Who Owns What? How to Design a Co-Managed IT Responsibility Model

A security alert lands at 4pm on a Friday. Your internal IT team sees it. So does your IT partner. Each assumes the other is dealing with it, and by Monday morning, nobody has.

It’s a scenario we’ve heard more than once, and it highlights something important about co-managed IT. When it goes wrong, the technology is rarely to blame. The real problem is ambiguity: tickets sitting in the wrong queue, changes made without the right approval, and grey areas that everyone assumes somebody else is covering.

More meetings won’t fix it. A clear responsibility model will – as long as it’s agreed at the very start and built into the way both teams work every day.

Here are seven things we recommend getting right:

1. Map the services, not just the tasks

Start by listing the services that make up your IT function: service desk, endpoint management, Microsoft 365, identity, networking, backup, security monitoring, supplier management and projects. For each one, agree who does the work, who’s accountable for the outcome, who needs to be consulted before changes, and who simply needs to be kept informed. A simple RACI matrix at service level is far more useful than a long list of individual tasks, and gaps become obvious very quickly.

2. Agree the technical boundaries

Shared environments need technical boundaries as well as organisational ones. Decide which accounts each team uses, which parts of the environment each can change, and how privileged access is granted and reviewed. In Entra ID or Active Directory, that might mean delegated permissions at administrative unit level rather than handing out global admin rights. At Clarins UK, for example, Clarins Groupe IT in Paris owns certain platforms and policies. We look after local accounts and devices, while group-level changes go through the group’s approval process. Everybody knows exactly where the lines are.

3. Use one ticketing flow, even with two tools

Your internal team probably has its own service desk tool, and so does your partner. Forcing either side to give theirs up rarely goes down well. A much better answer is to integrate the two, so tickets, updates and status changes flow both ways. At Clarins, we connected our ticketing system with the group’s service management platform. This removed duplicate entries and let both teams keep the tools they prefer. Whatever the setup, agree which tickets go where, how they’re reassigned, who talks to the user, and how SLAs are measured when a ticket crosses teams.

4. Write the escalation path down

Escalation should never depend on who happens to know whom. Document your priority definitions with real examples. Mention who to escalate to at each level in both organisations; include out-of-hours contacts, and explain when the internal IT lead must be told, no matter who’s handling the issue. Then test it. A short tabletop exercise will expose gaps much faster than reading the document ever will.

5. Bring every change under one process

Change management is where co-managed arrangements are most exposed. Agree a single process for standard, normal, and emergency changes, with named approvers on each side. If your organisation already follows a framework like ITIL or COBIT, align to it rather than inventing something new. It gives both teams a shared language and makes audits much easier.

6. Report on the partnership, not just the tickets

Monthly reporting should cover more than ticket volumes. Include SLA performance, recurring issues, security posture, project progress and the actions each team owes the other. The aim is one honest view of how your IT function is performing, regardless of who did the work.

7. Review it regularly

A responsibility model isn’t a document you write once and file away. As the business grows, adds systems or takes on new risks, it needs revisiting. A quarterly review keeps it current and stops old assumptions turning into new gaps.

You can read more about how this works in practice in our Clarins UK case study.

Signs that your responsibility model needs attention

It might be time for a rethink if tickets regularly bounce between teams, users aren’t sure who to contact, changes are being made without anyone on the internal side knowing, or monthly reports tell you what was done but not how well. Another warning sign is when the answer to “Who owns this?” starts with “I think…”.

Setting up a co-managed partnership?

Here at Reliable, we help internal IT teams design co-managed arrangements that actually work day to day, from responsibility mapping and admin boundaries to integrated ticketing and escalation.

If you’re planning a new partnership or want to tighten up an existing one, book an introductory conversation with our team and we’ll talk through where the grey areas are.

When everyone knows who owns what, two teams start working like one.