The roles a controlled accounting team needs, from engagement owner to submission approver

These are operating roles, not job titles or a recommended headcount. The list was developed from the decisions needed to accept, prepare, review, submit and protect accounting work. One person may hold several roles in a small practice, but conflicts and unavailable deputies still need safeguards.

What to take away

1. Engagement owner

This person accepts the service scope, customer risk, fee and capacity. They ensure responsibilities and exclusions are understood, approve material changes and own the overall relationship. They should not promise specialist work until an appropriately competent person agrees it can be delivered.

2. Records coordinator

The coordinator requests inputs, checks entity and period, logs missing evidence and follows cut-offs. They prevent informal messages and mixed folders from becoming an untraceable source record. Their exception list should show consequence and escalation, not just overdue status.

3. Preparer

The preparer processes information, reconciles control accounts and documents adjustments. They record source, reasoning and uncertainty. Automation may suggest coding or detect patterns, but the assigned human remains accountable for examining exceptions within their role.

4. Technical specialist

The specialist addresses a defined accounting, tax, payroll, reporting or industry question. Competence should be recorded by task and kept current. The referral note gives facts, question, deadline, response and how the conclusion was applied.

HMRC's standard for agents expects its population of agents to maintain correct, current knowledge in the tax areas they handle, prevent unsupported figures and keep contemporary records of advice.

5. Reviewer

The reviewer challenges completeness, reconciliations, unusual items, judgements and presentation. They need enough independence from preparation to question assumptions. Findings remain open until evidence or a recorded decision closes them.

A senior title alone does not establish suitability. Match experience to the entity, transaction, tax and reporting framework under review.

6. Submission approver

This role confirms the reviewed output, client authority, correct entity, period, deadline and submission route. It preserves the sent version and acknowledgement. Where role separation is proportionate, the preparer should not silently approve and transmit their own high-consequence output.

7. Information and system owner

This owner approves tools, access, data flows, retention, backups and incident procedures. They coordinate with data-protection and security specialists where needed. The ICO's controller and processor guidance helps determine roles from factual control rather than contract labels.

8. Quality and incident lead

The quality lead samples files, analyses recurring errors and confirms that corrective actions work. During an incident, they coordinate containment, impact assessment, communication and recovery without destroying evidence.

Map decisions, not only names

For every role, record the decisions it may make, access it needs, evidence it produces, competence required, conflicts, deputy and escalation point. Build a responsibility matrix for each service and deadline.

Add acceptance and removal controls to the assignment. The role holder should confirm the scope, while the service owner verifies training and access before work is allocated. Temporary cover needs a start date, end date and review of actions taken. When someone changes role, reassign open queries and deadlines before revoking old privileges.

Capacity belongs in the role map too. Show forecast work, review queues and specialist dependencies. A named reviewer who has no time before the statutory deadline is not an effective control. Set a trigger for stopping new work, moving a deadline internally or obtaining approved external support.

Test the map with an absence, a difficult technical issue, a rejected filing and a compromised administrator account. If work stops, or one person can prepare, approve, submit and erase evidence without challenge, redesign the controls.

Review assignments after recruitment, departure, promotion, outsourcing or a new service line. A role map is useful only if it reflects who performs the work.

Before you act

Common questions

What should a role map record for each role?

For every role, record the decisions it may make, access it needs and evidence it produces. Also note competence required, conflicts, deputy and escalation point. Build a responsibility matrix for each service and deadline. This ensures clarity and accountability.

Why is capacity important in a role map?

Capacity belongs in the role map because a named reviewer with no time before the statutory deadline is not an effective control. Show forecast work, review queues and specialist dependencies. Set a trigger for stopping new work or obtaining approved external support.

How can you test the role map?

Try it against an absence, a tricky technical matter, a rejected filing and a hacked administrator account. If work halts, or one person can prepare, approve, submit and wipe evidence unchallenged, the controls need redesigning.