Back to Hub
Governance

Who should own your management system? Getting internal ownership right

Published 24 July 2026
  • governance
  • management systems
  • internal audit
  • ISO 9001
  • ISO 45001
  • contractor assurance

Most management systems don't fail on content - they fail because the person who owns them has no authority, no time, or both. Here is how to structure ownership so the system actually runs.

The right owner for your management system is whoever in the business has both the authority to make other leaders comply with it and protected time to run it - not necessarily whoever holds the "quality" or "compliance" title. Most systems that look weak at audit aren't weak on content. They're weak on ownership: the person responsible can maintain documents but cannot make anyone else follow them.

That distinction matters more as a business grows past the size where the founder can personally chase every register and every close-out. Somewhere between 10 and 50 staff, ownership stops being something you can improvise, and starts being a governance decision with a real cost if you get it wrong.

What does a management system owner actually need to do?

Strip away the title and the job is four things: keep the documented system current as the business changes, run the internal audit schedule (not just the pre-external-audit scramble), chase nonconformances to genuine close-out, and feed accurate information to top management at management review. None of those four things require a specific qualification. All four require authority the person doesn't automatically get from a job title.

Why does the role usually fail? Three common patterns

The under-authorised owner. An admin coordinator or junior quality person is given the role because they're organised, not because they can direct a site supervisor. They can update documents. They cannot make a project manager close an NCR on time, and everyone on site knows it - so nothing closes on time.

The unprotected owner. A capable operations leader is given the role on top of their existing job, with no reduction in their other workload. The system runs fine until the business gets busy - at which point the management system is always the first thing that slips, because it's the only part of the job with no external deadline attached to a client.

The isolated owner. The role exists, has some authority, but reports into operations rather than to top management directly. Findings get filtered or softened before they reach the person who can actually resource a fix. Management review becomes a status update instead of a governance function.

Any one of these produces the same audit symptom: a system that looks complete on paper and inconsistent on site, because the person accountable for it cannot actually make the rest of the business comply.

REPORTING LINE — WHY IT MATTERS ISOLATED OWNER (findings filtered) System owner Operations softened Top management

DIRECT-LINE OWNER (this brief's rule) System owner direct, unfiltered Top management Same person, same findings — the only variable is whether the signal reaches top management intact or gets filtered on the way.

Dedicated role or shared across leaders? Sizing it to the business

Business sizeTypical structureWhat makes it work
10-50 staff, 1-3 concurrent projectsShared - a senior operations or project leader carries it as a protected 20-30% allocationThe allocation is named and defended, not absorbed into "other duties"
50-150 staff, several concurrent projectsSplit - a systems-side owner (documents, audit schedule, management review) plus project-side owners feeding site evidenceBoth sides report the same data to top management; neither can quietly under-report
150-250+ staff, multiple concurrent projects, high subcontractor churnDedicated role, direct line to top managementThe role has genuine authority to raise and enforce NCRs against project leadership

The size bands are a starting point, not a rule - project count and subcontractor complexity move the right structure more than headcount alone does. A 40-person business running six concurrent civil packages needs more than a 20% allocation; a 90-person business with two long-run contracts might not.

What does top management have to give this person to make it work?

Three things, and they cost intention rather than money: visible authority (say it in front of the leadership team, not just in the position description), protected time (name the allocation in project planning, and don't let it be the first thing cut), and a real management review (read the outputs, ask questions, resource what the findings say needs resourcing - rather than treating the meeting as a formality before the audit).

Get those three right and the rest of the system tends to follow, because the person running it finally has what they need to make it actually run - not just look complete on the day someone checks.

Where to start

If your management system owner cannot point to a nonconformance they raised against a project leader and had actioned in the last quarter, that's the first signal - not a documentation gap, an authority gap. Our free audit-readiness check looks at ownership and authority as part of the review, not just document content, and gives you an honest read on where the structure needs to change.

FAQ

Does my management system need a full-time Management Representative? Not until you're roughly 100-150+ staff with multiple concurrent projects. Below that, the role works well as a defined, protected part of an existing leader's job - the failure mode isn't a shared role, it's an unprotected one.

Who is usually the wrong person to own the management system? Whoever has the least authority to make anyone else comply with it. A junior admin or quality coordinator with no line authority over site supervisors or project managers can maintain documents, but cannot make the system run - and that gap shows up at audit as inconsistent site-level evidence.

What authority does a Management Representative actually need? The ability to raise a nonconformance against a project manager or site supervisor and have it acted on, direct reporting access to top management (not filtered through operations), and protected time that isn't the first thing cut when a project runs hot.

How much time does the role really take? It scales with project count and headcount, not with company revenue. A business running two or three concurrent projects can often manage the role at 20-30% of one person's time; multiple concurrent projects with subcontractor churn usually needs more, and a growing business should re-check the allocation every 12 months, not set it once.

Can ownership be split across more than one person? Yes, and for many contractors it should be - a project-side owner (site-level compliance, NCRs, inductions) and a systems-side owner (documents, internal audit schedule, management review) can work well together, provided both report the same information to top management and neither can quietly let the other's half slide.

What does top management actually have to do to make this work? Back the role publicly and specifically - state in front of the leadership team that a nonconformance from this person carries the same weight as an instruction from a director, protect the time allocation in planning, and read the management review outputs rather than rubber-stamping them.

Want plain feedback on your governance?

30 minutes. No pitch.

Jemma Kennedy

Founder, Hillview Business Services. 15+ years inside civil construction, mining and infrastructure businesses.

Frequently asked questions

Find out where you stand.

Free, thirty minutes, no pitch.