Policy versions

A policy version belongs to an organization and can be linked to the assessment that raised the need for review. Record the version identifier, intended audience and required reader count together. That makes the decision legible later: the reviewer can see which version was submitted and which group was expected to acknowledge it. A general statement that a policy was circulated is too loose for a version decision.

The Control Owner prepares the record and its supporting assessment. The Independent Assurance Reviewer decides on the submitted policy record. Its decision date and status keep approved and rejected outcomes distinct. The acknowledgment date records a later audience event; the team must verify that event through its agreed distribution channel. A completed status should reflect the actual acceptance rule the organization agrees during setup.

• Version. Keep the version identifier and revision together so the reviewer acts on the submitted material.
• Audience. Record who is expected to read the version and the required reader count before circulation.
• Decision. Keep the policy decision date on the policy record and the assessment review reason with the related assessment.

Decide how the organization names versions and audience groups. Agree who can prepare a submission, who can approve it and whether a returned decision requires a new revision. Define what acknowledgment means for a named audience and what evidence is needed before marking it completed. If delivery happens through an identity or communication system, configure that connection and decide which event is brought back into the acknowledgment record.

For a first cycle, choose one organization and one audience with a clear owner. Write the version identifier on the record before submission. Let the reviewer compare the submitted revision with the assessment and attachments. If the reviewer rejects it, keep that version record and submit a corrected version for a fresh decision.

Suppose an updated operating policy follows a control review in a business unit. The Control Owner records the version and audience under the organization, links the assessment and asks for review. The Independent Assurance Reviewer checks the related assessment decision and the policy record revision, then records the policy decision date and status. After approval, the team verifies the audience outcome through its agreed channel and records the acknowledgment date. The required reader count sets the completion rule; the team checks audience responses in the agreed channel.

If the version changes after approval, keep the approved record and submit a new version for review. That separation matters when an Auditor later asks which version was approved and what audience acknowledged it.

• Policy decision queue — Submitted versions waiting for an independent decision.
• Policy acknowledgments — Approved and completed versions with audience and acknowledgment dates.
• Review queue — Assessments whose supporting revision awaits review.

See policy review and completion reconciliation.