to the VM and the Managing Director is in the rota, with numbers. Reachability is tested in the annual notification drill (PSM-PROC-002 §6) — the drill tests the phone numbers as much as the templates.
• Vacancy: if a role falls vacant, the Managing Director assumes it personally until it is filled, and records the date. A role listed as vacant with no interim holder blocks the release gate.

5. The Managing Director has no deputy

Deliberate. Approval of Art. 14 submissions, risk acceptance and policy approval are not delegable in a company of this size — delegating them would make the approval meaningless, since the delegate reports to the delegator.

The mitigation is not a deputy but reachability: the Managing Director is on the escalation path in the on-call rota, and the Art. 14 decision templates (PSM-PROC-003 Annex C) are pre-filled so that the decision is a signature on a prepared document, not an analysis performed at 02:00. Where the Managing Director is genuinely unreachable within the 24-hour window, the PSL submits the early warning and records that they did so — a late notification is a breach, a notification submitted by the wrong person is a correction.

6. Competence

Each role names its required competence and the evidence for it: the PSL and VM maintain current knowledge of the CRA obligations and the notification route; the Development Team Lead maintains the secure coding standard; key custodians are trained on the ceremony procedure before their first ceremony. Training records are quality records, reviewed annually with this matrix.

7. Records

Appointment records, deputy notifications, handover log entries, the on-call rota with its history, drill participation, and training records. Superseded revisions of this matrix are retained — the question "who was authorised to approve this in March 2026" must remain answerable.

Revision history