STD-GOV-137: Department Mandates & Decision Rights¶
| Field | Value |
|---|---|
| Standard | STD-GOV-137 |
| Title | Department Mandates & Decision Rights |
| Status | Draft — for leadership offsite review |
| Owner | CEO / CDO |
| Created | 2026-04-05 |
| Review | Annually |
Purpose¶
Define what each department owns, what decisions they can make independently, and where they need to escalate. Without this, decisions fall into gaps ("who owns this?"), get duplicated ("we both thought we owned that"), or stall ("nobody wants to decide").
The offsite "Organisational Clarity" session (Day 2, 09:15) aims to leave with clear department mandates, ownership of strategy, decision rights, overlaps resolved, and gaps filled. This document is the proposal.
Current State¶
- No documented department mandates.
- Decision rights are informal. "Whoever speaks loudest" or "whoever the CEO asks."
- Overlaps between departments cause confusion (e.g. who owns partner onboarding, who owns compliance monitoring?).
- Gaps exist where no department owns a function (e.g. data governance, execution tracking).
- Cross-functional projects have no defined interaction model.
Department Mandates¶
CDO Division (Product, Security, Data, Technology)¶
Mandate: Own the technology platform, product architecture, data strategy, and security posture. Ensure the platform is reliable, secure, compliant, and scalable. Translate the CEO's strategic goals into technical delivery.
| Function | Owns | Decides Independently | Escalates To |
|---|---|---|---|
| Technology architecture | System design, tech stack, infrastructure | Technology choices, tooling, build vs buy for technical components | CEO for budget >$50K |
| Product architecture | API design, product capabilities, merchant-facing features | Feature design, API contracts, SDK specifications | CEO for new product lines |
| Security | Security posture, threat modelling, incident response, pen testing | Security standards, vulnerability remediation priorities, incident classification | CEO for security incidents affecting customers |
| Data | Data architecture, governance, quality, privacy, retention | Data standards, schema design, encryption, anonymisation | CEO for cross-border data flow decisions |
| Platform reliability | Uptime, SLOs, incident management, observability | On-call rosters, monitoring tooling, runbook content | CEO for SLO changes affecting commercial commitments |
| Engineering hiring | Technical assessment, team structure, engineering standards | Hire/no-hire for technical roles within budget | CEO for headcount increases |
Does NOT own: Commercial pricing, merchant relationships, country P&L, treasury operations, HR policy.
COO Division (Operations)¶
Mandate: Own day-to-day operations across all markets. Ensure transactions flow, partners are managed, and operational issues are resolved. The engine room.
| Function | Owns | Decides Independently | Escalates To |
|---|---|---|---|
| Transaction operations | Transaction monitoring, settlement, reconciliation | Operational process changes, shift scheduling | CDO for system changes, CFO for settlement policy |
| Partner management | Partner onboarding, performance monitoring, relationship management | Partner-level operational decisions, SLA enforcement | CEO for partner termination, CDO for technical integration |
| Country operations | In-country operational execution, local regulatory interaction | Operational process adaptations per market | CEO for market-level strategy changes |
| Incident operations | First-line incident response, customer impact assessment | Operational escalation, temporary service restrictions | CDO for technical root cause, CEO for customer communication |
Does NOT own: Technology architecture, security policy, product design, pricing strategy.
CFO Division (Finance)¶
Mandate: Own financial health, treasury, compliance reporting, and commercial governance. Ensure the business is financially viable and regulatorily compliant from a financial perspective.
| Function | Owns | Decides Independently | Escalates To |
|---|---|---|---|
| Treasury | Liquidity management, pre-funding, FX management | Treasury operations within policy | CEO for policy changes |
| Settlement policy | Settlement cycles, fee structures, corridor economics | Settlement timing, reconciliation processes | CEO for pricing changes affecting merchants |
| Financial compliance | Regulatory financial reporting, audit coordination | Reporting content, audit scope | CEO for regulatory findings |
| Commercial governance | Pricing approval, contract terms, revenue recognition | Standard pricing within approved framework | CEO for non-standard pricing |
| Budget | Department budgets, cost allocation, financial planning | Budget allocation within approved envelope | CEO for budget increases |
Does NOT own: Technology spending decisions (CDO), operational process design (COO), product design (CDO).
Commercial Division¶
Mandate: Own merchant acquisition, revenue growth, and market development. Bring merchants onto the platform and maximise revenue per merchant.
| Function | Owns | Decides Independently | Escalates To |
|---|---|---|---|
| Merchant acquisition | Sales pipeline, merchant outreach, onboarding coordination | Which merchants to pursue, pricing proposals within framework | CFO for non-standard pricing, CEO for strategic partnerships |
| Revenue growth | Upsell, cross-sell, product adoption per merchant | Campaign targeting, merchant engagement | CEO for new market entry |
| Market development | Market intelligence, competitive positioning | Market research scope | CEO for new country decisions |
Does NOT own: Merchant technical integration (CDO), merchant operational support (COO), pricing approval (CFO).
Decision Rights Matrix¶
For decisions that cross department boundaries:
| Decision | Who Proposes | Who Decides | Who Is Consulted | Who Is Informed |
|---|---|---|---|---|
| New product line | CDO or Commercial | CEO | CFO, COO | All departments |
| New market entry | CEO or Commercial | CEO | CDO, CFO, COO | All departments |
| Partner termination | COO | CEO | CDO, CFO, Commercial | Country operations |
| Technology stack change | CDO | CDO | COO (operational impact) | CEO, CFO |
| Pricing change | Commercial or CFO | CFO | CDO, COO | CEO |
| Security incident response | CDO | CDO (technical), CEO (communication) | COO, CFO | All departments |
| Regulatory response | CFO or CDO | CEO | All departments | All departments |
| Hiring (within budget) | Department head | Department head | HR | CFO |
| Hiring (new headcount) | Department head | CEO | CFO | HR |
| Initiative >$50K | Any department head | CEO | CFO | All departments |
| Standard/ADR adoption | CDO | CDO (via ARB) | Affected departments | All departments |
| Data architecture change | CDO | CDO | COO, CFO | All departments |
| Vendor selection (technology) | CDO | CDO | CFO (budget) | CEO |
| Vendor selection (non-tech) | Requesting department | CEO | CFO | CDO |
| Cross-border data flow | CDO | CEO | CFO (regulatory), COO (operational) | All departments |
Overlap Resolution¶
These are the areas where current ownership is unclear. The offsite must resolve each.
| Area | Claimed By | Proposed Resolution |
|---|---|---|
| Merchant onboarding | Commercial (relationship) + COO (process) + CDO (technical) | Commercial owns the relationship and initiates. COO owns the operational process. CDO owns the technical integration. Handoff points defined in Merchant Onboarding Standard. |
| Compliance monitoring | CFO (financial compliance) + CDO (technical compliance) + COO (operational compliance) | CFO owns financial/regulatory compliance. CDO owns technical/security compliance. COO owns operational compliance. Each maintains their domain's reporting. |
| Partner performance | COO (operational performance) + Commercial (commercial performance) | COO owns operational health (uptime, success rates). Commercial owns revenue performance. Joint quarterly partner review. |
| Incident communication | CDO (technical) + COO (operational) + Commercial (merchant-facing) | CDO leads technical response. COO leads operational containment. Commercial leads merchant communication. CEO approves external communications for P1 incidents. |
| Data quality | CDO (data architecture) + COO (data entry) + CFO (financial data) | CDO owns data standards and tooling. COO owns data entry quality. CFO owns financial data accuracy. CDO provides monitoring, each department owns their data. |
Gaps (No Current Owner)¶
| Function | Why It Matters | Proposed Owner |
|---|---|---|
| Execution tracking | No one tracks whether strategic initiatives are on track | CDO (via Execution Framework, STD-GOV-135) |
| Performance management | No company-wide dashboard or review cadence | CDO (via Performance Management Framework, STD-GOV-136) |
| Data governance | No formal data ownership model, classification, or retention enforcement | CDO (Data Lead, when hired) |
| Knowledge management | No system for finding institutional knowledge | CDO (via Maerifa) |
| Developer experience | No one owns onboarding, tooling, CI/CD, or local dev environment | CDO (Platform Lead, when hired) |
Interaction Model¶
How Departments Work Together¶
┌──────┐
│ CEO │ Strategy, final authority,
│ │ cross-functional conflicts
└──┬───┘
┌───────────┼───────────┐
▼ ▼ ▼
┌─────────┐ ┌─────────┐ ┌─────────┐
│ CDO │ │ COO │ │ CFO │
│ Build │ │ Run │ │ Govern │
└────┬────┘ └────┬────┘ └────┬────┘
│ │ │
▼ ▼ ▼
┌─────────┐ ┌─────────┐ ┌─────────┐
│Commercial│ Partners │ │Compliance│
│(acquire) │ (operate) │ │(report) │
└─────────┘ └─────────┘ └─────────┘
CDO builds the platform.
COO runs the platform.
CFO governs the platform.
Commercial fills the platform.
Escalation Path¶
Department-level disagreement
│
▼
Department heads discuss directly (24-hour resolution target)
│
┌────┴────┐
│Resolved?│
└────┬────┘
No │ Yes → Done
▼
Escalate to Leadership Forum (next scheduled, or ad-hoc if urgent)
│
▼
CEO decides. Decision documented within 24 hours.
Rule: No escalation without a written proposal. "We disagree" is not an escalation. "We disagree on X. Department A proposes Y because Z. Department B proposes W because V." That is an escalation.
Adoption¶
This document becomes effective once agreed at the leadership offsite (April 14-15, 2026). Department heads are accountable for communicating mandates to their teams within 2 weeks of the offsite.
Review annually or whenever a department is created, merged, or reorganised.