“We thought your team was handling that.”

That’s an expensive sentence to hear when a system is down and everyone is waiting for someone else to fix it. Your internal IT staff thought the outside provider was responsible. The provider understood that its role was limited to supporting your staff. Meanwhile, employees are waiting, and the business is losing time.

Co-managed IT brings your internal team and an outside IT provider together to support the business. A responsibility matrix documents how they divide that work, including who is accountable when something needs attention.

That document needs to be one of the first things completed. “We’ll work together” leaves too much open to interpretation.

What is a co-managed IT responsibility matrix?

A co-managed IT responsibility matrix is a shared document that identifies which tasks belong to your internal IT staff, which belong to your provider, and where coordination is required. It also establishes who approves decisions and how unresolved issues get escalated.

The document should be specific enough that someone can use it during an actual problem. “Backup management” is a category. It doesn’t explain who checks failed backups or who tests whether the business can recover its data.

Some organizations use a RACI matrix, which identifies who is responsible, accountable, consulted and informed. Whatever format you use, everyone involved needs to understand their commitments and agree that they have the resources to meet them.

Why does co-managed IT need clearly defined responsibilities?

An internal IT manager often brings in outside support because the workload has grown beyond what the existing team can reasonably handle. The provider adds capacity or expertise, but the division of responsibility still needs to be agreed on.

Without that discussion, the internal team starts relying on services the provider hasn’t included. The provider assumes certain work remains with internal staff. Both sides are busy, and the gap stays hidden until something goes wrong.

For a manufacturer, that gap can affect production. For an accounting or law firm, it can prevent employees from accessing client files. A company with several locations also needs to know whether the same support arrangements apply at every site.

The business owner is paying for help. They need to understand what that help covers and what still depends on their own people.

What should a responsibility matrix include?

Start with the work your business depends on, then document the actual division of responsibility. Avoid assigning broad categories without explaining what they include.

This simplified example illustrates the level of detail to discuss. The assignments will differ by engagement.

For ongoing services, document coverage hours and escalation expectations. For projects or corrective actions, assign an owner and a due date.

“Shared” responsibility needs particular attention. Several people can contribute to a task, but someone still needs to be accountable for making sure it gets finished.

Who manages third-party vendors and suppliers?

Vendor management belongs in the responsibility matrix because hiring an IT provider doesn’t automatically transfer every supplier relationship to them.

Suppose your ERP system becomes slow. The software vendor says the network is the problem. Your IT provider checks the network and points back to the application. Who brings them together, schedules further troubleshooting and stays with the issue until it is resolved?

That person doesn’t need to perform every technical task. They need responsibility for moving the issue forward.

The same question applies to equipment suppliers with remote access and cloud application vendors. Document who opens support cases and who can authorize changes. If vendor coordination is outside the provider’s agreement, leadership needs to know that before employees start depending on it.

What remains the business owner’s responsibility?

Some decisions require business authority. An IT provider can recommend replacing an unsupported server, but leadership still has to approve the expense and agree on an acceptable implementation schedule.

The matrix should make those decisions visible. Your internal IT manager shouldn’t inherit authority to accept a business risk simply because a recommendation has gone unanswered.

Leadership also needs to confirm that assigned employees have time to do the work. Putting someone’s name in a column doesn’t create capacity in their schedule.

When should IT responsibilities be reviewed?

Complete the initial matrix during planning and kickoff, alongside the service agreement. If it identifies work that neither side has included in staffing or pricing, resolve that before the engagement depends on it.

Review it when your IT manager leaves or a new provider takes over. Adding a location or changing a major business system also deserves another look. The document needs to reflect how the business operates now.

For Michigan businesses working with a co-managed IT provider, this is a practical document to request early. Ask both teams to walk through a few real situations using it. An after-hours outage will tell you more about the clarity of the agreement than a general promise of support.

Frequently asked questions

Does co-managed IT replace internal IT staff?

Co-managed IT supports an existing internal team by dividing agreed responsibilities with an outside provider. The arrangement should reflect the skills and capacity your business needs.

Is a responsibility matrix the same as a service agreement?

A responsibility matrix explains how work is assigned. The service agreement establishes the contractual scope and terms. They should align so the matrix doesn’t imply coverage that hasn’t been agreed on.

Who keeps the responsibility matrix updated?

Assign a named owner during kickoff. Internal IT and the provider should review changes together, with leadership approving changes that affect spending or business accountability.

Before an engagement starts, both teams should be able to explain who owns an unresolved issue and what happens next. During an outage, your employees are already waiting. You shouldn’t also be negotiating whose job it is to help them.