Policy Governance · 13 min read
Policy Owner: Who Owns Each Company Policy and What the Role Involves
A policy owner is the one person accountable for a company policy: keeping it accurate, getting each version approved, deciding who it applies to, making sure those people read it, reviewing it on schedule and answering for it when an auditor or customer asks. (If you came here about insurance, where the policy owner is whoever controls an insurance contract, this is a different meaning.)
Ownership is the quiet foundation of policy governance. Every policy program that falls apart in an audit has the same story underneath, which is a set of policies that were written once by someone who has since moved on, never reviewed, and now belong to nobody. This guide explains what a policy owner does, how to assign owners at a company of 50 to 500 people, how the role differs from authors, approvers and the people who acknowledge, and what to do when an owner leaves.
Key takeaways
- A policy owner is accountable for a policy from draft to retirement, even when someone else writes it or approves it.
- Every policy needs exactly one named owner, usually the head of the function the policy governs, not a team or a committee.
- Owners, authors, approvers and readers are four different roles, and auditors increasingly expect the owner and the approver to be different people.
- Ownership has to survive people leaving, so keep an owner register and a handover routine, and make sure the system lets someone else pick the policy up.
What is a policy owner?
In company governance, the policy owner is the person who answers for a policy. They don’t have to write every word, and they shouldn’t be the only person who approves it, but if the policy is out of date, unread or impossible to prove, it is their problem to fix. That clarity is the whole point, because a policy that three departments vaguely share is a policy nobody reviews.
Most organizations that write down how they manage policies, usually in a policy on policies, separate the owner from the author and from the approving authority. University and public-sector policy frameworks have done this for years, and the same split now shows up in the help pages of security and compliance tools, which tend to describe the owner as the person who enforces a policy and keeps it current.
Source: Policy roles in university and public-sector frameworks, for example csusm.edu/policies, tcu.edu/compliance/policies and bpa.gov internal policy library
The role matters more as a company grows. At 20 people the founder owns everything by default and can answer any question about a policy from memory, but at 150 people the handbook belongs to HR, the security policies belong to IT, the quality manual belongs to the quality manager, and the founder can’t remember which version of the expense policy is current. Naming owners turns that sprawl into something one person per policy can keep in order.
Policy owner responsibilities
A policy owner’s responsibilities follow the policy through its life, from the first draft to the day it is retired, and most of them come back around every time the policy changes.
| Duty | What it means in practice | How often |
|---|---|---|
| Keep it accurate | Make sure the policy matches the law, your contracts, your certifications and how the work is really done | All the time, and at every review |
| Get it approved | Send every new version to the right approvers and answer their questions or rejections | Every change |
| Decide who it applies to | Name the teams, locations and roles in scope, and update that when the company changes shape | Every change, and after reorganizations |
| Get it read | Send it out for acknowledgment, follow up with people who haven’t confirmed, and explain what changed | Every change, and yearly where a standard asks |
| Review it on schedule | Confirm it is still right on its review date, or revise it, or retire it | Usually every 12 months, sooner for high-risk policies |
| Handle exceptions | Decide requests to depart from the policy and write down why | As requests come in |
| Answer for it | Show an auditor, customer or regulator who approved it, who read it and what was in force on a date | Each audit or review |
Two of these duties are the ones that slip. Reviews slip because nothing reminds anyone when a policy turns a year old, and acknowledgment slips because the owner sends an email and assumes people read it. Having been through ISO 9001 audits more than ten times, I’ve found that auditors spend far less time asking whether a policy exists than asking when it was last reviewed, who has seen the current version and, depending on the policy, whether people have agreed to it.
Policy owner vs author, approver and readers
Most confusion about ownership comes from blending four roles that have different jobs, so it helps to separate them clearly before you assign anyone.
The author works out what the policy needs to say. At a mid-sized company the author is often the owner, but a security policy might be drafted by an engineer, a leave policy by an HR generalist, and a whole set of policies by an outside consultant helping you prepare for a standard, while the owner stays accountable for the result.
The approver confirms the policy is right before anyone has to follow it. That might be a single senior leader, employment counsel for a handbook change, or several people in order, such as an operations lead and then the CEO. Some auditors expect the owner and the approver to be different people, so even at a small company it is worth having a second person sign off on anything an auditor will read.
The readers are everyone the policy applies to. Their job is to read it, follow it and confirm they have read it, and the owner’s job is to make sure that confirmation exists for every version, because “we emailed it to everyone” is not proof anyone saw it.
In AllyMatter, the policy owner is the person set as the policy’s Editor, which is the seat that edits the policy, sends it for approval and distributes it once it is approved. Each policy has one Editor, which matches the governance rule of one accountable person, and approvers sit in an approval workflow of up to four ordered steps, where a step can need any one of its approvers or all of them. Your lawyer or an outside consultant can be invited to approve, too.
Who should own company policies?
The simplest rule is that the policy owner should be the head of the function the policy governs, because that person has the expertise to keep it right and the authority to make people follow it. Cross-cutting policies, such as acceptable use or a data breach response, involve several teams, but they still need one owner who pulls the others in, because shared ownership quietly becomes no ownership.
Here is how that tends to look at a company of about 180 people.
A few practical rules make the map work.
Name a person, then a role. Write “Iris Murdoch, Head of People” rather than just “HR”, so there is a face to ask, and record the role too, so the policy has a home when that person moves on.
Keep families together. One owner for the whole handbook is easier than six owners for six handbook chapters, because related policies change together and contradict each other when they don’t.
Spread the load. If one person owns forty policies, none of them gets reviewed properly, so five to eight owners across the main functions is a common shape for a company of 50 to 500 people.
Own the rules about owning. Someone, usually a compliance lead or the COO, owns the policy on policies and the owner register itself, and checks every quarter that no policy has lost its owner.
Ownership also decides who gets each policy. In AllyMatter, tags describe your teams, locations and roles, and a policy reaches everyone holding all of its tags, so the owner of the warehouse safety program sends it to Warehouse and nobody else has to remember a distribution list.
A policy owner’s year
Ownership works best as a steady rhythm rather than a scramble the month before an audit, and a simple quarterly cycle keeps most mid-sized companies on track.
Some standards and regulators expect people to confirm certain policies every year, not just when they change, which is usually called policy attestation. The owner decides which of their policies need that yearly cycle and runs it, while every change in between still goes back through approval and back out for re-acknowledgment.
In AllyMatter there is no shortcut for small edits, because every new version of a policy goes back through approval and back out for acknowledgment, which means the version people confirmed is always the version in force. Reviewers can see every word removed and added between two versions, so a change takes them minutes to check rather than a full re-read.
What auditors ask policy owners
When an auditor or a customer’s security reviewer picks up a policy, the questions are predictable, and the owner is the person expected to answer them.
- Who approved this version, and when?
- What changed from the previous version, and why?
- Who does this policy apply to, and can you show they received it?
- When was it last reviewed, and when is the next review due?
- Were there any exceptions, and who agreed to them?
An owner who keeps policies in a shared drive answers those questions by searching email and building a spreadsheet, usually the week before the audit. An owner who keeps them in a policy system answers them from the record, which is why the audit trail matters as much as the policy itself, as we cover in our guide to the document audit trail.
What happens when a policy owner leaves
Owners leave, change jobs and go on leave, and the policies they held are the ones most likely to go stale, because nobody notices a missing review until it is overdue. A short handover routine prevents that.
| Step | What to do before the owner leaves or changes role |
|---|---|
| 1. Name the new owner | Pick one person for each policy, not a team, and write the change into your owner register |
| 2. Walk the list | Go through every policy the outgoing owner held, with its review date, open exceptions and anything half-drafted |
| 3. Pass on the reasons | Share why the policy says what it says, which auditor findings shaped it and which promises to customers rely on it |
| 4. Check the dates | Make sure no review is overdue on the day the owner leaves, because those are the ones that get forgotten |
| 5. Update the system | Make the new owner the person who edits, sends for approval and distributes each policy, and tell the approvers |
In AllyMatter, an Admin can still reach every policy a departed Editor held, so nothing disappears while you decide who takes each one on. The handover itself is a people decision, which is why it belongs in your policy on policies rather than being left to whoever notices first.
Common mistakes with policy ownership
A team as the owner. “Owned by HR” sounds clear until HR has five people and each thinks another is reviewing the leave policy, so always name one person.
The author as the permanent owner. The consultant who drafted your security policies won’t be reviewing them in two years, so ownership should sit with someone inside the company from the start.
The owner approving alone. It works at ten people, but an auditor reading a policy approved only by the person who wrote it will often ask who checked it, and a second approver answers that before it is asked.
Ownership without a calendar. An owner with no review dates is an owner in name only, so every policy needs a date, set when it is approved, rather than a good intention.
No register. If you can’t list every policy with its owner and next review date on one page, you can’t tell which ones have been orphaned, and the complete guide to policy management software covers how a policy system keeps that list for you.
Questions about policy owners
What is a policy owner?
A policy owner is the one person accountable for a company policy: keeping it accurate, getting each version approved, deciding who it applies to, making sure those people read it, reviewing it on schedule and answering for it in an audit. It is a governance role, not the insurance term for whoever owns an insurance policy.
Who should be the policy owner?
Usually the head of the function the policy governs, so HR owns the handbook and conduct policies, IT or security owns information security, finance owns spending and signing authority, the quality manager owns the quality manual and safety or operations owns safety programs. What matters most is that each policy has exactly one named person, not a team or a committee.
Can the policy owner also approve the policy?
At a very small company the owner often approves their own policies, but as you grow, and especially once an auditor is involved, a second person should approve. Some auditors expect the owner and the approver to be different people, so separating them early saves an awkward finding later.
What is the difference between a policy owner and a policy author?
The author drafts the wording, while the owner is accountable for the policy being right, approved, read and reviewed. The same person can do both, but an owner can also ask a specialist or an outside consultant to draft while they stay accountable.
How many policies should one person own?
There is no fixed number, but ownership should follow expertise, and one person holding every policy is usually a sign that nobody really owns them. At a company of 50 to 500 people, five to eight owners covering the main functions is a common and workable shape.
What happens when a policy owner leaves the company?
Name a new owner for each of their policies before they go, hand over the reasons behind each policy and any reviews coming due, and update your records and system so the new owner can edit, approve and send the policy. Policies without an owner tend to drift out of date quietly until an audit finds them.
Is the policy owner the same as the compliance officer?
Not usually. The compliance officer runs the overall program and the rules for how policies are written and reviewed, while individual policy owners in HR, IT, finance and operations keep their own policies current. At a smaller company the same person may hold both roles.
Ownership is the cheapest control a growing company can put in place, because it costs nothing but a decision and a name, and it is the one every other part of a policy program depends on. Our guide to policy governance shows how owners fit together with approval, review, attestation and proof.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.