1. Create the policy

First, policy owners must create the policy. This is likely to be an offline process which can involve various different policy owners, stakeholders and owners. It’s likely to be done in a document format, and may have gone through several revisions. In particular, starting a new policy from scratch is not necessarily a rapid process.

2. Upload the document to a library

When a draft policy document is ready, it can be uploaded to a repository ready for dissemination. This is likely to be an appropriate document library within an intranet or SharePoint site, for example.

3. Send the document for review and approval

It’s important to check that the policy document is the correct version, so there will often be some review and approval workflow from appropriate stakeholders to make sure everything has been approved. In practice, reviews will likely have already taken place offline if a new policy has been created from scratch. However, if it is a new version of a policy with only some changes to confirm, then this review and approval workflow stage works very well.

4. Document approved and accessible within the document library

Once the document has been approved for organisational use, it will be displayed in the document library and given a suitable version control number, such as V2.0. Important additional information should also be displayed such as the date and the policy owner, as well as elements like the category. At the same time, the previous version of a policy will be retired.

5. Distribute the document and trigger an attestation process

With the document accessible, it’s now time to distribute the document to the entire organisation or to targeted groups; the latter could be reflected in your Active Directory.

Distributing the new policy could be as simple as drawing attention to it through a communication, but there may also be a need for an employee attestation process whereby all employees must confirm they have read the new policy. This could be because it is important for internal or external compliance, or both. Using software like Xoralia, you can automate the attestation process, with every employee getting a notification and link to the policy and related confirmation form.

You can also ensure that the attestation process is triggered for new starters, for example, who need to review a particular policy as part of their onboarding process.

6. Review attestation status for each employee and chase if required

It’s now time to review the attestation status for each employee and, if necessary, chase them to take action; policy management software will have in-built report to help with this.

If an employee does need to be chased, it can be done through automated reminders if there has been no action after a certain amount of time or by a certain deadline, or a direct message from their line manager.

7. View overall reporting and attestation status for each policy

As more employees confirm they have read the policies, administrators and policy owners can then review the overall attestation status for each one.

8. Meet compliance requirements and report for audit

As admins view the overall attestation status of a policy, they can take action until everybody has confirmed they have read and understood it, meeting any compliance requirements. There should be some reporting to provide confirmation that the compliance has been met, to be used with external third parties for auditing and certification purposes.

9. Review the policy

Policies need to be regularly reviewed so they remain up to date. Ideally, a review period or date should be set to automatically prompt the owner to review the policy and see if it needs an update. At other times, there might be a trigger such as change in legislation or an incident that could prompt a review of policies. During its lifecycle, a version of a policy will go through multiple reviews.

10. Retire and replace the policy

A policy will eventually be replaced by a later version, or sometimes replaced entirely. The lifecycle is then complete.