Policy Governance · 19 min read
Policy Governance: How Growing Companies Write, Approve, Own and Prove Their Policies
Policy governance is how a company decides who writes, approves, owns, communicates, reviews and retires each of its policies, and how it proves that all of that actually happened. It turns a folder of documents into a program with rules, owners and a record, which is exactly what auditors, regulators, insurers and larger customers check when they ask to see your policies.
Most companies don’t set out to build policy governance. It arrives when the policies start to matter: a customer’s security review asks who approved your information security policy, an ISO auditor asks to see the version that was in force last March, or a manager discovers that half the team never saw the revised safety procedure. I’ve sat through more than ten ISO 9001 audits, two ISO 27001 audits, SOC 2 and HIPAA, and the questions were always about governance rather than about the words in the policy. This guide is for small and mid-sized companies, roughly 10 to 500 people, that want to get those answers right without hiring a compliance department.
Key takeaways
- Policy governance is the rulebook for your rulebook: ownership, approval, communication, acknowledgment, review, exceptions and retirement, plus the proof of each.
- It starts with a short policy on policies, a named policy owner for every document, and approval tiers that match risk.
- Auditors and customers judge it by evidence, so every step has to leave a record: who approved which version, who received it, and who attested that they read it.
- A 50-person company can set it up in about a month, and the program then becomes the foundation of a wider compliance program.
Two meanings of policy governance
If you searched for policy governance and found pages about boards of directors, you met the other meaning of the term. Policy Governance, written with capital letters, is a board model that John Carver developed in the 1970s, in which a board governs through a small set of written board policies instead of approving management decisions one by one.
The Carver model sorts board policies into a few types: Ends policies that say what results the organization exists to produce and for whom, Executive Limitations policies that set the boundaries of prudence and ethics the chief executive must work within, and policies about how the board governs itself and delegates to management. It is widely used by nonprofit boards, school boards and public bodies, and if that is what you need, the books and coaches built around it are the right place to go.
Sources: John Carver, Boards That Make a Difference, carvergovernance.com
This guide covers the other meaning, which is the one most companies need first: how an organization governs all of its own written policies and procedures, from the code of conduct and the handbook to the information security policy and the forklift procedure. The two fit together, because even a board that runs on the Carver model needs a company underneath it that writes, approves, communicates and proves its operating policies in a controlled way.
What policy governance covers in a company
Think of policy governance as eight decisions you make once, write down, and then apply to every policy you own. Universities, hospitals and public bodies publish their versions as a “policy governance framework”, and they all come back to the same short list, which a growing company can adopt in plain language.
| Decision | The question it answers | A sensible default for 50 to 500 people |
|---|---|---|
| Scope | What counts as a policy, and what is a procedure, standard or guideline? | Anything people must follow, and can be disciplined for ignoring, is a policy or a procedure under the framework |
| Format | What does every policy contain? | Purpose, scope, the rules, roles, exceptions, related documents, owner, approval date and next review date |
| Ownership | Who answers for each policy? | One named owner per policy, usually the leader of the function the policy governs |
| Approval | Who must approve before it counts? | Approval tiers by risk, with high-risk policies going to leadership and routine ones to the owner’s manager |
| Communication | Who must receive it, and do they need to confirm? | The people in scope, with acknowledgment for anything you might later enforce |
| Review | How often is it checked, and what forces an early review? | Yearly for high-risk policies, every two years for the rest, and early when a law, a process or an incident changes |
| Exceptions | Who can grant a one-off exception, and how is it recorded? | The policy owner, in writing, with an end date |
| Retirement and records | How is a policy withdrawn, and how long are old versions kept? | Withdrawn by the same authority that approved it, with old versions kept for as long as your records retention schedule requires |
Those eight decisions belong in one document, your policy on policies, so that nobody has to remember them and every new policy starts from the same rules. Once that document exists, the rest of governance is simply following it consistently, which is where most companies either build the habit or slowly drift back to a shared drive.
Why policy governance matters for a growing company
A policy only protects you if you can show it was in force, that the right people approved it, and that the people it applies to knew about it. Without governance, each of those facts has to be rebuilt from email threads and file histories at exactly the moment someone outside the company is waiting for an answer.
Auditors and certifiers expect it. ISO 9001 asks that documented information is reviewed and approved for adequacy before use, and that its distribution, access, version and retention are controlled. SOC 2 criteria expect an organization to put its controls into effect through policies that set out what is expected and procedures that put those policies into action. HIPAA requires written policies and procedures that are reviewed periodically, updated when needed and kept for six years.
Sources: ISO 9001:2015 clause 7.5, AICPA Trust Services Criteria CC5.3, 45 CFR 164.316
Regulators judge whether a program works, not whether it exists. The first element of the compliance program guidance that the HHS Office of Inspector General publishes for health care organizations is written policies and procedures, and the Department of Justice asks prosecutors to check whether a company’s policies are accessible to employees and who is responsible for keeping them current.
Sources: HHS-OIG General Compliance Program Guidance, U.S. Department of Justice, Evaluation of Corporate Compliance Programs
Customers ask for proof before they sign. A larger customer’s security questionnaire rarely stops at “do you have a policy”, and it usually goes on to ask when it was last reviewed, who approved it and how staff are trained on it. Years of responding to RFPs taught me to read those follow-up questions line by line, because they are where a quick yes turns into a week of chasing evidence.
Headcount adds obligations quietly. Federal employment rules switch on at 15, 20, 50 and 100 employees, so a company that grows from 40 to 120 people can pick up leave, benefits and reporting duties within a year, and each of those needs a policy that somebody owns and keeps current. Our guide to policy management software for small and growing businesses sets out what changes at each threshold.
The document hierarchy: policies, standards, procedures and records
Governance gets much easier once everyone agrees what kind of document they are writing, because each kind changes at a different speed and needs a different level of approval. A policy that changes every month is usually a procedure in disguise, and a procedure that needs board approval for every tweak will simply stop being updated.
The practical rule is that the higher the level, the fewer documents there are, the less often they change and the more senior the approval. A 100-person company might have one policy on policies, twenty to forty policies, a handful of standards and many more procedures, and only the top two levels usually need leadership involved.
Who does what: roles in policy governance
Governance fails most often because a policy has no owner, or because everybody assumes somebody else is keeping it current. A growing company needs only four roles, and in a 50-person business one person may hold two of them.
Leadership approves the policy on policies and the highest-risk policies, and sets the tone that policies are followed rather than filed. In a company with a board, the board may approve the governance policy and a few others such as the code of conduct and the conflict of interest policy.
The policy owner is the one person accountable for a specific policy: its content, its approval, getting it to the right people and keeping it current. Our article on the policy owner role covers who should hold it and what happens when nobody does.
The policy coordinator runs the system rather than any single policy, keeps the register, checks new policies against the format, chases overdue reviews and produces evidence for audits. In smaller companies this is usually the head of HR, operations, quality or compliance, often alongside a full-time job.
Subject experts and employees draft and comment on the policies in their area, and everyone in scope reads and acknowledges the policies that apply to them.
The policy lifecycle under governance
Every policy moves through the same stages, and governance is mostly about making sure none of them is skipped and each one leaves evidence behind. The stages below hold whether the policy is a two-page remote work policy or a forty-page quality manual.
Draft and review. The owner writes in the house format, and subject experts comment before anyone is asked to approve, so approvers see a finished draft rather than a conversation. Comments on the draft itself are much easier to follow than comments scattered across email.
Approve. Approval is the moment a document becomes a policy, so the record of who approved which version, and when, matters more than almost anything else in the program. High-risk policies usually need two or three approvers in a set order, for example the owner’s manager first, then HR or legal, then a member of the leadership team, and an outside lawyer can sit in that chain when a policy needs one.
Communicate. A policy only works if it reaches the people it covers, and governance means deciding the audience deliberately, by team, location or role, rather than sending everything to everyone and hoping. Sending a warehouse procedure to the finance team trains people to ignore policy emails, which is the opposite of what you want.
Acknowledge. Acknowledgment is the evidence that the person received and read the version in force, and it is the record auditors and employment lawyers ask for most often. The details of annual and event-driven acknowledgment, and how attestation differs, are in our guide to policy attestation, and our post on re-acknowledgment after a policy update covers what to do when a policy changes.
Review. Every policy needs a date when its owner checks that it still matches the law, the business and the way work is actually done. The table below shows review cycles that many growing companies use as a starting point, and your certification body or regulator may ask for something stricter.
| Policy type | Typical review cycle | Triggers for an early review |
|---|---|---|
| Information security, privacy and access | Every 12 months | A breach or near miss, a new system, a customer or certification requirement |
| Health, safety and quality procedures | Every 12 months, or as your certification requires | An incident, an audit finding, new equipment or a process change |
| Code of conduct, harassment, conflicts of interest | Every 12 to 24 months | A complaint, a reorganisation, a change in the law |
| HR and handbook policies | Every 12 to 24 months | Crossing a headcount threshold, opening in a new location, a benefits change |
| Finance and expense controls | Every 24 months | A new approval limit, a fraud attempt, a new auditor |
| The policy on policies itself | Every 24 months | A new standard, a new regulator, or a governance change at leadership level |
Handle exceptions. Sometimes a team genuinely can’t follow a policy for a while, for example during a system migration. Governance means the exception is granted by the policy owner in writing, with a reason and an end date, rather than quietly tolerated, so that an auditor sees a managed decision instead of a failure.
Retire and keep records. A policy that no longer applies should be withdrawn by the same authority that approved it, with its history kept, because you may need to show what was in force on a past date. How long to keep old versions, acknowledgments and approval records belongs in your records retention schedule, and our post on deleting, archiving and the audit trail explains the difference between hiding a document and losing its history.
Proving governance: the evidence auditors ask for
Every audit I’ve been through came down to the same few requests, and a governed program answers each of them with a file rather than a hunt. At the last company I started, those answers were spread across Word documents and online attestations, and the week before an audit turned into a scramble for signatures that should never have been needed.
- The approved version in force on a given date, with the earlier versions and what changed between them.
- Who approved it, in what order and when, including any rejection and the reason given.
- Who it was sent to, and who has acknowledged that exact version.
- When it was last reviewed and when the next review is due.
- Who has looked at it, which helps when a manager insists a team “definitely saw” the update.
Our post on the document audit trail goes through what a defensible trail contains, and our guide to policy acknowledgment tracking covers the acknowledgment record in depth.
The parts of a policy governance program
Policy governance touches several documents and roles that each deserve their own explanation, so we’ve written a guide to each part. Start with whichever one your auditor, customer or leadership team is asking about.
Policy on policies. The master policy that sets out how every other policy is written, formatted, approved, reviewed, granted exceptions and retired. It is usually short, approved by leadership, and the first document an auditor asks for when they want to understand how your program works.
Policy owner. The one person accountable for a policy’s content, approval, communication and review. The guide covers who should hold the role in a company of 50 to 500 people, what the job involves through the year, and the gaps that open up when owners leave or change roles.
Policy attestation. How employees confirm on record that they have read a policy and will follow it, how annual attestation differs from acknowledging a new version, and what evidence an auditor expects to see for each.
Compliance program. The wider structure that policy governance sits inside, built around the recognized elements of an effective compliance program: written policies, oversight, training, communication, monitoring, enforcement and response, and how a growing company covers them without a full-time compliance team.
Conflict of interest policy. One of the policies regulators, auditors and nonprofit filers ask about most often, covering what it should say, how disclosures are handled, and how the policy is acknowledged every year.
Records retention schedule. How long to keep policies, versions, approvals, acknowledgments and other records, how a document retention policy and a retention schedule fit together, and how to retire documents without losing the history you may need later.
How to set up policy governance in 30 days
You don’t need a consultant or a committee to start, and a company of 50 to 200 people can put the foundations in place in about four weeks if one person owns the project. The order matters: write the rules first, then bring the highest-risk policies under them, then extend to everything else.
| Week | What to do | What you have at the end |
|---|---|---|
| Week 1 | List every policy, procedure and handbook section you have, wherever it lives, and name an owner for each | A policy register with an owner beside every line |
| Week 2 | Write and approve a short policy on policies covering format, approval tiers, review cycles and exceptions | The rules every other policy will follow |
| Week 3 | Move the highest-risk policies first, bring them to the house format, and run them through approval | Your most important policies approved, versioned and dated |
| Week 4 | Send the approved policies to the people in scope for acknowledgment and set a review date on each one | A record of who has read what, and a calendar of reviews that runs itself |
Two habits keep the program alive after the first month. Every change, however small, goes back through approval and back out to the people it covers, because one changed word can change what people are expected to do. And every review date is treated as a real deadline with an owner, rather than a reminder that can be snoozed.
Common policy governance mistakes
Approving by email. A reply that says “looks good” proves very little a year later, especially when nobody can tell which attachment it referred to. Approval needs to be tied to a specific version.
Treating small edits as harmless. Exceptions for “minor” changes are how a policy drifts away from what staff actually acknowledged, so the safest rule is that every new version is approved and acknowledged again.
Sending everything to everyone. Over-communicating trains people to ignore policy notices. Scoping each policy to the people it applies to keeps acknowledgment rates high and the record meaningful.
Owners who have left. A policy whose owner left two years ago is effectively ungoverned, so ownership should be reassigned as part of every departure or reorganisation.
A framework nobody follows. A forty-page policy on policies that sits in a folder is worse than a two-page one that people use, because it suggests to an auditor that the program exists only on paper.
Where software fits in policy governance
Policy governance is a set of decisions and habits first, and a tool second. A small company with a dozen policies can run it with a register, a shared drive and a calendar, and we’d say that even though we sell software. The tool earns its place when the record becomes too big to keep by hand: dozens of policies, several approvers, staff across teams and locations, and auditors or customers who want proof on short notice.
We built AllyMatter to run the governance described in this guide for small and growing companies. Each policy has one Editor who owns it, an approval workflow of up to four steps that every version must pass, tags that decide exactly who sees it, acknowledgment with automatic reminders, a review date fixed or repeating, version history that shows every word added or removed, and an audit trail that exports as a PDF or CSV. If you are comparing tools, our checklist for choosing policy management software lists the questions to ask, and our complete guide to policy management software covers the whole category.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.
Questions about policy governance
What is policy governance in a company?
Policy governance is the set of rules a company uses to manage its own policies: who writes each one, who approves it, who it applies to, how people confirm they have read it, when it is reviewed, how exceptions are handled and how it is retired, along with the records that prove each of those steps happened.
Is policy governance the same as the Carver Policy Governance model?
No. The Carver model is a framework for how a board of directors governs an organization through a small set of board-level policies, while company policy governance is about how an organization manages all of its written policies and procedures day to day. A board that uses the Carver model still needs company policy governance underneath it.
What is a policy governance framework?
It is the written structure behind the program, usually captured in a policy on policies, that defines the document hierarchy, the house format, roles and responsibilities, approval tiers, review cycles, the exceptions process and how policies are retired and kept.
Who should own policy governance in a small or mid-sized company?
One person should coordinate it, often the head of HR, operations, compliance or quality, while each individual policy has its own named owner. Leadership approves the framework and the highest-risk policies, and the coordinator makes sure every owner follows it.
How often should company policies be reviewed?
Most growing companies review high-risk policies such as information security, safety and conduct every year and the rest every two years, with an early review whenever a law, a process, a system or an incident changes what the policy needs to say. Your certification or regulator may set a stricter cycle.
What is the difference between a policy and a procedure?
A policy states what the company requires and why, in rules that rarely change, while a procedure sets out the steps a person follows to meet that policy and changes whenever the process changes. Standards sit between them as the measurable minimum, and forms and records are the evidence that the steps happened.
Do auditors look at policy governance?
Yes. Frameworks such as ISO 9001, ISO 27001, SOC 2 and HIPAA all expect written policies that are approved, communicated to the right people, kept current and controlled, and an auditor will usually ask to see the approval record, the version in force and proof that staff received it.
Do I need software for policy governance?
Not at first. A small company can run policy governance with a register, a shared drive and discipline. Software starts to pay for itself when you have dozens of policies, several approvers, people in different teams or locations, and outside parties who ask you to prove who approved and acknowledged what.
Policy governance sounds like something only large companies need, but the work is the same at 50 people as at 5,000, and the difference is only how many people share it. Write the rules down once, give every policy an owner, and make sure each step leaves a record, and the next audit becomes a file you export rather than a week you lose.
On yearly plans, migration is on us: we’ll move your policies from SharePoint, Google Drive, Confluence or Notion, usually within a week and often sooner.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.