Policy Attestation: What It Is and How to Run an Annual Round

Policy attestation is a recorded statement from an employee that they have read a policy, understand it and will follow it, usually collected when they join and again every year for the policies that matter most. It is how a company shows an auditor, a regulator or a large customer that its code of conduct and its security rules didn’t just exist on a shared drive but reached each person, who then confirmed them by name.

Attestation is one part of policy governance, the system a growing company uses to decide who writes, approves, owns and reviews its policies. This guide explains what attestation is and how it differs from acknowledgment and e-signature, where it is actually required, and how a company of 50 to 500 people can run an annual attestation round that produces the evidence an auditor expects.

Key takeaways

• An acknowledgment confirms a policy was received and read, while an attestation adds a commitment to follow it, and sometimes a statement that there is nothing to disclose.
• Few laws require attestation in general, but investment advisers, federal information systems, ISO 27001 and SOC 2 audits all expect some form of recorded confirmation.
• An annual round works best as a cycle: review the policies, approve them, send each one to the people it covers, follow up automatically and export the record.
• The evidence that counts is a named, dated record tied to a specific approved version, plus the list of who was in scope and how gaps were closed.

What is policy attestation?

A policy attestation is a short, recorded confirmation from one person about one policy. In its simplest form the person confirms that they have read the policy, understood it and agree to follow it, and the company keeps a record of who confirmed, which version they confirmed and when.

A typical statement reads something like this: “I have read the ShiftTilt Inc Code of Conduct, version 4.0, I understand it, and I agree to follow it. I have no conflicts of interest to report that I have not already disclosed.” The first sentence is what most companies collect, while the second turns the attestation into a statement about the person’s own situation, which is why it carries more weight when something goes wrong later.

The word also has other meanings. Accountants use attestation for an auditor’s opinion on a company’s controls, which is what a SOC 2 report is, and cloud platforms use it for marking a resource as compliant. This guide is about the employee kind, which our glossary defines in one line.

Policy attestation vs acknowledgment vs e-signature

The three are often treated as the same thing, and in day-to-day speech they overlap, but they prove different things, so it helps to be precise about which one you need before you choose how to collect it.

Acknowledgment is the baseline. It proves the policy reached the person and that they confirmed it, which is what most handbook and procedure rollouts need, and our guide to acknowledgment versus notification explains why a sent email on its own proves almost nothing.

Attestation adds a commitment, and often a disclosure. Because it is a statement the person makes about themselves, it is the form regulators and auditors tend to expect for the code of conduct, the code of ethics, conflicts of interest and information security, and it is usually repeated every year rather than collected once.

E-signature is for documents that work as agreements, such as an NDA or an IP assignment, where the signature itself has legal effect. You wouldn’t ask people to e-sign a remote work policy every year, and you wouldn’t accept a simple read confirmation on an IP assignment.

A fourth word, certification, usually means a named officer such as the chief executive or the compliance lead personally certifying that a program works, which is a different exercise from the all-staff attestation this guide covers.

At the last company I started, we learned the cost of mixing these up. Before an audit we found ourselves chasing signatures across Word documents and online attestations at the same time, with five different versions of the NDA in circulation depending on when people had joined, and nobody could say quickly who had confirmed what. We built AllyMatter partly so that every confirmation is tied to one approved version from the start.

When is policy attestation required?

There is no general federal law that tells every company to collect policy attestations, and pages that claim otherwise usually stretch a narrower rule. What exists is a set of regimes and standards that expect a recorded confirmation, plus an auditor’s practical need for evidence that policies reached people.

Investment advisers. The SEC’s code of ethics rule requires a registered adviser to give each supervised person a copy of the code and every amendment, and to get a written acknowledgment of receipt back from each of them, which is why advisers run an acknowledgment round every time the code changes and usually once a year as well.

Source: 17 CFR 275.204A-1(a)(5), Investment Advisers Act code of ethics rule

Federal information systems. NIST SP 800-53 control PL-4 asks for a documented acknowledgment that people have read, understand and agree to abide by the rules of behavior before they get access, and again after the rules change, and the FedRAMP baselines set that re-acknowledgment at least once a year.

Sources: NIST SP 800-53 Rev. 5, control PL-4 Rules of Behavior, FedRAMP security control baselines

ISO 27001. The 2022 version of the standard expects information security policies to be approved by management, communicated to the people they apply to and acknowledged by them, so certification auditors look for acknowledgment records alongside the policies themselves.

Source: ISO/IEC 27001:2022, Annex A control 5.1, Policies for information security

SOC 2. The trust services criteria ask a company to set standards of conduct and check that people follow them, and auditors commonly test this by sampling employees and asking for proof that each one confirmed the code of conduct and the security policies during the audit period, which matters most in a Type 2 audit that looks at a whole stretch of time.

Source: AICPA 2017 Trust Services Criteria, CC1.1 and CC2.2

Healthcare. HHS OIG guidance treats written policies and standards of conduct as the first element of an effective compliance program, alongside regular training, and many providers collect a yearly attestation to the code as their evidence. HIPAA itself requires workforce training on policies, documentation that the training happened, and keeping policy records for six years, though it doesn’t prescribe an attestation form.

Sources: HHS OIG General Compliance Program Guidance, November 2023, 45 CFR 164.530(b) and (j)

Federal contractors. Contractors covered by the FAR ethics clause must have a written code of business ethics within 30 days of the award and make it available to each employee working on the contract, and an attestation round is the simplest way to show that happened.

Source: FAR 52.203-13, Contractor Code of Business Ethics and Conduct

If none of these apply to you, attestation is still the cheapest protection you can buy for your code of conduct, because the day you need to rely on a policy in a dispute is the day you need to show the person had confirmed it. Our guide to compliance programs shows where attestation fits among the other elements regulators look for.

Which policies belong in an annual attestation?

Keep the annual round to the policies where a personal commitment matters, because asking people to attest to forty documents every year teaches them to click through without reading. For most companies between 50 and 500 people the list looks like this.

• Code of conduct or code of ethics, the anchor of almost every attestation program.
• Conflict of interest policy, often paired with a yearly prompt to disclose anything new.
• Information security and acceptable use, which SOC 2 and ISO 27001 auditors will ask about.
• Privacy and data protection, including HIPAA policies where they apply.
• Anti-harassment and equal opportunity, often handled alongside the employee handbook acknowledgment.
• Role-specific policies, such as a trading code for investment staff or a safety program for people on the floor, sent only to the people they cover.

Everything else, such as procedures and team guides, still needs an acknowledgment when it is first sent and whenever it changes, but it doesn’t need to join the annual round.

How to run an annual policy attestation cycle

An annual round goes smoothly when it is run as a cycle with an owner, a start date and an end date, rather than as a one-off email blast in the month before the audit. Here is a rhythm that works for most companies of 50 to 500 people.

1. Pick the policies and the people. Decide which policies are in this year’s round and who each one covers, and make the policy owner for each one responsible for its part. Your policy on policies is the right place to write this down so it doesn’t depend on one person’s memory.

2. Review and update. Each owner reads their policy against what has changed in the business, the law and your tools over the year. In AllyMatter each policy carries its own review date, either fixed or repeating every twelve months, so the round starts from alerts on the policies that are due rather than a list someone has to rebuild.

3. Approve. People should only ever attest to an approved policy, never a draft. In AllyMatter every change goes through the policy’s approval workflow, with up to four steps in order, before it can be sent, and a rejected draft goes back with the reason on record. A policy that needs no changes is still re-approved, because re-approving it is the record that someone reviewed it and judged it still valid, and that approved version can then go to anyone who joined or gained access since the review.

4. Send to the right people, with the statement. Send each policy for acknowledgment to the people it covers. Put the attestation statement inside the policy itself, at the top or the end, so it is part of the approved version each person confirms and the record points back to exactly what they agreed to.

5. Let reminders do the chasing. Automatic reminders follow up with anyone who hasn’t confirmed, on a schedule you choose when you send, and each person sees what is waiting for them on their home screen as soon as they sign in.

6. Handle the exceptions. Somebody will be on leave, somebody will have a question, and somebody may disclose a conflict or decline to confirm. Deal with each one by name and write down what you decided, because an auditor is more interested in how you handled the gaps than in a perfect completion rate.

7. Export the evidence. When the round closes, save the record of who confirmed which version and when, so you can answer the auditor, the customer or the board without rebuilding anything.

8. Keep it running all year. New starters should confirm the core policies in their first days, and any covered policy that changes mid-year should go back out for confirmation, which our post on re-acknowledgment after a policy update covers in detail.

How to write the attestation statement

The statement is the part of an attestation that does the work, so it deserves the same care as the policy. A good one names the policy and its version, uses the first person, says what the person is committing to, and, where it matters, asks for a disclosure.

• Name the policy and version: “I have read the Information Security Policy, version 3.2.”
• State the commitment plainly: “I understand it and I will follow it in my work.”
• Add a disclosure where it matters: “I have reported any conflict of interest as the policy requires.”
• Point to help: “If I am unsure how the policy applies to me, I will ask the policy owner.”

Keep the wording short and stable from year to year, and change it through the same approval as the policy, so you can show which statement was in force when each person confirmed it.

What evidence an auditor expects

When an auditor asks for proof of policy attestation, the question behind the request is almost never “show me a signature.” It is whether the right people confirmed the right version of a current policy, and what you did about the people who didn’t.

That evidence should come out of the work itself rather than being assembled afterwards. In AllyMatter each policy’s audit trail records the approvals, the acknowledgment requests with the number of people they went to, and each acknowledgment by name and time, and you can filter it by date or by person before exporting it.

Document Analytics on each policy adds the per-person view, showing who has opened it, how long it was on screen and the status of each person’s acknowledgment request, which is the quickest way to see who is still outstanding while the round is open. Our guide to policy acknowledgment tracking goes deeper on what that record should hold, and our post on how courts treat click-through acknowledgments explains why the details of the record matter if a confirmation is ever challenged.

Common policy attestation failures

Most attestation programs fail in the same handful of ways, and nearly all of them come down to a record that can’t answer one of the auditor’s questions.

Attesting to a document nobody approved. If the version people confirmed was a draft, or a copy someone edited after approval, the attestation proves very little, which is why only approved versions should ever reach people.

No version on the record. A spreadsheet that says “Code of Conduct, confirmed” without a version or date can’t show what the person agreed to, and it falls apart the first time the policy changes.

The wrong list of people. Rounds built from last year’s email list miss new hires and include people who left, so the scope should come from your current teams, locations and roles.

One giant bundle. Asking people to attest to a combined 60-page pack in one click invites people to confirm without reading, and makes it harder to show which policy someone actually confirmed.

Chasing by hand. When follow-up depends on someone sending emails from their own inbox, the round stalls at 80 percent and the last fifth takes as long as the first four.

Forgetting the middle of the year. A policy that changes in March and isn’t sent again until the next annual round leaves months where people were bound by rules they had never confirmed.

Attestation and the rest of policy governance

Attestation only works when the rest of the system around it works, which is why it sits inside a wider policy governance framework. Someone has to own each policy and keep it current, a policy on policies has to set the rules for approval and review, and a records retention schedule has to say how long you keep the attestation records once a round is finished. For the software side, our guide to policy management software for small and growing businesses explains what to look for.

How AllyMatter runs policy attestation

We built AllyMatter for the growing company that needs this record without a compliance department to produce it. Every policy goes through an approval workflow before anyone can see it, tags send each policy to the people it covers, each person confirms it while signed in, and automatic reminders follow up with anyone who hasn’t.

When a policy changes, even by a word, the new version goes back through approval and out again for acknowledgment, and the person confirming can see exactly what changed through version compare instead of rereading the whole thing. Completed acknowledgments stay on the record even after someone leaves the company, and the audit trail exports as a PDF or CSV whenever someone asks.

You pay for the people who manage policies, while everyone who reads and confirms them is free, so an all-staff attestation round never adds to the bill.

Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.

Questions about policy attestation

What is policy attestation?

Policy attestation is a recorded statement from an employee that they have read a policy, understand it and will follow it. It goes one step further than an acknowledgment, which only confirms the policy was received, and it is usually repeated every year for core policies such as the code of conduct.

What is the difference between policy attestation and acknowledgment?

An acknowledgment proves a person received and read a policy, while an attestation adds a personal commitment, such as agreeing to follow it or confirming there is nothing to disclose. Many companies use the words interchangeably, so what matters is the statement the person actually confirms.

Is policy attestation legally required?

Rarely as a general rule, but some regimes come close. SEC-registered investment advisers must get a written acknowledgment of their code of ethics and each amendment, federal information systems under NIST SP 800-53 need a documented acknowledgment of the rules of behavior, and ISO 27001 expects policies to be acknowledged by the people they apply to.

How often should employees attest to policies?

Once a year is the common rhythm for the code of conduct and security policies, plus a fresh confirmation whenever a covered policy changes and when someone joins or moves into a new role. Some frameworks set the cadence for you, so check what your auditor or regulator expects.

What happens if an employee refuses to attest?

Refusing to sign doesn’t release anyone from a policy. Talk to the person about why, record that the policy was given to them and that they declined, and take advice before treating a refusal as a disciplinary matter.

Do new hires need to attest straight away?

Yes. New starters should confirm the core policies during their first days rather than waiting for the next annual round, because the evidence an auditor wants covers everyone who was in scope during the period, including people who joined halfway through it.

Do you need software for annual policy attestation?

A company of twenty can run it on email and a spreadsheet. Past fifty people, or once an auditor asks for proof by person and version, software saves the chasing and produces the record as a side effect of the work.

An attestation round is judged on the record it leaves, and that record is either a side effect of how you send and confirm policies all year, or a scramble in the weeks before an audit. Growing companies are better off with the first.

Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.