A small service provider is experiencing growth and success. Currently, all important decisions are made by a small executive group. This creates delays because some members of the group are often unavailable. Which is the BEST approach for establishing an authority structure for decision-making within the service provider organization?

The most effective approach is to establish a formal governance structure for decision-making. Option C proposes a risk-based model, which is a core principle of modern governance. By having the executive group retain authority for high-risk decisions, the organization ensures that critical choices receive appropriate oversight. Simultaneously, creating a clear policy for delegating lower-risk decisions directly addresses the bottleneck and delays. This structured delegation empowers other levels of the organization, improves responsiveness, and allows the executive group to focus on strategic matters, which is essential for a growing service provider.

A. This is a viable action but is less comprehensive than C. It lacks the formal, risk-based policy framework that would define when it is appropriate to escalate, which is crucial for consistency.
B. This option is too narrow. While technical staff should be involved in technical decisions, this approach fails to address the broader range of "all important decisions" mentioned in the scenario.
D. This describes supporting activities rather than the establishment of an authority structure. Training and automation are means to support a delegated model, not the model itself.

1. AXELOS. (2020). ITIL® 4: Direct

Plan and Improve (DPI). TSO (The Stationery Office).

Section 3.1.3

Governance activities: This section explains that a governing body is accountable for compliance with policies and may "delegate responsibility for the implementation and enforcement of these policies to the management and staff of the organization." This supports the concept of formal delegation.

Section 3.2.1

Controls for directing and planning: The text states

"Controls are also needed to ensure that the right people are making the right decisions... This includes defining policies for decision-making

delegating authority

and establishing a decision-making matrix or RACI chart." This directly supports creating a policy for delegating decisions.

Section 3.2.3

Risk management: This section emphasizes that the governing body should agree on the organization's risk appetite

which "will inform how decisions are made throughout the organization." This supports the risk-based approach in option C

where high-risk decisions are treated differently from others.