The Authorising Officer is ultimately responsible, but daily duties fall to the Level 1 User and HR/compliance staff. Many businesses schedule quarterly internal reviews or outsourced audits to minimise the risk of suspension or revocation.