Policy Governance · 9 min read
How Often Should Policies Be Reviewed? Review Cycles, Triggers and What the Law Requires
Review most policies at least once a year. Review high-risk policies, such as information security, privacy, health and safety and anything an auditor or regulator checks, every six to twelve months, and stable low-risk policies every two years. On top of the schedule, review any policy as soon as something changes what it should say: a new law, an incident, an audit finding, a new system or a change in how the business runs.
A few rules set the interval for you, such as the annual review the SEC requires of investment advisers. For most small and growing businesses, though, no law sets a date, and the real test is whether each policy still matches the law in force and the way work is actually done. This guide covers how to set a cycle by risk, what laws and standards say, the triggers for an early review, how to run a review and what to record. Governance is easier to keep up when the policies themselves live in policy management software rather than a shared drive.
How often to review policies, by risk
Set each policy’s cycle by how much is at stake if it is wrong. Here is the pattern most growing companies use.
| Risk | Review cycle | Examples |
|---|---|---|
| High: a regulator, auditor or customer checks it, or a mistake causes harm | Every 6 to 12 months | Information security, privacy, health and safety, anti-harassment, anything a certification covers |
| Medium: it affects pay, conduct or how people are treated | Every 12 months | Leave and time off, code of conduct, remote work, expenses, discipline |
| Low: stable rules that rarely change | Every 24 months | Dress code, travel booking, the policy on policies itself |
Cycles longer than two years are rare outside very stable policies, and most guidance treats three years as the outside limit. Our guide to policy governance has the same cycles broken down by policy type, alongside who owns, approves and acknowledges each one.
What laws and standards require
Most US employment law sets no review interval at all; it simply expects your policies to reflect the law in force. A handful of rules and standards are more specific.
| Source | What it says about review | Who it applies to |
|---|---|---|
| SEC Rule 206(4)-7(b) | Review the adequacy and effectiveness of the compliance policies and procedures at least once a year | Registered investment advisers |
| HIPAA Security Rule, 45 CFR 164.316(b)(2)(iii) | Review documentation periodically and update it as needed when the environment or operations change | Covered entities and business associates |
| NIST SP 800-53 Rev. 5, AC-1 and the other -1 controls | Review and update each policy at a frequency the organization sets, and after defined events | Federal systems, and companies that adopt the framework |
| ISO/IEC 27001:2022, Annex A 5.1 | Review information security policies at planned intervals and when significant changes occur | Companies certified to ISO 27001 |
| Most US employment law | No set interval; the policy must reflect the law in force, so a change in the law is the trigger | Employers, with obligations growing at 15, 20, 50 and 100 employees |
Sources: 17 CFR 275.206(4)-7(b), 45 CFR 164.316(b)(2)(iii), NIST SP 800-53 Rev. 5, AC-1, ISO/IEC 27001:2022, Annex A 5.1
If a standard or certification you follow sets a stricter interval, it overrides your own cycle. If your company answers to several, use the shortest.
When to review a policy early
A schedule catches drift, but most of the reviews that matter are triggered by a change. Review a policy as soon as any of these happens.
- A change in the law or a regulation, including new federal rules and new guidance from an agency.
- An incident or a near miss that the policy should have prevented.
- An audit finding, from an external auditor, a certification body or your own internal review.
- A new system or tool that changes how the work is done.
- A reorganization, a new location or a new line of business.
- Crossing an employee threshold, since several federal laws apply from 15, 20, 50 or 100 employees.
- A complaint or a dispute that shows the policy is unclear or not followed.
- A customer or certification requirement, such as a security questionnaire that asks for a policy you have not updated.
Laws change more often than most small businesses expect. When the Pregnant Workers Fairness Act took effect in June 2023, for example, employers with 15 or more employees needed their accommodation and leave policies updated, whatever their review date said.
How to run a policy review
A review does not need to be a project. For most policies it is an hour of the owner’s time, done on a date set in advance.
- Keep one list of every policy with its owner, its last review date and its next review date, so reviews are scheduled rather than remembered.
- Spread the dates across the year. Reviewing everything in December means nothing gets reviewed properly.
- Check the policy against three things: the law and any standard you follow, what people actually do, and what has happened since the last review, such as incidents, complaints and audit findings.
- Talk to the people who follow it. A short conversation with a manager or two finds the gaps between the policy and real practice faster than rereading it alone.
- Mark up the changes, and decide whether they are minor, such as a new contact name, or substantive, such as a new rule.
- Approve the new version through the same people who approved the last one, or the people your policy on policies names.
- Send it back out to everyone it covers and ask them to acknowledge the new version, so the record matches what is now in force.
- Record the review, even when nothing changed, and set the next review date.
A policy review checklist
Run through these questions for each policy on its review date.
- Does the policy still match the law, and any standard or certification you follow?
- Does it still describe what people actually do?
- Have there been incidents, complaints or audit findings it should address?
- Have the systems, teams, locations or headcount it refers to changed?
- Are the owner, approver and contact details still right?
- Are the procedures and forms it links to still current?
- Is it still clear to someone reading it for the first time?
- Does everyone it covers still need it, and does anyone new?
What to record when you review a policy
The review itself is only half the job. The other half is being able to show it happened, which is what an auditor, a customer or a lawyer will ask about.
| Record | Why it matters |
|---|---|
| The date of the review and who did it | Shows the review happened on schedule |
| The outcome: no change, minor change or new rule | A review that found nothing to change is still evidence that the policy is current |
| Who approved the result | Shows the policy still carries the right authority |
| What changed, version to version | Lets anyone see exactly what was different, and when |
| Who acknowledged the new version | Shows the change reached the people it covers |
| The next review date | Keeps the cycle going without relying on memory |
Common mistakes
One date for everything. Reviewing every policy in the same month guarantees that most get a glance rather than a review. Spread them out by owner and by risk.
Not recording a review that found nothing. Without a record, a policy that was checked and confirmed looks exactly like one that was ignored.
Updating without telling anyone. A changed policy that is not sent back out leaves people working to the old version, and leaves you unable to show they knew about the new one.
Review dates that drift. A review that slips once tends to slip again. Put the date on the policy itself, where its owner and everyone else can see it.
Reviewing the words, not the practice. A policy can read perfectly and still describe something nobody does. Ask the people who follow it.
How AllyMatter keeps reviews on schedule
We built AllyMatter so that a review date lives on the policy, not in someone’s calendar. Each policy can carry a fixed review date or a repeating cycle, and when it comes due, a review alert stays on the document until its owner updates it or approves it again.
Approving the policy again creates a new version, even when nothing changed, and it goes back out to the people it covers, so the record of who acknowledged what always matches the version in force. Version history keeps every earlier version, and comparing two shows exactly what changed. When someone asks, the record of approvals, versions and acknowledgments exports as a PDF or CSV.
Questions about reviewing policies
How often should policies be reviewed?
At least once a year for most policies, every six to twelve months for high-risk ones such as information security, privacy and safety, and every two years for stable, low-risk policies. Any policy should also be reviewed straight away when a law, a process, the business or an incident changes what it should say.
Is there a law that says how often policies must be reviewed?
For most US businesses, no single law sets an interval. Some rules do: SEC Rule 206(4)-7 requires investment advisers to review their compliance policies at least once a year, and the HIPAA Security Rule requires periodic review. Standards such as ISO 27001 expect reviews at planned intervals. For everything else, the practical rule is that a policy must reflect the law in force, so a change in the law forces a review.
How often should policies and procedures be reviewed and updated?
Review policies on their cycle, usually yearly, and procedures more often, because they change whenever a tool or task changes. Critical procedures often need a review every quarter. Our guide to writing an SOP covers review cycles for procedures.
How often should an employee handbook be reviewed?
Once a year, and whenever a law changes or the company crosses an employee threshold. The handbook collects your core HR policies, so its review is a good moment to review those policies too. Our guide to the employee handbook for small businesses covers what it should contain.
What if a review finds nothing to change?
Record it anyway: the date, who reviewed it, that it was confirmed as current, and the next review date. That record is evidence that the policy is current, and it is often what an auditor asks to see.
Do employees need to acknowledge a policy again after a review?
If the policy changed, yes, because the old acknowledgment covers the old version. If nothing changed, many companies still ask for an annual confirmation of their core policies. Our guide to policy attestation explains how the two differ.
Who should review a policy?
The policy owner leads the review, with input from the people who follow it, and the approver signs off the result. For legal or high-risk policies, add HR, legal or your outside counsel. Our guide to policy owners covers how to choose them.
What is a policy review cycle?
It is the interval at which a policy is routinely checked, such as every twelve months. Each policy should carry its own cycle and next review date, set by its risk, rather than one date for everything.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.