Policy Management Glossary

A

Acceptance
The act of a person confirming that they agree to be bound by a document, usually a code of conduct, an agreement or a policy with consequences. Acceptance is stronger than acknowledgment: it records agreement, not only receipt. Many companies use acknowledgment for most internal policies and keep acceptance or signature for the few documents that create obligations. What courts look for in click-through acknowledgments
Access control
The rules that decide who can open, edit, approve or share a document. In policy work, access control usually follows roles (who writes, who approves, who only reads) and audience (which teams, sites or groups a policy applies to). Good access control keeps drafts away from readers and keeps the current approved version in front of them.
Accreditation
Formal recognition that an organization is competent to carry out specific work, such as testing, calibration or certification. Accreditation bodies assess certification bodies and laboratories against international standards. When a customer asks for an accredited certificate, they want one issued by a certification body that is itself accredited.
Acknowledgment
A person’s record that they have received and read a document. A useful acknowledgment names the person, the date and time, and the exact version they read, and includes the statement they confirmed, such as “I have read and understood this policy.” An acknowledgment that does not name the version is weak evidence once the document changes. Policy acknowledgment tracking
Acknowledgment rate
The share of the people a policy was sent to who have acknowledged it. It is tracked per policy and per version. Reviewers often look at the rate for a recent change and at how long it took to reach it, because a policy nobody has read is a policy in name only. Tracking employee acknowledgments
Approval
The decision, by one or more named people, that a document is ready to be issued. A documented approval shows who approved, when, and which version they approved. Most standards that require documented information also require that it is approved before it is used. Approval workflows in AllyMatter
Approval workflow
The defined route a document follows before it is issued: who reviews it, in what order, and what happens on rejection. A workflow can run in steps, where each step must clear before the next, and each step can need every approver or any one of them. A written workflow makes approval repeatable instead of depending on who happens to be asked. Reusable approval workflows
Approver
A person whose sign-off is required before a document goes out. Approvers are chosen for authority or expertise: a department head for an operating procedure, legal for a contract template, the board for a code of conduct. An approver can sit outside the team that wrote the document, and sometimes outside the company. Every approver or any one
Archive
The store of documents that are no longer in force but must be kept. Archived documents stay readable for the retention period so you can show what applied at a given date, and they are marked so nobody mistakes them for current policy. Delete, archive and the audit trail
Attestation
A formal statement that something is true, such as an employee attesting that they have completed training or a manager attesting that their team follows a procedure. In policy work the word is often used for the statement a person confirms when they acknowledge a document. Some regulations require periodic attestations, for example a yearly certification by a senior officer.
Audience
The people a document applies to. Defining the audience precisely, by team, role, location or another attribute, decides who must receive the document, who must acknowledge it, and who a reviewer will expect to see in the record.
Audit
A systematic, independent examination of whether an organization does what its standards, regulations or own policies say it should. Audits can be internal (run by the organization or someone it appoints) or external (run by a customer, a certification body or a regulator). Written policies and the records around them are among the first things an auditor asks for.
Audit log
A time-ordered record of actions taken on documents: created, edited, approved, sent, viewed, acknowledged, signed, exported. Each entry names the person and the time. An audit log lets you answer “who did what, and when” without relying on memory or email threads. Audit trail and export in AllyMatter
Audit trail
The complete chain of records that shows how a document reached its current state and who has interacted with it, from first draft to approval, distribution and acknowledgment. The term is often used for the audit log of a single document. What a document audit trail should show
Auditor
The person who carries out an audit. External auditors include certification body auditors, customer auditors and regulators’ examiners. Internal auditors work for, or on behalf of, the organization. Auditors sample: they pick a few documents and a few people and test whether the record holds up.

B

Business continuity plan
A written plan for keeping critical operations running, or restoring them quickly, after a disruption such as an outage, a fire or the loss of a key supplier. Many security and health care standards ask for a continuity or contingency plan that is approved, tested and reviewed on a schedule.

C

CAPA (corrective and preventive action)
The process of fixing the cause of a problem (corrective action) and preventing a similar problem from happening (preventive action). A CAPA often ends in a policy or procedure change, which then has to be approved, issued and acknowledged like any other change.
Certification
Confirmation by an independent body that an organization meets the requirements of a standard, such as ISO 9001 or ISO/IEC 27001. A certification audit usually runs in two stages, is followed by surveillance audits each year, and is renewed through a recertification audit every three years.
Certification body
An organization that audits companies against a standard and issues certificates. Customers and schemes usually expect the certification body to be accredited, so that its certificates are recognized.
Change control
The process for proposing, reviewing, approving and recording changes to a controlled document. Change control makes sure that every change, however small, is approved before it takes effect and that the previous version is kept. Version control for HR policies
Clause
A numbered section of a standard or regulation. Policies are often mapped to the clauses that ask for them, so that an auditor can follow a requirement to the document that meets it.
Code of conduct
A company-wide document setting out expected behavior and values, often covering ethics, conflicts of interest, gifts, harassment and reporting concerns. It is usually approved at the highest level and acknowledged by everyone, often at hiring and again each year.
Completion certificate
A summary record produced when an electronic signature is completed. It typically lists who signed, when, from which address or device, and how each signer was identified. It is kept with the signed document as evidence of how the signature was made. How electronic signatures work
Compliance
Meeting the requirements that apply to an organization: laws, regulations, standards, contracts and its own policies. Compliance is shown, not claimed: by written policies, the records that people received and followed them, and the evidence an auditor can sample.
Compliance program
The structure an organization uses to manage compliance: a responsible officer, written policies and procedures, training, monitoring, reporting channels and a way to respond to problems. Several regulators, including the HHS Office of Inspector General, publish the elements they expect a program to have.
Control
A measure that reduces a risk, such as an access review, a backup or a training requirement. Controls are often described in policies and procedures, and evidence that a control operates is what many audits test.
Controlled document
A document whose content, approval, version and distribution are managed, because people rely on it to do their work correctly. Policies, procedures, work instructions and forms are typically controlled. An uncontrolled copy, such as a printout or a downloaded file, may be out of date without anyone knowing.
Current version
The single version of a document that is in force today. Everyone the document applies to should be able to reach the current version, and it should be clear which version that is. Confusion about the current version is one of the most common audit findings.

D

Distribution
Sending a document to the people it applies to, with a request to read it, acknowledge it or sign it. Distribution is recorded so that you can show who received which version and when. Policy distribution and access in AllyMatter
Document control
The set of practices that keep documents correct and available: identifying them, approving them before use, reviewing and updating them, controlling changes and versions, making the current version available where it is used, and keeping obsolete versions from unintended use. Quality and security standards set out document control requirements in detail.
Documented information
The term ISO management system standards use for information an organization must control and keep, covering both documents (such as policies and procedures) and records (such as evidence of results). It replaced the older separate terms “documents” and “records” in ISO language.
Draft
A version of a document that is still being written or reviewed and has not been approved. Drafts should not reach the people the document applies to, so that nobody acts on wording that may still change.
Due diligence questionnaire
A set of questions a customer, investor or partner sends to check an organization’s practices, often covering security, privacy and compliance. Answers usually have to be backed by current, approved policies, and buyers increasingly ask for the policies themselves.

E

Editor
The person responsible for writing and maintaining a document. The editor drafts changes, sends the document for approval, and keeps it current between reviews.
Effective date
The date from which a version of a document applies. It can be the approval date or a later date that gives people time to read and prepare. Regulators often ask what a policy said on a given date, so effective dates should be kept for every version.
Electronic signature
A signature made electronically to show that a person agrees to the contents of a record. In the United States, the ESIGN Act gives electronic signatures and records the same legal effect as paper, provided the requirements are met, and most states have adopted the Uniform Electronic Transactions Act. Evidence of identity, intent and the integrity of the signed record is what makes an electronic signature hold up. How electronic signatures work
Employee handbook
A document that introduces employees to the company’s employment policies, such as hours, leave, conduct and benefits. A handbook is one kind of policy document; many companies also run department policies, procedures and safety programs that sit outside it. Stop calling it a handbook
Evidence
Records that show a requirement has been met: an approved policy, an acknowledgment record, a training log, an audit log export. Auditors work from evidence, so policies need records that show they were approved, issued and read.
Exception
An approved, documented departure from a policy for a specific case, usually time-limited and with a reason and an approver. A clear exception process keeps the policy credible: people know how to ask, and the record shows each exception was decided, not ignored.
Expiry date
The date after which a document should no longer be in use unless it is renewed. An expiry date suits documents that must be revisited by a set time, such as a temporary procedure or an annual plan.
External viewer
A person outside the organization who is given access to read a document, such as a contractor, a supplier, an auditor or a client. External access is usually limited to the documents that person needs, for a period of time. External viewers in AllyMatter

F

Framework
A structured set of requirements or guidance used to build a program, such as NIST CSF 2.0 for cybersecurity. Some frameworks are certifiable standards; others are guidance an organization adopts voluntarily or because a customer asks.

G

Governance
The way an organization is directed and controlled: who decides, who is accountable, and how decisions are recorded. Policies are a main governance tool, because they turn decisions into written rules that people can follow and auditors can check.
GRC (governance, risk and compliance)
A combined approach to governance, risk management and compliance, and the name for software suites that cover all three. GRC suites often include policy management alongside risk registers, audits, incidents and controls.

I

Internal audit
An audit an organization runs on itself, or has run on its behalf, to check that its processes and policies work as intended. Most management system standards require a program of internal audits, with records of what was audited and what was found.

M

Major version
A version that changes the substance of a document, such as a new requirement, a removed step or a change in who is covered. Some teams number major versions 1.0, 2.0 and so on. Whether a change counts as major or minor, it still changes what people are asked to follow.
Management review
A scheduled review by top management of how a management system is performing, required by ISO management system standards. Its inputs and decisions are kept as records, and it often leads to policy changes.
Management system
The set of policies, processes and records an organization uses to achieve its objectives in a given area, such as quality (ISO 9001), information security (ISO/IEC 27001) or road traffic safety (ISO 39001). Management system standards share a common structure, so an organization can run several together.
Minor version
A version that makes a small change, such as a correction or a clarification. Teams often number minor versions 1.1, 1.2 and so on. Even a small edit can change meaning, so many teams still send minor versions through approval and back to the people they cover.

N

Nonconformity
A failure to meet a requirement, found in an audit or in normal work. Auditors grade nonconformities by seriousness. Common findings in policy work include an out-of-date document in use, a missing approval, or no evidence that staff received a policy.
Notification
A message telling people that a document is new or has changed, without asking them to confirm anything. Notification suits documents people should know about but do not need to formally accept. Acknowledgment or notification

O

Obsolete document
A document, or a version of one, that is no longer in force. Obsolete documents are kept for the retention period and marked or removed from use, so that nobody follows an old rule by mistake.

P

Periodic review
A scheduled review of a document to confirm it is still accurate and fit for purpose, even if nothing has prompted a change. Many standards and regulations expect policies to be reviewed at planned intervals, often yearly, and the review itself should be recorded.
Policy
A written statement of what an organization requires and why, approved by people with the authority to set it. A policy says what must happen; procedures and work instructions say how. Policies apply to a defined audience and are reviewed and updated over time.
Policy layer
The part of any standard or regulation that lives in written documents: the policies, procedures and plans it asks for, and the records that show each one was approved, kept current, and received by the people it covers. Most standards also require operational work beyond this layer, such as testing controls or running inspections.
Policy lifecycle
The stages a policy moves through: drafting, review, approval, distribution, acknowledgment, periodic review, revision, and finally retirement. Managing the lifecycle means every policy is somewhere on this path, with a record of each step.
Policy management
The practice, and the software, for running the policy lifecycle across an organization: writing and approving policies, getting them to the right people, recording acknowledgment, keeping them current, and producing the record when asked. Policy management with AllyMatter
Procedure
A written description of how to carry out a task or process, step by step. Procedures put policies into practice. A procedure is usually more detailed than a policy and changes more often.
Public policy page
A published copy of a policy that anyone can read without signing in, such as a privacy notice, a supplier code of conduct or terms of use. A public page should always show the current approved version, so outside readers never see an old one. Public pages in AllyMatter

R

Re-acknowledgment
Asking people to acknowledge a document again after it changes, so that the record covers the version currently in force. Without re-acknowledgment, an organization can show that people read last year’s policy but not this year’s. Re-acknowledgment after a policy update
Records retention
Keeping records for as long as law, regulation, contracts or the organization’s own rules require, and disposing of them safely afterwards. For example, HIPAA requires required documentation to be kept for six years. A retention schedule lists each type of record and how long it is kept.
Redline
A marked-up copy of a document showing what changed between two versions: deletions struck through, additions underlined or highlighted. A redline lets approvers and readers see exactly what moved without rereading the whole document.
Regulation
A rule issued by a government agency under authority given by law, such as the HIPAA Privacy and Security Rules or the FTC Safeguards Rule. Unlike voluntary standards, regulations are mandatory for the organizations they cover and are enforced by the agency.
Reminder
A follow-up message to people who have not yet acted on a document, such as acknowledging or signing it. Reminders can run on a set cadence until each person responds.
Review date
The date by which a document must be reviewed. A review date makes periodic review visible and assignable, instead of relying on someone remembering it. Versions and reviews in AllyMatter
Risk assessment
The process of identifying risks, judging how likely and how serious each one is, and deciding how to treat it. Many security, privacy and safety standards require a documented risk assessment, which in turn drives which policies and controls an organization needs.
Role
A set of permissions given to a person, such as writing documents, approving them or only reading them. Assigning permissions by role keeps access consistent as people join, move and leave.

S

Scope
The boundaries of a policy, a management system or an audit: which sites, teams, products, processes or data it covers. A clear scope tells people whether a document applies to them and tells an auditor what to sample.
SOP (standard operating procedure)
A detailed, written procedure for a routine operation, written so that anyone trained can carry it out the same way every time. SOPs are common in manufacturing, laboratories, health care and logistics, and are usually controlled documents. What an SOP is and how to write one
Standard
A document that sets out requirements or guidance agreed by a recognized body, such as ISO, so that organizations can work in a consistent way. Some standards are certifiable, like ISO 9001; others are adopted voluntarily or because customers require them.
Superseded version
A previous version of a document that has been replaced by a newer approved version. Superseded versions are kept so you can show what applied before, but they are no longer in force.
Surveillance audit
A periodic audit by a certification body, usually yearly, between initial certification and recertification. Surveillance audits sample part of the management system each time, often including document control and recent changes.

T

Tag
A label attached to documents and people, such as a department, a site or a role. Tags make it possible to send each document to exactly the people it applies to, and to find related documents quickly. Access control with tags
Template
A pre-structured document used as a starting point for a new policy or procedure. A template keeps documents consistent, but it is only a starting point: the content has to be adapted to the organization and approved like any other document.
Training record
A record that a person completed training, with the date and the subject. Many regulations and standards ask for training records alongside policies, to show that people were not only given a rule but taught it.

V

Version
One fixed state of a document at a point in time. Each version has its own content, approval and effective date. Keeping versions separate is what lets you show exactly what a policy said, and who accepted it, at any date. Versions and reviews in AllyMatter
Version compare
Showing the differences between two versions of a document, word by word: what was added and what was removed. A version compare helps approvers check a change quickly and helps readers see what is new before they acknowledge it again. Track every change with version control
Version history
The full list of a document’s versions, with who changed it, who approved each version, and when. Version history is the backbone of document control and one of the first things an auditor looks at. Version history and restore

W

WISP (written information security program)
A written program describing how an organization protects the information it handles: risk assessment, safeguards, training, vendor oversight and incident response. Tax professionals are expected to keep one, and the FTC Safeguards Rule requires a written information security program for the financial institutions it covers.
Work instruction
A detailed, task-level document that tells a person exactly how to do one specific job, often at a workstation. Work instructions sit below procedures in a document hierarchy and are common in manufacturing and laboratories.
Written program
A set of written policies and procedures that a regulation requires for a specific area, such as an OSHA hazard communication program or an FTC Safeguards Rule information security program. A written program usually has a named owner and must be kept current and available to the people it covers.

Try AllyMatter free for 30 days

  • No credit card needed
  • 30-day money-back guarantee
  • Free migration on yearly plans
Start a TrialBook a Demo (opens in a new tab)