Policy management

The problem it solves

Policies drift. A draft becomes the working version, the approved copy sits in a different folder, and the review date passes unnoticed until an assessor asks when the document was last approved.

How it works

1. 1

   Draft and version

   Every change creates a version. The history shows what changed, who changed it and when, which is the question an assessor asks first.

2. 2

   Route for approval

   Policies move through review to an approver. Approval is recorded against the specific version, not the document in general.

   • Version history retained in full
   • Approval recorded per version with approver and date
   • Scheduled review dates with advance notice
3. 3

   Link to controls

   Policies connect to the controls that implement them, so a policy statement is traceable to the operational practice behind it.

Capabilities

What people remain responsible for

• Authoring and approving policy content
• Deciding review frequency for each document
• Confirming a policy reflects how the organisation actually operates