Ask five people at a 200-employee company who is responsible for the EPF ECR filing, and you will often get five different answers. HR says payroll handles it. Payroll says it’s a finance sign-off. Finance says HR owns the data. The admin manager thought the new compliance software handled it automatically. Nobody is lying, and nobody is being lazy, the role was simply never written down anywhere a person could check it.
This is the single most common cause of missed filings, not ignorance of the law, not lack of tools, but an undefined RACI (Responsible, Accountable, Consulted, Informed) for who does what, who signs off, and who gets told when something goes wrong. This guide sets out the actual roles involved in Indian statutory compliance, how to build a working RACI matrix for them, and the monthly operating rhythm that keeps the whole thing running without depending on one person’s memory.
Why Compliance Management Fails Where Ownership Is Undefined
Most compliance breakdowns are not knowledge failures. The compliance manager usually knows the EPF ECR is due on the 15th. What fails is the handoff: payroll finalizes data late, nobody flags that as a compliance-affecting delay rather than a payroll delay, and the filing slips because no single person was accountable for catching it in time.
A RACI matrix exists to close exactly this gap. It assigns, for every recurring compliance task, who does the work (Responsible), who is answerable if it fails (Accountable), who must be consulted before it’s finalized, and who simply needs to be informed once it’s done. Without this written down, “the team handles it” quietly becomes “nobody specifically owns it,” and that’s the condition under which filings slip.
What a Compliance RACI Matrix Actually Maps
A compliance RACI matrix is not an org chart. It’s a task-by-task assignment table, built around your actual recurring statutory obligations, not job titles. The same person can be Responsible for one task and merely Consulted on another. The matrix answers four questions for every task on your compliance calendar:
- Responsible: who actually prepares the filing, register, or return
- Accountable: who signs off and is answerable if it’s wrong or late (there should be exactly one Accountable person per task, never more)
- Consulted: who needs to review or provide input before it’s finalized (often a second department, like finance confirming a wage figure)
- Informed: who needs to know it happened, without being involved in producing it (often leadership, for visibility)
The Five Core Roles in Indian Statutory Compliance
Across most Indian companies, regardless of size, the same five functional roles recur in statutory compliance, even when the same individual wears more than one hat:
1. The Preparer (usually HR or Payroll Executive). Pulls the underlying data, drafts the filing or register, and is the first point of error-catching.
2. The Reviewer (usually a Compliance Manager or Senior HR). Checks the preparer’s work against the applicable act’s requirements before it moves forward. This is the Consulted role in most RACI structures.
3. The Accountable Sign-Off (usually a Compliance Manager, Company Secretary, or CHRO depending on company size). The person whose name is effectively on the filing. In a maker-checker-DSC workflow, this is the person holding the Digital Signature Certificate.
4. The Escalation Owner (usually CFO or COO). Gets involved only when something goes wrong, a missed deadline, a notice, a flagged discrepancy, not for routine filings. This role exists specifically so escalation doesn’t default to “whoever happens to notice.”
5. The Informed Executive (usually CEO/Managing Director). Doesn’t touch the task but needs visibility into overall compliance health, typically through a dashboard or periodic summary rather than individual filings.
Building Your RACI Matrix, Act by Act
A single company-wide RACI is too generic to be useful. Build it per statutory obligation. A representative example for a mid-size manufacturer:
EPF ECR (monthly, due 15th): Responsible: Payroll Executive. Accountable: Compliance Manager. Consulted: Finance (wage data confirmation). Informed: CHRO.
ESIC contribution (monthly): Responsible: Payroll Executive. Accountable: Compliance Manager. Consulted: HR (employee coverage changes). Informed: CHRO.
Factories Act registers, e.g. Form 25 Muster Roll (ongoing, state-specific format): Responsible: Factory HR/Admin. Accountable: Plant HR Head or Factory Manager. Consulted: Compliance Manager (format correctness). Informed: COO.
CLRA half-yearly return, Form VI-B and Form XXIV (due 31 July and 31 January): Responsible: Vendor Compliance Executive. Accountable: Compliance Manager. Consulted: Procurement (vendor contract terms) and Legal. Informed: CFO (liability exposure).
Shops & Establishment licence renewal (annual or multi-year, state-specific): Responsible: Admin Manager. Accountable: Company Secretary or Legal Manager. Consulted: Finance (renewal fee budgeting). Informed: CEO/MD.
Notice the pattern: Responsible shifts by function (payroll vs. factory admin vs. vendor team), but Accountable consistently sits with whoever holds sign-off authority for that category, usually the Compliance Manager, with escalation-worthy items (CLRA liability, licence renewals) also informing the CFO or CEO directly.
The Monthly Compliance Operating Rhythm
A RACI matrix tells you who. An operating rhythm tells you when, and it’s what actually prevents the matrix from becoming a document nobody looks at after the first month. A working monthly rhythm looks like this:
Week 1 (1st to 7th): Prior month’s payroll data locked. Preparers begin drafting EPF/ESIC/PT filings. Any new joiner or exit data reconciled against UAN and ESIC registration status.
Week 2 (8th to 15th): Reviewer checks drafts. EPF ECR and ESIC contributions filed by the 15th (EPF) and 15th/21st (ESIC, depending on the specific contribution cycle). Accountable sign-off applied via maker-checker-DSC before submission.
Week 3 (16th to 22nd): Register upkeep window, factory registers, S&E registers, vendor documentation collection for the current month. This is also when licence renewal dates 60/30/15 days out get reviewed and flagged if any are approaching.
Week 4 (23rd to month-end): Monthly compliance review meeting, Accountable owners report status to the Informed layer (CHRO, COO, CFO), any flagged gaps get an owner and a target date, and the following month’s calendar is confirmed before it starts.
This rhythm doesn’t need to be elaborate. It needs to be the same four windows, every month, so that a filing slipping isn’t discovered reactively but shows up as a gap in a review that was always going to happen regardless.
Where Maker-Checker-DSC Sign-Off Fits the Rhythm
The RACI’s Responsible and Accountable roles map directly onto a maker-checker-DSC workflow: the Preparer is the maker, the Accountable sign-off holder is the checker, and the Digital Signature Certificate step is what formally closes the task, converting an internal draft into a filed, legally binding document with a clear audit trail of who approved what and when. This is the operational mechanism that makes a RACI matrix enforceable rather than aspirational, since the system itself won’t let a filing go out without the Accountable person’s review, regardless of deadline pressure. See how Iztty’s Maker-Checker-DSC workflow engine applies this structure directly to the filing process.
What Breaks When Roles Are Left Undefined
Three patterns repeat across companies that haven’t formalized this:
The “everyone assumed someone else had it” filing gap. A task with no clearly Accountable person gets treated by three different people as someone else’s job, and the actual filing happens late or not at all, discovered only when a notice arrives.
The single point of failure. One person, usually the original compliance hire, becomes the de facto owner of everything by default, and when they leave or take extended leave, institutional knowledge about which state has which quirk leaves with them.
The escalation that never reaches leadership. Without a defined Informed layer, a compliance gap can sit at the HR or payroll level for months without the CFO or CEO ever knowing it existed, which is precisely the kind of gap that surfaces during funding-round due diligence rather than internally.
How This Changes at Multi-State and Multi-Vendor Scale
A single-location RACI matrix doesn’t scale by simply copying it across branches. Each state introduces its own Shops & Establishment, Professional Tax, and Labour Welfare Fund requirements, which means the Responsible role for register upkeep needs to sit with someone who actually understands that state’s specific rules, not a central HR team applying one state’s process everywhere. Multi-state companies typically add a state-level Compliance Coordinator role, Responsible for that state’s filings, reporting up to a central Compliance Manager who holds overall Accountability.
Vendor and contract labour adds a parallel structure entirely: the Vendor Compliance Executive role (Responsible for collecting and verifying contractor EPF/ESIC documentation monthly) typically doesn’t exist at all in companies before their first contractor engagement, which is exactly why principal employer liability under the Contract Labour (Regulation and Abolition) Act, 1970 so often goes unmanaged until it’s already a problem. We cover this specific liability mechanism in full in Vendor & Contractor Compliance: Managing Principal Employer (PE) Liability.
RACI for Compliance Consultants Managing Multiple Clients
For a statutory compliance consulting firm managing several client companies, the RACI structure adds a layer: the consultant’s own team is Responsible for preparing filings across multiple client accounts, but Accountable sign-off still legally belongs to each client’s own authorized signatory. This is a distinct operational challenge, keeping dozens of clients’ filing calendars, role assignments, and sign-off chains separate and auditable within a single team, which is why Iztty offers a dedicated Compliance Consultant account type built for firms managing multiple client companies from one dashboard, with per-client RACI and DSC-holder separation rather than a single shared workflow.
A Practical Starting Checklist
To build your own RACI and operating rhythm starting this month:
- List every recurring statutory obligation your company actually has, not a generic template, specific to your states and acts
- For each one, name the Responsible, Accountable, Consulted, and Informed person by role, not just department
- Confirm exactly one Accountable person per task, never shared accountability
- Set the four-window monthly rhythm (data lock, filing, register upkeep, review) and put the review meeting on a recurring calendar invite
- Identify your single points of failure, any task where only one person knows how to do it, and begin documenting or cross-training against that risk
If you’d rather see this mapped against your specific states, acts, and team structure rather than building it from scratch, book a free compliance audit with Iztty, which includes a RACI and calendar review as part of the baseline assessment.
FAQs
What is a RACI matrix in compliance management?
It’s a task-by-task table assigning who is Responsible (does the work), Accountable (signs off and answers for it), Consulted (reviews before finalization), and Informed (notified after) for each recurring statutory obligation.
Who should be Accountable for EPF and ESIC filings?
Typically the Compliance Manager or equivalent senior HR role, since they hold sign-off authority. There should be exactly one Accountable person per filing, never a shared or ambiguous accountability.
How is a RACI matrix different from an org chart?
An org chart shows reporting lines. A RACI matrix shows task-level accountability, and the same person can carry different RACI roles across different compliance tasks depending on their expertise, regardless of their position in the org chart.
Do small companies need a formal RACI matrix?
Even a 20-person single-state company benefits from writing down who owns each filing, since the “everyone assumes someone else has it” gap happens at small scale too, often because there’s no dedicated compliance hire at all.
How does a monthly operating rhythm prevent missed filings?
By building in a recurring review window (typically the last week of the month) where every task’s status gets checked against the RACI, a gap surfaces during a scheduled review rather than being discovered only when a deadline is already missed.
What happens when the Accountable person for a task leaves the company?
This is exactly the single-point-of-failure risk a documented RACI is meant to prevent. If the role and its requirements are written down rather than held only in one person’s memory, a successor can take over the Accountable role without a compliance gap opening up during the transition.
Where does Maker-Checker-DSC fit into a RACI structure?
It operationalizes it. The maker role maps to Responsible, the checker role maps to Accountable, and the Digital Signature Certificate step formally closes the task, creating an audit trail that shows the RACI was actually followed, not just documented on paper.
Does the RACI change for multi-state operations?
Yes, most multi-state companies add a state-level Compliance Coordinator role, Responsible for that specific state’s filings, since Shops & Establishment, Professional Tax, and Labour Welfare Fund rules differ by state and a single centralized Responsible owner can’t realistically track all of them accurately.
How does vendor and contract labour compliance fit the RACI model?
It typically needs its own dedicated role, a Vendor Compliance Executive, Responsible for monthly collection and verification of contractor EPF/ESIC documentation, since principal employer liability under the CLRA exists independent of whether this role has been formally assigned.
Can a compliance platform replace the need for a RACI matrix?
No, a platform enforces and automates the RACI, flagging gaps, routing sign-offs, maintaining audit trails, but the underlying decision of who is Responsible and who is Accountable for each task is a human organizational decision the company still has to make first.
How often should a RACI matrix be reviewed and updated?
At minimum annually, and immediately after any structural change: a new state of operation, a new contractor engagement, a role change, or crossing a statutory coverage threshold such as ESI Act applicability.
