Documents and acknowledgments

A controlled document has a title, version, effective date, attachment and status. The Document Controller can prepare a draft, send it through review and record an approved or obsolete state. The version matters because a later policy may replace an earlier one while both remain relevant to past assessment work. A reader should be able to identify which attached document was effective for a given review period.

A training acknowledgment links a person to a controlled document and records when that person acknowledged it. The link is the core of the evidence. It tells the Auditor exactly which document record the person acknowledged. A name on a separate spreadsheet would be harder to reconcile with the approved version and effective date.

• Controlled version. Title and version identify the policy or procedure used in a security review.
• Approval state. Draft, review, approved and obsolete distinguish preparation from active material.
• Person-level evidence. Each acknowledgment refers to both a person and a document.

Agree who writes and reviews a policy, what the effective date means, and when an older version becomes obsolete. The Document Controller should check that the attachment matches the recorded version before moving it into the approved state. If the same title has multiple versions, reviewers need a consistent way to find the one relevant to the assessment date.

Also decide which people must acknowledge each document and how that acknowledgment is collected. People records connect staff to user identities; the acknowledgment record connects a person to the document. The team should decide whether an acknowledgment is required before a person performs specific work and how to follow up with a person who has not yet acknowledged an updated version.

The Document Controller prepares a revised assessment procedure. They attach the new file, set its version and effective date, then send it for review. After approval, an Inspector acknowledges the document. The Auditor later opens the acknowledgment and checks the referenced document’s version and effective date, rather than relying on the document title alone.

Rehearse a replacement version as well. The prior document may become obsolete, but the old acknowledgment should continue to point to that old record. A new acknowledgment should point to the approved replacement. This keeps the historical trail readable when an audit finding asks which procedure applied at the time of an earlier inspection.

• Documents in review — Versions awaiting a decision before use.
• Document acknowledgments — Person, document and date for recorded acknowledgment evidence.

Use document control to rehearse version review and acknowledgment. See the data model for the document-to-person link.