The policy owner's playbook: drafting, approval, attestation and review cycles
How to run the policy management lifecycle: drafting, approval, attestation and review cycles, with what the DOJ, USSG 8B2.1, ISO 37301 and NIST require.
**Answer first.** A policy owner runs four connected stages: draft the policy against an identified obligation or risk, get it approved by a named authority, publish it where staff can find it and attest to it, then review it on a fixed cycle and after trigger events. Regulators and standards bodies judge the record of that cycle, not the document alone.
**Answer first.** A policy owner runs four connected stages: draft the policy against an identified obligation or risk, get it approved by a named authority, publish it where staff can find it and attest to it, then review it on a fixed cycle and after trigger events. Regulators and standards bodies judge the record of that cycle, not the document alone.
Why the lifecycle matters more than the document
The US Department of Justice tells prosecutors to ask how a company designs new policies, updates existing ones, consults business units before roll-out, confirms that employees can find them, and trains the gatekeepers who approve or certify under them (DOJ, Evaluation of Corporate Compliance Programs, September 2024). The US Sentencing Guidelines set the floor: an organization "shall establish standards and procedures to prevent and detect criminal conduct", communicate them periodically through training, monitor whether they are followed, and modify them after a periodic risk assessment (USSG §8B2.1(b)(1), (b)(4), (b)(5), (c)).
ISO 37301:2021, the certifiable compliance management system standard, asks for the same things in management-system language: communication of the compliance policy to personnel and business associates, training, monitoring and auditing, and management review (ISO/TC 309, ISO 37301 FAQs). COSO's Internal Control framework places policies and procedures under Principle 12, the mechanism through which control activities are deployed (COSO, Internal Control Integrated Framework).
Each of those sources describes a cycle with evidence at every stage. That is the policy owner's job.
Who does what
Four roles share the work, and the split should be written down.
- Policy owner. Accountable for one policy or a family of policies: content, approval, publication, attestation and review dates. NIST SP 800-53 asks organizations to "designate an official to manage the development, documentation, and dissemination" of each policy and its procedures (NIST SP 800-53 Rev. 5, AC-1(b)).
- Policy analyst. Runs the mechanics: templates, version control, the review calendar, attestation campaigns and the evidence file.
- Ethics and compliance lead. Holds "day-to-day operational responsibility" for the program and reports to senior management on its effectiveness (USSG §8B2.1(b)(2)(C)).
- Chief compliance officer. One of the "high-level personnel" assigned overall responsibility, answerable to the governing authority, which must know the program's content and operation (USSG §8B2.1(b)(2)(A), (B)).
Stage 1: drafting
Start from the obligation or risk the policy answers, not from a template. The DOJ asks whether policies "mitigate risks identified by the company as part of its risk assessment process" and whether business units were consulted before roll-out (DOJ ECCP, I.B). Record the obligation, the risk and the controls the policy will govern before writing a sentence.
NIST SP 800-53 gives a usable content checklist for any policy, not only security ones. A policy should address "purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance", and be consistent with applicable laws, regulations and standards (NIST SP 800-53 Rev. 5, AC-1(a)). Keep procedures in separate documents that describe how the policy is carried out, so that a procedure can change without reopening the policy.
Two drafting rules save review time later. First, name the control each requirement relies on, so that the policy, the control and the evidence stay linked. Second, write in plain language for the audience that must attest to it, with a defined-terms section where the subject demands precision.
Stage 2: approval
Approval is a control, so it needs a named authority, a record and a date. The DOJ singles out "those with approval authority or certification responsibilities" as gatekeepers and asks what guidance and training they have received (DOJ ECCP, I.B). Set the approval level by policy tier: board or committee for the code of conduct and program-level policies, executive owner for functional policies, and policy owner for procedures.
The approval record should capture the version approved, who approved it, the date, the effective date and any conditions. Keep the superseded version; a reviewer will want to see what changed and why.
Stage 3: publication and attestation
A policy nobody can find does not count. The DOJ asks whether policies are "published in a searchable format for easy reference", how the company "confirm[s] that employees know how to access relevant policies", and whether it tracks which policies attract attention (DOJ ECCP, I.B). The Sentencing Guidelines require periodic communication "in a practical manner" to the board, senior and substantial-authority personnel, employees and, where appropriate, agents (USSG §8B2.1(b)(4)). ISO 37301 extends communication of the compliance policy to business associates as well as personnel (ISO/TC 309, ISO 37301 FAQs).
Attestation is the evidence that communication landed. The DOJ expects "periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners" (DOJ ECCP, I.C). A workable attestation record holds the policy version, the person, the date, the method (read-and-acknowledge, quiz or training completion) and the exceptions, with a follow-up list for anyone who has not responded. Scope the audience by role: a trading policy goes to traders and their supervisors, not to the whole company.
Stage 4: review cycles and triggers
Reviews run on two clocks. The first is a fixed cycle. NIST SP 800-53 leaves the frequency to the organization but requires that each policy is reviewed and updated at a defined frequency (NIST SP 800-53 Rev. 5, AC-1(c)). Set the cycle by risk tier and record it on the policy itself.
The second clock is event-driven. NIST CSF 2.0 states the outcome plainly: policy "is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission" (NIST CSF 2.0, GV.PO-02). NIST SP 800-53 lists the events that should trigger a review: "assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines" (NIST SP 800-53 Rev. 5, AC-1 discussion). The DOJ adds lessons learned from the company's own issues and from peers in the same industry or region, and asks whether the periodic risk review "led to updates in policies, procedures, and controls" (DOJ ECCP, I.A and I.B). After misconduct, the Sentencing Guidelines require "any necessary modifications" to the program (USSG §8B2.1(b)(7)).
A review ends in one of three outcomes: reaffirm without change, revise and re-approve, or retire with a redirect to the replacement policy. Each outcome is recorded, and a material revision restarts the attestation campaign for the affected audience.
What the record must show
An examiner, auditor or certification body reads the lifecycle backwards from the evidence. For each policy the record should answer: which obligation or risk it addresses, which controls it governs, who approved which version and when, who received it and who attested, when it was last reviewed, what triggered the review and what changed. ISO 37301 lists corrective action and management review among the measures an organization must demonstrate (ISO/TC 309, ISO 37301 FAQs).
SmartSuite's Policy Management product holds each policy as a record with its owner, version history, approval workflow, linked obligations and controls, attestation campaigns and review dates, so that the answers above come from one place rather than from a folder of documents and a spreadsheet.
Key facts
| Fact | Detail | Source |
|---|---|---|
| DOJ guidance edition | Evaluation of Corporate Compliance Programs, updated September 2024 | DOJ |
| DOJ policy questions | Five headings: design, comprehensiveness, accessibility, responsibility for operational integration, gatekeepers | DOJ ECCP, I.B |
| Sentencing Guidelines floor | §8B2.1(b) lists seven minimum requirements; (c) adds periodic risk assessment | USSC Guidelines Manual, 1 November 2025 |
| ISO 37301 | Published 13 April 2021; a requirements standard, so organizations can be certified; revised ISO 19600:2014 from a guideline into requirements | ISO/TC 309 |
| NIST CSF 2.0 | Published 26 February 2024; Govern function includes the Policy category GV.PO with two outcomes | NIST CSWP 29 |
| NIST SP 800-53 Rev. 5 | Published September 2020; every control family opens with a policy and procedures control (the "-1" control) that requires a named official and a defined review frequency | NIST SP 800-53 Rev. 5 |
| COSO | Internal Control Integrated Framework issued 1992, refreshed 2013; 17 principles, Principle 12 covers deploying controls through policies and procedures | COSO |
Frequently asked questions
How often should a policy be reviewed?
No primary source fixes a universal interval. NIST SP 800-53 requires review at an organization-defined frequency and after defined events; NIST CSF 2.0 requires review to reflect changes in requirements, threats, technology and mission. Set the cycle by risk tier, record it on the policy, and treat audit findings, incidents and legal change as triggers that override the calendar.
What is the difference between attestation and training certification?
Attestation is a person's recorded acknowledgement that they have received and will follow a specific policy version. Training certification records that they completed instruction and, usually, passed an assessment. The DOJ expects both: periodic training and certification for directors, officers, relevant employees and, where appropriate, agents and business partners. Keep both records against the policy version.
Who should approve a policy?
Match the approver to the policy's reach. Program-level documents such as the code of conduct go to the board or a board committee, because the governing authority must know the program's content and operation under USSG §8B2.1(b)(2)(A). Functional policies go to the accountable executive, and procedures to the policy owner. Record the approver, version and date every time.
What should trigger a review outside the normal cycle?
NIST SP 800-53 names assessment or audit findings, incidents or breaches, and changes in laws, regulations, standards or guidelines. The DOJ adds lessons learned from the company's own issues and from other companies in the same industry or region, and emerging risks such as new technologies. After detected misconduct, USSG §8B2.1(b)(7) requires any necessary modifications to the program.
Does ISO 37301 require a documented policy lifecycle?
ISO 37301:2021 is a requirements standard, so an organization can be certified against it. The ISO/TC 309 FAQ lists what it requires, including communication of the compliance policy to personnel and business associates, training, monitoring and auditing, performance evaluation, corrective action and management review. Together those requirements describe a lifecycle with evidence at each stage, which is what a certification auditor will test.
Sources
- US Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (updated September 2024): https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl
- US Sentencing Commission, Guidelines Manual (1 November 2025), Chapter 8, §8B2.1 Effective Compliance and Ethics Program: https://www.ussc.gov/sites/default/files/pdf/guidelines-manual/2025/CHAPTER_8.pdf
- ISO/TC 309, ISO 37301 published (13 April 2021): https://committee.iso.org/sites/tc309/home/news/content-left-area/news-and-updates/iso-37301-published.html
- ISO/TC 309, ISO 37301:2021 FAQs (May 2022): https://committee.iso.org/files/live/sites/tc309/files/FAQ%2037301/ISO%2037301%20FAQs,%20May%202022.pdf
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (26 February 2024), GV.PO-01 and GV.PO-02: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (September 2020), AC-1 Policy and Procedures: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
- COSO, Internal Control Integrated Framework (1992, refreshed 2013): https://www.coso.org/guidance-on-ic
Related
- Category: Regulatory & Framework Readiness
- Policy management that connects the written rule to the actual control
- Policy vs procedure vs control: what's the difference in GRC
- Connected GRC for policy owners: connecting policy, controls and training
- What is policy management in GRC?
- Policy Management in the Compliance Management suite
Reviewed by: [reviewer name and credential to be added before staging]
Linked Articles
Learn how to build a supervisory-ready evidence trail by linking obligations, policies, controls, owners, evidence, testing, issues, remediation, validation, and dashboards.
Learn how to prepare for regulatory inquiries by connecting obligations, evidence, owners, legal review, response workflows, issues, remediation, and dashboards.
Learn how to run regulatory change impact assessments by linking legal change to obligations, policies, controls, owners, evidence, issues, remediation, and dashboards.
Learn how to map NIST, ISO 27001, SOC 2, SOX, CRI, and internal policies into shared controls, evidence, testing, issues, and dashboards without duplicating work.
Learn how to prepare for EU AI Act readiness in Connected GRC by linking AI inventories, risk classification, obligations, controls, evidence, vendors, monitoring, issues, and dashboards.
Compare NIST AI RMF, ISO/IEC 42001, and CRI AI RMF, and learn how Connected GRC turns AI frameworks into inventories, controls, evidence, issues, monitoring, and dashboards.
Learn how ISO/IEC 42001 works inside Connected GRC by linking AI policy, inventory, risk, controls, vendors, evidence, monitoring, audit, and continual improvement.
Learn how SEC cyber disclosure connects to GRC by linking cyber incidents, materiality assessment, board oversight, evidence, controls, vendors, remediation, and reporting.
Frequently Asked Questions
Answers to the questions readers ask most about this topic.
A policy defines expectations and rules. A playbook tells people what to do when a specific event occurs, including who owns the response, what evidence is required, what approvals are needed, and how closure happens.
Legal review interprets what changed and whether it may apply. Regulatory change management turns that interpretation into operational action by updating obligations, policies, controls, evidence, owners, workflows, issues, and dashboards.
A policy management dashboard should include policies by risk area, policies mapped to obligations, policies mapped to controls, overdue reviews, attestations by audience and version, training completion, exceptions, issues linked to policies, policies lacking owners, evidence readiness, and decisions needed.
Regulatory change should trigger policy review when an obligation changes. The policy workflow should show the regulatory source, affected obligation, policy owner, required update, control impact, attestation need, evidence requirement, and implementation status.
Policy exceptions should be documented with a business justification, affected policy, risk impact, compensating control, approver, expiration date, review date, evidence, and remediation plan where needed.
Contract Lifecycle Management connects to GRC by linking contracts to vendors, obligations, data use, cyber requirements, privacy terms, service commitments, business continuity expectations, renewals, issues, and evidence. This keeps contractual risk visible after execution.
Contract Lifecycle Management in Connected GRC is the process of managing contracts from intake, drafting, review, approval, negotiation, execution, obligation tracking, performance monitoring, amendments, renewals, and termination through connected workflows, owners, risks, issues, evidence, and reporting.
A policy management dashboard should include policies by risk domain, policies by owner, policies mapped to obligations, policies mapped to controls, overdue reviews, attestations by version, training completion, exceptions, issues linked to policies, evidence readiness, and decisions needed.
Put Connected GRC into action with SmartSuite
Map controls, collect evidence, run assessments, manage remediation, and report readiness - all from a single connected system.