Playbooks
The lifecycle of a policy
Write, approve, have read and accepted, revise and retire a policy, with the acknowledgement as proof.
Role: Compliance manager Role: Approver Screen details: Policies. States of a policy: draft, in approval, in force, review due, review overdue, expired, retired.
1. Write
Role: Compliance manager "New policy": a template (in French and English, copied with no later link) or a blank page; language, text, review interval (30 to 1,095 days), audience (everyone or named people), acknowledgement required or not, owner and approver. Without a named approver, a policy cannot be submitted.
2. Get it approved
- "Submit for approval".
- Role: Approver Read and click "Approve". The policy is "In force", with version, approver, date and a fingerprint of the text.
- If the approver is also the owner or the person who submitted, the server refuses, except for an administrator; the policy then carries the note "Approved by its own owner or by the person who submitted it: the separation of duties is not ensured, and the auditor will see it."
3. Have it read and accepted
People concerned see the policy under "To read and accept", tick the box to accept version N, then accept. Acknowledgements feed People and training ("Policies to acknowledge").
4. Revise
"Start a revision" opens a new version without touching the one in force. Approving the revision restarts acknowledgements; earlier versions stay under "Previous versions".
5. Review or retire
Marking a policy as reviewed records a review with no change. "Retire the policy" takes it out of force and stops acknowledgements.
6. The proof
The screen keeps the text, version, approver, date, fingerprint and acknowledgements; every step is in the audit log.
What the app does not do
- It does not say a policy complies with a standard: it keeps the text, approval and acknowledgements.
- It neither reads nor writes the linked Confluence page: it is only a link.
- It keeps no more than 60,000 characters per version.
Was this page helpful?