Building the Compliance Function: Roles, RACI and the Skills Map

Packaging compliance fails organisationally before it fails technically: duties distributed across packaging engineering, sustainability, regulatory, procurement and finance, owned - in the sense that matters when an authority writes - by no one. The working model this guide prescribes is a small central desk (the framework's expertise, the registers and matrix, the audit programme, the authority interface) with named category and site owners executing inside their operations (packaging decisions, data delivery, change control), joined by a RACI that assigns every duty in this guide to a role that knows it holds it. Scale adjusts the headcount; the model survives from a single part-time owner in a small producer to a department in a multinational, because its principle is ownership, not size.

This guide draws the model and the skills map beneath it.

Build the RACI from the guide's own structure: per station, the accountable owner (one name), the responsible executors, the consulted (product regulatory, food safety, legal, finance), the informed. The rows that matter most are the seams the earlier stations flagged: declaration sign-off (conformity), register and mandate maintenance (EPR), artwork claims approval (labelling), change triggers (every station, owned by the change systems of each function), and the authority interface (one door, logged). Publish the RACI where the business can find it, review it at every reorganisation - reorganisations are where RACI rows go to die silently - and test it annually with the file-production exercise: if the exercise cannot find an owner in a day, the RACI is a poster.

The function's skills are a hybrid no single profession supplies: regulatory literacy (the framework and its national layer), packaging technology (materials and constructions as the grades see them), data engineering (the master data, the cube, the reconciliations), supplier and contract craft, and the auditor's temperament. Hire and develop against the map explicitly: the central desk typically combines a regulatory lead, a packaging technologist and a data owner, with legal and finance as standing consultees. External support (consultants, laboratories, representative networks) is bought against the same map - as capacity and specialism, never as the ownership itself, which cannot be outsourced because the authority will not accept the vendor's name in the owner's box.

For the small producer, the model compresses without breaking: one named owner (often the quality or operations lead) holding the desk part-time, the RACI on one page, the registers and matrix maintained as the owner's standing documents, external representatives and laboratories contracted for the specialisms, and the audit programme reduced to the three reconciliations run annually with an external reviewer every second year. What cannot compress is the principle: the owner's name known to the business, the authority interface singular, the calendar kept. Smallness is a resource constraint; anonymity of ownership is a choice, and it is the choice enforcement finds first.

Every artefact in this guide - the matrix, the files, the reconciliations, the calendars - is a crystallised decision about ownership: whose it is, in writing, reviewed when the organisation moves. Build the RACI first, keep it true, and the rest of the station is maintenance. Skip it, and the most sophisticated systems in this guide decay into a shared drive nobody answers for - which is, not coincidentally, the first thing a surveillance authority's questions will discover.

The function's final organisational risk is the single holder: the desk whose registers live in one person's head and habits. Succession - a deputy who runs the reconciliations in rotation, documentation that lets a stranger operate the calendar, the RACI tested by absence as well as by presence - is a control like any other, audited in the programme's cycle. Organisations insure their buildings against single points of failure. The compliance function is smaller and more flammable. Insure it with people.