Use this after the applicable controls are known (statement of applicability or control matrix), and again after a reorganisation, a change to which controls apply, the departure of anyone who owns several controls, or at the annual management review. You get two files in a new folder, ./control-owner-raci/: a spreadsheet you can open in Excel with one row per control, showing which role answers for it, who runs it, who is consulted and informed, how often it is reviewed and any conflict found (raci.csv), and a one-page brief per owner explaining the controls they own and what an auditor will ask them (owner-briefs.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Owners accept their role; the agent only proposes it.

Inputs to gather

Read: the applicability statement or control matrix, the org chart or team list, job descriptions if any, policies that already name roles, the supplier list (some controls are operated by suppliers), and tickets or records that show who actually does the work today. Ask the reader, in one message: who can approve spending, which roles are held by a single person, and which suppliers run parts of operations.

Step 1: find who does the work today

For each control, look for evidence of who performs it: the person by role who closes the access review ticket, approves changes, runs the backup test, signs supplier assessments. Record it as observed, with the source. Where nobody does it, write "no operator" rather than guessing; those rows are the real findings of this work.

Step 2: assign the four letters

Accountable (A): exactly one role per control, someone who can decide, fund and answer for it, with the authority to stop a release, block a supplier or pause a process when the control fails. A team name is not an owner; a function head is.
Responsible (R): the roles or suppliers that operate it. Several are fine.
Consulted (C): roles whose input is needed before a decision (legal for retention, HR for disciplinary steps).
Informed (I): roles that receive the output (leadership for metrics, the security lead for exceptions).

Use role names in the RACI. Keep any role-to-person list in a separate file the reader holds, so the table survives staff changes.