Governance, Stakeholders, and Operating Models

Introduction

Training coordination is often treated as an administrative activity: schedules are published, rooms are booked, facilitators are briefed, and attendance is recorded. In complex organizations, however, training operations are a governance system. They allocate decision rights, control risk, coordinate scarce resources, protect learner and employee data, and connect organizational strategy with learning delivery.

Governance becomes especially important when an organization operates across business units, countries, professional disciplines, or employment categories. A centralized model may improve consistency but reduce local responsiveness. A decentralized model may increase ownership but create duplication and uneven standards. Federated and shared-service models attempt to balance these tensions, but they require carefully designed interfaces, policies, and escalation mechanisms.

This chapter examines how to design and govern these operating models. It focuses on the relationship between structure and accountability: who decides, who performs, who must be consulted, who receives information, and what happens when performance, risk, or priorities conflict.

Learning Objectives

By the end of this chapter, learners should be able to:

1. Distinguish centralized, decentralized, federated, and shared-service training operating models.
2. Select an operating model using strategic, operational, risk, and stakeholder criteria.
3. Map stakeholders according to power, interest, influence, and impact.
4. Construct and critically evaluate a RACI matrix.
5. Design policies, governance forums, decision rights, and escalation paths.
6. Apply governance controls to quality, compliance, data, suppliers, and learner experience.
7. Evaluate the limitations and ethical consequences of alternative governance arrangements.

1. Training Operations as an Operating Model

An operating model describes how an organization arranges people, processes, technology, information, and decision rights to produce value. For training, the value proposition may include capability development, regulatory compliance, safer work, leadership succession, improved performance, and employee mobility.

A training operating model answers six practical questions:

• Purpose: What organizational outcomes is training expected to support?
• Services: Which learning services are provided, to whom, and at what service levels?
• Structure: Where are learning responsibilities located?
• Decision rights: Who can approve priorities, budgets, content, suppliers, and exceptions?
• Interfaces: How do central teams, business units, managers, vendors, and learners interact?
• Controls: How are quality, risk, privacy, equity, and performance monitored?

A useful distinction is between delivery structure and governance structure. Delivery structure concerns where work is performed. Governance structure concerns who has authority and how accountability is exercised. Two organizations may use the same delivery structure but obtain different results because one has clear decision rights and the other relies on informal influence.

Training operations also involve several layers of work:

A strong operating model makes these layers mutually reinforcing rather than allowing each to operate as an isolated activity.

2. The Main Operating Models

2.1 Centralized model

In a centralized model, a corporate learning function owns most strategic and operational responsibilities. It normally controls the enterprise learning platform, standards, major suppliers, core curricula, and reporting.

Advantages include:

• consistent standards and learner experience;
• economies of scale in technology and procurement;
• stronger enterprise reporting;
• reduced duplication of content and suppliers;
• clearer accountability for organization-wide programs.

Risks include:

• slow response to local operational needs;
• insufficient subject-matter expertise in specialist units;
• perception that training is imposed by headquarters;
• excessive standardization across legally or culturally different contexts.

Centralization is most suitable when training is highly regulated, strategically uniform, data-intensive, or dependent on scale. It is less suitable where local knowledge and rapid adaptation are critical.

2.2 Decentralized model

In a decentralized model, business units or geographical entities design and manage most training independently. A central function may provide only advisory support or a small number of enterprise programs.

Advantages include local ownership, speed, contextual relevance, and close alignment with operational managers. Specialist units can respond quickly to changing technologies, customers, and work practices.

The principal risks are duplication, incompatible systems, inconsistent quality, unequal access, fragmented data, and weak enterprise visibility. Decentralization can also create inequity if well-funded units offer substantially better development opportunities than other employees.

2.3 Federated model

A federated model combines enterprise direction with local execution. A central learning function establishes principles, architecture, common standards, critical programs, and selected controls. Business units retain responsibility for contextual design, delivery, and some investment decisions.

Federation is not simply a compromise between centralization and decentralization. It is a deliberate allocation of decision rights. The central question is not “Who owns training?” but “Which decisions should be enterprise-wide, and which should remain local?”

Typical enterprise responsibilities include:

• learning strategy and capability taxonomy;
• mandatory policy and compliance standards;
• learning technology architecture;
• accessibility and data requirements;
• enterprise supplier frameworks;
• organization-wide reporting definitions.

Typical local responsibilities include:

• role-specific learning needs;
• local scheduling and delivery;
• operational examples and subject-matter input;
• local language and cultural adaptation;
• manager engagement and workplace application.

Federation works only when interfaces are explicit. Without clear boundaries, it can produce conflict, duplicated approvals, and “shadow” systems outside the official architecture.

2.4 Shared-service model

A shared-service model concentrates repeatable transactional activities in a service center that supports multiple business units. The center may manage enrollment, scheduling, learning administration, vendor coordination, reporting, and platform support. Strategic design and business partnering may remain in a central or federated function.

Shared services commonly use service catalogs and service-level agreements (SLAs). An SLA specifies the service, customer, performance standard, measurement method, and exception process. For example, a service center might commit to processing complete enrollment requests within two business days, while excluding requests that lack manager approval or required prerequisites.

The shared-service model can lower unit costs and improve process consistency. Its risks include bureaucratic handoffs, narrow focus on transaction speed, weak understanding of business needs, and disputes over whether a request falls inside the service catalog.

2.5 Hybrid designs

Most mature organizations use hybrid arrangements. For example, strategic governance may be centralized, curriculum ownership federated, scheduling provided as a shared service, and specialist technical training decentralized. Hybrid design should not mean that every unit can choose every arrangement. It should reflect deliberate principles such as risk, scale, proximity to work, and need for standardization.

Figure: Alternative training operating models and the criteria that should guide selection.

3. Choosing an Operating Model

Operating-model selection is a strategic design decision, not a preference for a particular organizational chart. Decision makers should assess at least the following criteria:

1. Strategic interdependence. Does the organization require common capabilities, mobility, or a unified culture?
2. Regulatory exposure. Would inconsistent training create legal, safety, licensing, or reputational risk?
3. Local variation. Do work practices, languages, customers, or regulations differ materially?
4. Scale economics. Are common platforms, suppliers, and content likely to create significant efficiencies?
5. Operational proximity. Must training be coordinated closely with shift patterns, equipment, or local production demands?
6. Capability maturity. Do business units have the expertise and controls to manage training responsibly?
7. Data requirements. Is enterprise-level evidence needed for assurance, workforce planning, or audit?
8. Equity and access. Could local discretion produce unequal opportunities or inconsistent accommodations?

A weighted decision matrix can make assumptions visible. Let an option’s score be calculated as:

Here, S_j is the total score for operating model j, w_i is the weight assigned to criterion i, and r_ij is the rating of model j against criterion i. Weights should sum to 1, and ratings must use a defined scale, such as 1 to 5. The method assumes criteria are sufficiently distinct and that additive scoring is acceptable; it does not prove that the highest score is objectively correct.

Illustrative example. Suppose an organization gives strategic consistency a weight of 0.30, local responsiveness 0.25, risk control 0.25, and operating efficiency 0.20. A federated model receives ratings of 4, 4, 4, and 3 respectively. Its score is:

A decentralized model might score 2, 5, 2, and 2, producing 2.85. The result supports federation under the stated assumptions, but leaders should test sensitivity: changing the weights or ratings may change the decision. Risk thresholds should also be treated as constraints rather than traded away through arithmetic. For example, a model that fails a non-negotiable privacy control should not be selected merely because it scores well on cost.

4. Stakeholder Mapping and Engagement

A stakeholder is any person, group, or institution that can affect training decisions, is affected by them, or has a legitimate interest in them. Stakeholders include executive sponsors, HR business partners, line managers, employees, learners, facilitators, subject-matter experts, compliance officers, works councils, procurement, information security, accessibility specialists, technology teams, vendors, and regulators.

Stakeholder analysis should go beyond listing names. It should examine:

• expected benefits and losses;
• formal authority and informal influence;
• information needs;
• likely resistance or support;
• legal or ethical interests;
• ability to affect implementation;
• desired engagement method.

A power–interest grid is a useful starting point:

The grid must be used critically. Learners may have low formal power but high moral and operational importance. A disability network or employee representative body may be entitled to consultation even when it lacks budget authority. Stakeholder mapping should therefore include legitimacy and impact, not only power.

A stakeholder register can record the stakeholder, interest, influence, current position, risks, engagement owner, communication channel, and review date. Mapping is not a one-time exercise. Stakeholders change as a program moves from design to procurement, implementation, and evaluation.

5. RACI Matrices and Decision Rights

The RACI framework assigns four roles:

• Responsible: performs or coordinates the work.
• Accountable: owns the result and has authority to approve it.
• Consulted: provides input before a decision or deliverable is finalized.
• Informed: receives relevant information after or during the activity.

A RACI matrix should normally have one Accountable party for each major decision or deliverable. It may have several Responsible parties, although excessive distribution can obscure ownership. “Consulted” should represent genuine two-way input, not everyone who might be interested. “Informed” is one-way notification.

*Where compliance has statutory or policy authority, its role may be Accountable for the control requirement, while the learning function remains Accountable for curriculum implementation. The organization must resolve such dual-accountability risks explicitly rather than hiding them in a table.

RACI is a communication device, not a substitute for governance. It does not describe decision thresholds, resource authority, escalation timing, or the quality of an individual’s performance. It should be accompanied by a decision-rights register specifying what can be decided, by whom, within what limits, and with what evidence.

Common RACI defects include:

• multiple Accountable parties with no tie-breaker;
• no Responsible party;
• every stakeholder marked Consulted;
• using RACI for ongoing relationships rather than defined activities;
• confusing seniority with accountability;
• assigning accountability without giving authority or resources.

6. Governance Architecture

Governance architecture consists of forums, policies, controls, records, and escalation arrangements. A practical architecture often includes the following layers.

Strategic steering group

This body approves strategy, investment principles, major priorities, risk appetite, and exceptions with enterprise consequences. It should not become a forum for approving routine schedule changes.

Portfolio or curriculum council

This group reviews proposed programs, duplication, curriculum coherence, prerequisites, assessment standards, and evidence of demand. It may include learning leaders, business representatives, compliance, technology, and employee representatives where appropriate.

Operational service forum

This forum monitors service levels, calendars, capacity, vendor performance, learner support, incidents, and recurring operational problems. Its purpose is rapid coordination and continuous improvement.

Assurance and risk review

This function tests mandatory completion, content currency, accessibility, privacy, records, vendor controls, and audit findings. It should have sufficient independence to challenge delivery owners.

Governance artifacts

Important artifacts include the learning policy, service catalog, operating procedures, decision-rights register, RACI matrix, curriculum standards, supplier standards, data-retention schedule, accessibility requirements, risk register, issue log, exception register, and performance dashboard.

Policies should establish principles and obligations; procedures should explain how work is performed. A policy that says “training data must be protected” is incomplete without specifying ownership, access rules, retention, incident reporting, and review mechanisms.

7. Escalation Paths and Exception Management

An escalation path specifies how an issue moves from operational handling to higher authority. Effective escalation is neither automatic referral of every problem nor informal reliance on personal relationships. It is a controlled response to defined triggers.

A training escalation design should identify:

1. the issue owner;
2. the first-level resolution point;
3. severity categories;
4. response and resolution expectations;
5. evidence required;
6. decision authority at each level;
7. communication requirements;
8. closure and lessons-learned procedures.

Typical escalation triggers include missed regulatory deadlines, unsafe or inaccurate content, a material privacy incident, systemic service failure, supplier non-performance, inaccessible learning, significant budget variance, or unresolved disagreement between central and local owners.

A four-level model may be useful:

• Level 1—operational: resolved by the coordinator or service team.
• Level 2—functional: referred to the learning manager or business owner when resources, quality, or timing are affected.
• Level 3—governance: referred to the steering group or risk owner when cross-unit priorities, policy exceptions, or material exposure arise.
• Level 4—executive or external: referred to executive leadership, legal counsel, a regulator, or emergency management where required.

Escalation should be supported by an exception register. Each exception should state the requirement, reason for departure, risk assessment, compensating control, approving authority, expiry date, and review owner. Permanent exceptions often indicate that the policy or operating model requires redesign.

8. Governance Controls and Performance Measures

Controls are mechanisms designed to prevent, detect, or correct undesirable outcomes. In training operations, preventive controls include approval gates, role prerequisites, content review, supplier due diligence, accessibility checks, and segregation of duties. Detective controls include completion reports, audit sampling, learner feedback, data-quality checks, and reconciliation of attendance records. Corrective controls include remediation learning, content withdrawal, incident response, and corrective action plans.

Performance should not be reduced to attendance. A balanced dashboard may include:

• demand and participation;
• completion and overdue rates;
• learner experience and accessibility;
• assessment performance;
• transfer indicators such as manager-observed application;
• operational reliability and SLA achievement;
• cost and capacity;
• audit findings and control effectiveness;
• equity of access and outcomes.

A completion rate can be defined as:

The measure assumes that enrollment records are accurate and that “completed” has a consistent definition. It does not establish learning, transfer, or business impact. A high completion rate may coexist with poor content, superficial participation, or ineffective assessment.

For service performance, an SLA attainment rate may be calculated as:

“Eligible requests” must exclude only those exclusions explicitly defined in the SLA. Otherwise, teams can improve the apparent rate by reclassifying difficult cases.

Governance dashboards should show trends, thresholds, ownership, and actions—not merely traffic-light colors. Measures should be disaggregated where ethically and legally appropriate to identify unequal access or outcomes, while protecting confidentiality and avoiding stigmatizing small groups.

9. Ethical, Legal, and Technology Considerations

Training governance affects employee opportunity, career progression, privacy, and sometimes authorization to perform safety-critical work. Ethical governance therefore requires more than efficiency.

Fairness and access. Central standards should include reasonable accommodations, accessible platforms, inclusive scheduling, language considerations, and alternative formats. Local discretion should not become a justification for excluding remote, shift, contingent, or disabled workers.

Privacy and data minimization. Learning records may reveal performance concerns, health-related accommodation needs, or professional status. Organizations should collect only necessary data, restrict access by role, define retention periods, and explain legitimate uses. Completion data should not be repurposed for unrelated punitive decisions without a clear legal and ethical basis.

Transparency and due process. Employees should understand mandatory requirements, consequences of non-completion, appeal routes, and how training results are used. Automated flags should be reviewable by a human when they affect employment decisions.

Vendor governance. Contracts should address confidentiality, accessibility, intellectual property, subcontracting, security, data location where relevant, service continuity, audit rights, and exit arrangements.

Artificial intelligence. AI may support needs analysis, content drafting, translation, learner assistance, and pattern detection in operational data. Its use requires human review, source verification, confidentiality controls, bias testing, transparency, and clear accountability. AI-generated learning content should not be assumed accurate merely because it is fluent. High-risk uses—such as inferring employee potential or making progression decisions—require particularly strong governance and may be inappropriate without robust validation and legal review.

10. Applied Case: Northstar Industrial Group

The following is an illustrative case.

Background

Northstar Industrial Group operates manufacturing, logistics, and field-service businesses in twelve countries. Its learning activities had grown independently. The manufacturing division used a central learning platform, logistics relied on spreadsheets and local vendors, and field service commissioned technical training from equipment suppliers. The executive team wanted a common safety curriculum and stronger evidence for audits, but business leaders opposed a fully centralized function.

Problem

An internal review found three problems. First, the same safety topics had been purchased from multiple vendors at different prices. Second, completion reports used inconsistent definitions, so the organization could not reliably identify overdue employees. Third, local teams were adapting mandatory content without a documented review process. The proposed solution of centralizing everything was rejected because field-service training depended on rapidly changing equipment and local customer requirements.

Analysis

A stakeholder map identified the chief operating officer as executive sponsor; central HR as policy owner; business-unit leaders as accountable for operational capability; safety and compliance as control authorities; local HR as implementation partners; managers as reinforcement agents; employees and works councils as affected stakeholders; and vendors as delivery partners.

A weighted assessment favored a federated model. Enterprise safety outcomes, data definitions, accessibility standards, and the learning platform would be common. Business units would retain responsibility for local examples, technical modules, scheduling, and manager follow-up. A shared service would handle enrollment, records, standard reporting, and vendor administration.

Approach and solution

Northstar implemented five design decisions:

1. A learning governance council approved the enterprise curriculum architecture and resolved cross-unit priorities.
2. A decision-rights register distinguished non-negotiable safety controls from locally adaptable examples.
3. A RACI matrix assigned central HR responsibility for standards, business-unit leaders accountability for workplace application, and safety compliance authority over mandatory control requirements.
4. The shared service introduced a service catalog, common completion definitions, and monthly SLA reporting.
5. An exception process required local deviations to state the reason, risk, compensating control, approving authority, and expiry date.

The organization also created a quarterly learner and representative forum. This exposed a problem missed by the original design: night-shift employees had limited access to instructor-led sessions. The service model was revised to include recorded briefings, repeated live sessions, and paid time for completion.

Outcome

After implementation, Northstar eliminated duplicate purchases for common safety topics, improved the reliability of mandatory-training reports, and preserved local technical specialization. More importantly, leaders could identify whether a problem concerned content, scheduling, management reinforcement, or the control environment. The organization did not treat the operating model as complete; it scheduled a formal review after the first operating year.

Learning points

The case demonstrates that federation requires explicit boundaries, not vague cooperation. Shared services are valuable when their service definitions and data rules are clear. Compliance authority must be distinguished from delivery ownership. Finally, stakeholder participation can reveal operational inequities that efficiency-focused governance overlooks.

11. Implementation Road Map and Best Practices

A practical redesign can proceed through the following stages:

1. Diagnose the current state: inventory services, systems, suppliers, decision forums, risks, costs, and pain points.
2. Clarify strategic outcomes: identify the capabilities and controls that training must support.
3. Segment services: distinguish enterprise-critical, locally specific, transactional, and specialist activities.
4. Select the operating model: use explicit criteria and test assumptions with stakeholders.
5. Design decision rights: create a RACI matrix and a decision-rights register; resolve gaps and conflicts.
6. Build governance forums: define membership, authority, inputs, outputs, meeting cadence, and escalation rules.
7. Document policies and controls: connect every major obligation to an owner, evidence source, and review cycle.
8. Pilot interfaces: test a service catalog, reporting definitions, escalation path, and exception process before enterprise rollout.
9. Measure and improve: review service, quality, risk, equity, and outcome indicators; retire controls that add effort without reducing risk.

Best practice is not maximum central control. It is the minimum clear control necessary to protect enterprise value while enabling competent local action. Governance should be proportionate, evidence-based, transparent, and designed around real work rather than formal charts alone.

Challenges and Limitations

Operating-model design involves unavoidable trade-offs. Centralization can create distance from work; decentralization can weaken consistency. Federated structures can become politically complex, and shared services can prioritize measurable transactions over meaningful learning. Weighted scoring models may conceal subjective judgments. RACI matrices can create an illusion of clarity while authority, budgets, and consequences remain unresolved.

Governance can also become excessive. Too many committees delay decisions, produce duplicated reporting, and encourage workarounds. Conversely, light governance may leave employees exposed to inconsistent standards, privacy risks, or inaccessible learning. Leaders should therefore periodically ask whether each forum, approval, metric, and control has a defined purpose and observable value.

A final limitation is causal ambiguity. Improvements in work performance may result from changed equipment, supervision, incentives, or market conditions rather than training alone. Governance dashboards should avoid claiming causal impact without appropriate evidence.

Chapter Summary

Training coordination is a governance system as well as an administrative service. Centralized, decentralized, federated, and shared-service models distribute authority and work differently, with distinct benefits and risks. Model selection should consider strategic interdependence, regulatory exposure, local variation, scale, operational proximity, capability maturity, data needs, and equity.

Stakeholder mapping identifies interests, influence, legitimacy, and engagement needs. RACI matrices clarify responsibility but must be supported by decision-rights registers, authority, resources, and escalation rules. Effective governance combines strategic forums, operational coordination, assurance, policies, service catalogs, exception records, and balanced performance measures.

Ethical governance protects access, privacy, transparency, and due process. Technology and AI can improve coordination but require human accountability, validation, and appropriate controls. The central design principle is proportionality: standardize what must be consistent, localize what depends on context, and make every boundary explicit.

Key Terms

Operating model: The arrangement of people, processes, technology, information, and decision rights used to create value.

Governance: The structures and processes through which authority, accountability, oversight, and control are exercised.

Centralized model: An arrangement in which a central function owns most training decisions and services.

Decentralized model: An arrangement in which business units or locations manage training largely independently.

Federated model: An arrangement combining enterprise standards with local decision-making and adaptation.

Shared-service model: A model in which common transactional services are provided by a service center to multiple units.

Service-level agreement: A documented commitment defining a service, performance standard, measurement, and exception process.

Stakeholder: A person or group that affects, is affected by, or has a legitimate interest in training decisions.

Stakeholder mapping: The systematic analysis of stakeholder interests, influence, impact, and engagement needs.

RACI: A responsibility framework using Responsible, Accountable, Consulted, and Informed roles.

Decision rights: Explicit authority to make specified decisions within defined limits.

Escalation path: A documented route for moving unresolved or serious issues to higher authority.

Exception register: A record of approved departures from a policy or standard, including risk, controls, authority, and expiry.

Preventive control: A control designed to stop an undesirable event before it occurs.

Detective control: A control designed to identify an event or failure after it occurs.

Corrective control: A control designed to remedy a failure and prevent recurrence.

Service catalog: A structured description of available services, users, standards, and responsibilities.

Governance forum: A formal group with defined membership, authority, inputs, and outputs.

Data minimization: The principle of collecting and using no more personal data than necessary for a legitimate purpose.

Review Questions

5 Short Answer Questions

1. What distinguishes an operating model from an organizational chart?
2. State two advantages and two risks of a centralized training model.
3. What is the difference between “Responsible” and “Accountable” in a RACI matrix?
4. Why should an exception have an expiry date?
5. Why is completion rate an insufficient measure of learning effectiveness?

5 Long Answer Questions

1. Compare centralized, decentralized, federated, and shared-service training models. Identify the circumstances in which each is most appropriate.
2. Explain how stakeholder mapping can improve the design and implementation of a training operating model.
3. Critically evaluate the claim that a RACI matrix creates accountability.
4. Design a governance architecture for a multinational organization with mandatory compliance training and locally specialized technical training.
5. Discuss the ethical and privacy issues involved in using learning analytics and AI in training operations.

3 Analytical / Application Questions

1. An organization has duplicate suppliers, inconsistent completion definitions, and strong local technical requirements. Recommend an operating model and justify your decision using at least five criteria.
2. Construct a RACI matrix for designing, approving, scheduling, delivering, and assuring a mandatory leadership program. Explain how you would resolve any multiple-accountability problems.
3. A business unit wants to deviate from an enterprise safety course because its equipment differs from the corporate standard. Design the escalation and exception process, including evidence, authority, compensating controls, and review arrangements.

Multiple Choice Questions with Answers

Question 1

Which operating model combines enterprise standards with local adaptation and execution?

A. Centralized

B. Decentralized

C. Federated

D. Independent vendor model

Correct Answer: C. Federated

Question 2

In a RACI matrix, who owns the result and has authority to approve it?

A. Responsible

B. Accountable

C. Consulted

D. Informed

Correct Answer: B. Accountable

Question 3

Which criterion is most directly concerned with whether inconsistent training could create legal or safety exposure?

A. Operational proximity

B. Regulatory exposure

C. Local language variation

D. Learner preference

Correct Answer: B. Regulatory exposure

Question 4

What is the primary purpose of a shared-service center in training operations?

A. To eliminate all local decision-making

B. To concentrate repeatable transactional activities

C. To replace compliance governance

D. To allow every unit to use separate data definitions

Correct Answer: B. To concentrate repeatable transactional activities

Question 5

Which stakeholder group should generally be managed closely in a power–interest grid?

A. High power and high interest

B. High power and low interest

C. Low power and high interest

D. Low power and low interest

Correct Answer: A. High power and high interest

Question 6

An organization assigns weights of 0.50 and 0.50 to two criteria. A model receives ratings of 4 and 2. What is its weighted score?

A. 2.0

B. 2.5

C. 3.0

D. 6.0

Correct Answer: C. 3.0

Question 7

Which item belongs in an exception register?

A. Only the name of the person requesting the exception

B. The deviation, risk assessment, compensating control, approval, and expiry date

C. A list of all employees in the organization

D. A general statement that local needs are different

Correct Answer: B. The deviation, risk assessment, compensating control, approval, and expiry date

Question 8

Why should completion rate not be treated as proof of learning?

A. Completion data can never be collected

B. Completion does not establish learning, transfer, or business impact

C. Completion is unrelated to enrollment

D. Completion rates are always confidential

Correct Answer: B. Completion does not establish learning, transfer, or business impact

Question 9

Which is an example of a preventive control?

A. A post-course satisfaction survey

B. An audit of last year's attendance records

C. A prerequisite approval before enrollment

D. A corrective action plan after an incident

Correct Answer: C. A prerequisite approval before enrollment

Question 10

What is a central governance risk when every stakeholder is marked Consulted in a RACI matrix?

A. The matrix becomes too concise

B. Genuine consultation and decision ownership become unclear

C. The organization gains excessive local autonomy

D. All communication automatically becomes confidential

Correct Answer: B. Genuine consultation and decision ownership become unclear