A growing number of Xoralia customers from the public sector, education, faith-based and not-for-profit space need to make their policies available to people outside their organisation. The groups they are reaching out to include parents, volunteers, funders, regulators and the general public; the reasons for publishing a policy on their website are equally diverse, ranging from making a safeguarding standard available to issuing a Code of Conduct.
Everyone who publishes policies externally faces the same practical problem. The approved version of the policy lives in one place, the website copy lives in another, and nobody is ever quite sure whether the two are aligned and in sync.
This article is about closing that gap. We’ll look at why public policies are now expected rather than optional for many organisations, the two ways most teams currently get policies onto their website and where each one can fall down, and what it looks like when publication is the last stage of the approval workflow rather than a separate job somebody has to manually track.
Summary
To publish policies on your website reliably, treat publication as the final step of policy approval rather than a separate upload. Each public policy should have one approved version, a stable link on the website that always provides the latest version, and a clear decision recorded about which policies are public and which are not. Maintaining a second copy on the website such as a re-uploaded PDF or a page in the CMS is where the process fails, because when you have to maintain two versions of a policy there is always the risk they will diverge, especially when you have to rely on somebody remembering to update the website version.
Why do organisations need to publish policies publicly?
Policies get published externally because someone outside the organisation has a right, a good reason or a strong expectation to read the policies. The clearest recent example is in Australia. Queensland’s Child Safe Organisations Act 2024 commenced on 1 October 2025, and the Queensland Family and Child Commission’s guidance on Standard 10 (policies and procedures) asks organisations to make sure documents can be located and understood by staff and volunteers and to make relevant documents publicly available. The commission’s resources go further for specific documents - the child safety and wellbeing policy and code of conduct should be publicly available or available on request, and the organisation’s commitment to child safety should be publicly available and promoted to everyone who interacts with it. The other Australian states have similar schemes built on the same National Principles, and a Reportable Conduct Scheme follows in Queensland from 1 July 2026.
Other examples include safeguarding policies that charities, sports bodies and schools are expected to make visible or privacy notices that must be accessible to the people whose data you hold. Larger organisations need to publish modern slavery statements. Procurement questionnaires may ask for a link to your policies rather than an attachment. In the US, accreditation bodies and state regulators demand much the same for healthcare and education providers. Here, policies are expected to be current and a regulator, auditor or parent needs to feel confident that they are.
Where does publishing policies to a website usually go wrong?
The publishing process usually falls down in the gap between approval and upload. Most organisations we speak to do one of two things:
Re-uploading the PDF. Someone in communications or the executive office is emailed the new approved policy, saves it as a PDF, logs into the website and replaces the old file. This is fine when it happens. The problem is that it depends on the person being told, having website access, and doing it promptly and the policy approval system (if there is one) has no idea whether it happened. When the comms lead is on leave, or the policy owner forgets that this particular policy is also on the website, the old version stays available publicly and nobody is alerted. We’ve also seen the opposite: a draft that was circulated for comment gets uploaded because it looked final.
Keeping a separate copy in the website CMS. Some organisations paste the policy into a web page so it is readable without a download. This is better for accessibility but worse for control, because you now have two documents with two editing histories. Changes made in the approved version have to be re-keyed into the page, and formatting differences (numbered clauses, defined terms, tables) make it easy to miss one. Over time the web page becomes its own version of the policy, which is exactly what a document control process is meant to prevent.
Both approaches share the same weakness: the website copy is maintained by hand, so the organisation has to prove, every time, that the hand did its job. A better question to ask is whether the website needs a copy at all, or whether it just needs a reliable link to the approved version.
How do you publish policies to a website from one approved version?
The approach we recommend has three parts:
1. Decide which policies are public, and record it on the document
Not every policy should be published on your website and it’s best to decide which ones early on. Policies that reference internal contact details, escalation phone numbers, system names or named individuals usually need either a public-facing version or a decision to publish on request only. Procedures and schedules that only make sense alongside an internal policy can also confuse an outside reader more than they help.
The practical way to handle this is a Tag on the document itself. A “Sensitivity” or “Audience” Tag with a Choice value like Internal / Public / Available on request means the decision is visible to the policy owner, the approver and whoever runs the website, and it travels with the document through every review. We see this Tag come into force in many public sector and contractor-facing implementations because it makes it very clear which policies can be viewed outside the organisation and which can’t.
2. Give every public policy one stable link
A stable link (sometimes called an evergreen link) is a URL that always resolves to the current approved version of a document, whatever happens to the file behind it. When the policy is reviewed and a new version is approved, the link stays the same and the content behind it changes. Your website, your intranet, your onboarding pack and your QR code posters all point at the same address, and none of them need updating when the policy does.
This stable link removes the need to have a second copy of the document. The website no longer holds a PDF that has to be updated and kept in sync; instead, it has a link to the approved document, so the public always sees the version your approvers signed off and nothing else. It also means a draft under review is never visible on the link.
3. Make publication the last stage of the approval workflow
Once the final stage of the approval workflow is complete, then publication available to the public gets automatically updated right away. The publication is not forgotten, cannot happen early, and is recorded alongside the approval itself so there is a record of who approved it, when, and which version went live.
How it works at the Catholic Diocese of Rockhampton
The Diocese needed a set of policies including safeguarding, code of conduct, complaints, privacy, reportable conduct and others made available on its public website, as expected under Queensland’s child safe organisation requirements. At the same time the Diocese needed to keep its full set of internal policies, procedures and schedules controlled behind within its internal Microsoft 365 environment.
The Diocese’s policies are managed in Xoralia, and the publishing step was configured in coordination with the approval workflow. When a document that has been marked for external publication gets approved and published, a Power Automate flow is triggered by the publication and pushes the approved version to the website, so the public policies page always resolves to the version the approvers signed off. The page at rok.catholic.net.au/our-diocese/policies/ lists 26 documents, and none of them are maintained as separate copies - the website team added the links once and the flow has kept them current since.
Source: The Catholic Diocese of Rockhampton
The automated publishing process has made managing our public-facing policies very easy. Once an approved document is marked for external publication, it seamlessly appears on our website without us having to maintain and upload a separate copy, saving time and helping ensure the public always sees the current version.
Dean Smith BBus FCPA MBA GAICD, Director of Diocesan Services, Catholic Diocese of Rockhampton
The key point here is that there is no separate copy to upload onto the website. Nobody in the Diocese has to check whether the website matches the policy register, because the website is the register for those documents.
What should you decide before making policies external?
A few things need to be considered before making any policies available externally. We always urge teams to plan early when that is part of an Xoralia implementation.
- Which documents are public. Agreeing this across policy owners takes a meeting, not an email, because owners are often unsure whether their policy contains anything they’d rather not publish. Start with the documents a regulator or funder has actually asked for (in Rockhampton’s case the safeguarding and conduct set) and extend from there.
- Public-facing versions. Some policies will need a separate version without internal phone numbers or system references. That is a drafting job, and it needs its own owner. Using Xoralia's linked documents functionality is a great way of keeping track of both and ensuring one update feeds through to the other.
- How the policies are displayed on the website. The website team still owns the page, its navigation and its accessibility so ensuring policies are organised and easy to find is important.
Who else offers public policy publishing?
Several policy management products handle this, and it is reasonable to compare them using the same criteria:
- Does external publication happen as part of publication or as a separate action?
- Does the website hold a copy of the policy or a link?
- Is the public version tied to the approval record?
Mitratech’s PolicyHub has a public access portal in which policies set to “Public” can be hosted or linked from a website, with only the current active version visible. Onspring states that policies can be published directly to SharePoint or other sites. NAVEX PolicyTech and ConvergePoint approach it through portals and permissions. If you already manage your policies on Microsoft 365, the question becomes whether the public link can be governed by the same approvals and permissions as everything else you manage in SharePoint.
Xoralia is compliance management software for Microsoft 365. It controls policies, SOPs and regulated documents, and proves every review, approval and attestation with a timestamped audit trail - document content by default stays in your SharePoint environment, governed by your own Entra ID and permissions. It is built by Content Formula, a Microsoft 365 consultancy that delivers across out of the box, in-a-box and custom build, which is why configuration like the Rockhampton publishing step sits comfortably alongside the product. Its an active choice to decide to publish your policies, and only the ones you choose to make external.
Want to see how a policy flagged as public moves from approval to your website?
Book a short Xoralia demo and we’ll walk through the workflow stage, or read how document reviews and version control work first.
Frequently asked questions
Do organisations have to publish their policies on their website?
Which policies should be published publicly?
What is an evergreen link for a policy?
How do you keep the website version of a policy up to date?
Can you automate publishing policies to a website?
About the author
Amber Oakes
Product manager
Amber is a Product Manager at Content Formula, helping shape Xoralia, a policy management platform built for Microsoft 365. She focuses on ensuring the platform addresses real challenges around policy access, compliance, and adoption. She writes about policy management, user adoption, and real-world challenges, drawing on direct experience and conversations with teams managing policies day-to-day.