Eight community team roles and who holds the decision rights for each

A role describes accountability and work, not always a separate employee. A small English organisation may combine several community team roles; a larger service may split them between staff and suppliers. Each of the eight community team roles below names the decision its holder owns, plus a real tool, body or framework that carries the duty in practice.

What to take away

1. Accountable owner

This person approves purpose, scope, risk acceptance, budget and continuation. They can pause the service when member safety or operating capacity falls outside the accepted boundary. Their authority should stay clear when delivery is outsourced.

In central government, the GOV.UK Service Manual gives that duty to a named service owner. For a charity, the Charity Commission's guidance CC3, The essential trustee, places overall responsibility with the board. A company records its directors at Companies House.

2. Community operator

The operator welcomes members, facilitates activity, identifies unanswered needs, applies routine rules and keeps the working queue moving. They need access to experts and permission to escalate, not an expectation that they answer every subject alone.

Most of this work runs in named tools. Discourse handles long-form forums and is open source, so it can be self-hosted at no licence cost. Slack carries day-to-day channels, Meetup lists events and Mailchimp sends the newsletter. Mailchimp's free tier covers up to 500 contacts.

3. Moderator or safety lead

This role designs and reviews moderation practice, trains operators, handles serious cases and monitors appeals. For an in-scope online service, the duties connect to the provider's regulatory assessment. Ofcom's guide for online services is the regulator's starting point, not a generic job description.

As of 9 May 2026, the Online Safety Act 2023 sets the framework, and Ofcom's first illegal content codes of practice were published in December 2024, with the duties starting on 17 March 2025. Reports of child sexual abuse imagery go to the Internet Watch Foundation.

4. Subject expert

Product, professional or policy experts give authoritative answers and correct dangerous or inaccurate material. Set their availability and the route for a query, usually a ticketed queue such as Zendesk or a named channel. An expert with no allocated hours cannot support a service promise.

Useful named sources include Citizens Advice for consumer and benefits questions, the CIPD for employment practice and NHS services for health content. Each needs cover while the named person is on leave.

5. Member researcher

The researcher recruits beyond active contributors, investigates unsuccessful journeys and tests changes. They keep evidence separate from assumption and protect participant information.

Nielsen Norman Group publishes widely used usability methods. The Market Research Society's code of conduct governs UK research practice. This duty may sit with a service designer or an experienced operator where competence and independence are adequate.

6. Data protection owner

This person oversees processing purposes, roles, retention and individual rights, plus supplier arrangements. The title depends on the organisation and legal requirements. Do not call somebody a data protection officer unless the formal role and independence requirements are met; UK GDPR Article 37 sets those out.

The Information Commissioner's Office publishes guidance for controllers and processors. At the time of writing, its annual data protection fee is 40 or 60 pounds for most small organisations and 2,900 pounds for the largest tier. Route data decisions to the accountable function rather than expecting moderators to improvise.

7. Technical and security administrator

This role manages configuration, identity, integration and privileged access. It also covers monitoring, recovery and supplier incidents. Separate ordinary administration from approval of material changes, and keep a second authorised route so one absent person is not the only way in.

Cyber Essentials, the scheme run by the NCSC and certified through IASME, tests five controls: firewalls, secure configuration, user access control, malware protection and security updates. At the time of writing, small organisations typically pay 300 to 500 pounds plus VAT for certification.

8. Insight and improvement lead

The analyst defines measures, samples quality, links member evidence to organisational decisions and reports limitations. They should separate activity, workload, outcome and safety instead of blending them into one engagement score.

Google Analytics 4 and Matomo cover web behaviour. NCVO's UK Civil Society Almanac gives annual sector benchmarks on staffing and income, useful when a board asks for a comparison.

Allocate the work

Create a table of tasks and decision owners. Add the performer, consulted specialist, cover and evidence for each. Trace an ordinary contribution, an appeal, a privacy request and an outage. Every handoff needs a recipient and an expected response.

Add capacity assumptions to the table. One person can hold several roles during a small pilot, but simultaneous incidents can still conflict. State which task takes priority and what service is reduced. For larger groups, decide when volume triggers extra cover rather than waiting for an exhausted operator to ask for help.

External suppliers need internal counterparts. An agency moderator requires a policy owner; a platform support team requires a technical contact. Outsourcing activity does not outsource the buyer's decision about its members.

Where contractors or volunteers are used, assess the actual relationship and responsibilities. Acas explains employment status and notes that status affects rights and employer responsibilities. Acas does not decide status from a job title, so take advice on the facts.

Review role allocation after a pilot and after staff change. If work repeatedly lands with an unlisted colleague, correct the operating model. Clarity means the member gets a responsible response even when the familiar operator is away. Document temporary delegates before leave begins.

Worked example: combining roles

For illustration, a small English charity might combine the eight roles as follows.

This is an illustrative model, not a real organisation.

Before you act

Common questions

What does the accountable owner approve and control?

Purpose, scope, risk acceptance, budget and continuation, plus the pause decision when safety or capacity falls outside the accepted boundary. The governance sources are in section 1.

Why should you not call somebody a data protection officer lightly?

The formal DPO role carries independence and legal duties under UK GDPR Article 37. Use a different title for someone who only coordinates data decisions. Section 6 has the ICO guidance.

How should a service handle cover when one person holds several roles?

Set priority for simultaneous incidents, name a deputy and reduce service if cover is short. Review the arrangement after a pilot or staff change. The task table in Allocate the work shows where to record it.