How often should company policies be reviewed, and by whom?
Written by PolicyDrafters. Published , updated .
Review each policy at least yearly and whenever a trigger fires: a rule or fact it relies on changes, or an incident or audit exposes a gap. ISO/IEC 27001:2022 Annex A 5.1 asks for review at planned intervals and after significant changes. The owner reviews and the approver re-approves. On the PolicyDrafters maintenance plan, our legal team reads rule changes.
Which two clocks does a policy run on?
A policy review is a dated reading of a policy by the owner it names, against the current text of the rule it cites and the facts it states, recorded in its revision block with the reviewer's name and the outcome. Every policy needs that reading on two clocks. The first is the calendar: a fixed interval at which someone opens the document, reads it, and signs to say it still holds. The second has no fixed interval at all: it starts when something the document depends on changes, and it runs until the document is read again.
Annually is the convention for the first clock, and for most documents it is a convention rather than a law; the standards that ask for review ask for planned intervals and leave the interval to you. A review schedule that has only the first clock will be right on the anniversary and wrong for the eleven months after the rule moved.
The honest answer to the question, then, is both. Review on a cycle so that no document goes unread for more than a year, and review on a trigger so that a document is read within weeks of the thing it describes changing. The cycle catches slow drift: the office that moved, the approver who left, the tool that was replaced without anyone thinking of the policy. The trigger catches the changes that matter most and arrive without warning.
| Aspect | Cycle review | Trigger review |
|---|---|---|
| Starts when | The review date in the document comes round, usually once a year | The rule or a fact changes, or an incident, an audit finding or a regulator's request arrives |
| What is read | The whole document | The clause the trigger points at, and anything that depends on it |
| Who reads it | The owner named in the document | The owner, with whoever made or handled the change, and a legal reviewer where a rule moved (our legal team, for documents on our plan) |
| What it catches | Slow drift: a moved office, a departed approver, a replaced tool | The changes that matter most and arrive without warning |
| What it records | A revision block row, even when nothing changed | A revision block row naming the trigger and the clauses changed |
- Starts when
- Cycle reviewThe review date in the document comes round, usually once a year
- Trigger reviewThe rule or a fact changes, or an incident, an audit finding or a regulator's request arrives
- What is read
- Cycle reviewThe whole document
- Trigger reviewThe clause the trigger points at, and anything that depends on it
- Who reads it
- Cycle reviewThe owner named in the document
- Trigger reviewThe owner, with whoever made or handled the change, and a legal reviewer where a rule moved (our legal team, for documents on our plan)
- What it catches
- Cycle reviewSlow drift: a moved office, a departed approver, a replaced tool
- Trigger reviewThe changes that matter most and arrive without warning
- What it records
- Cycle reviewA revision block row, even when nothing changed
- Trigger reviewA revision block row naming the trigger and the clauses changed
What starts a trigger review?
A trigger is any event that makes a sentence in the document untrue or incomplete. Five recur, and each changes a different part of the document.
Scroll sideways for the other columns
| Trigger | Who acts | What changes |
|---|---|---|
| The rule the document names changes: a regulation is amended, a standard is revised, a regulator issues new guidance | The document owner opens the review; a legal reviewer reads the affected clauses against the new text (our legal team, for documents on our plan) | The clauses drafted against the rule, the citation in the revision block, the review date |
| A fact the document states changes: a new tool, a new office, a new product, a new processor, a new reporting line | The document owner, with the person who made the change | The description of the system, the named role, the scope, the record each step leaves |
| An incident: a breach, a complaint, a near miss, a failed step | The owner and whoever handled the incident | The step that failed, the escalation route, what to do when the step fails again |
| An audit or certification finding | The owner, the approver and the person who answered the auditor | The clause the finding names, often the record it asks for and the evidence that it exists |
| A regulator's request or a customer's questionnaire | The owner, with the compliance lead | Whatever the request shows is missing, dated and approved so it can be sent |
The common thread is that the trigger names the part of the document that has to be read, which is why a trigger review is usually quicker than a cycle review. The cycle review reads the whole document. The trigger review reads the clause the trigger points at, checks that nothing else depends on it, and records the change.
Who reviews a policy, and who approves it?
Three people have a role in a policy review, and a document that names only one of them tends to be reviewed by nobody. The owner, named by role, reads the document on the cycle and when a trigger fires: the person closest to the process, such as the HR lead for a leave policy or the compliance officer for an AML policy.
The approver, usually the director, board or committee that carries the risk, re-approves any review that changes the rule. A review that changes only a fact, such as the name of a tool, can be approved by the owner alone if the document says so.
A legal reviewer reads where the document is drafted against a rule: a handbook against employment law, a privacy notice against the GDPR or the CCPA, an AML manual against the FATF Recommendations. For a document on the PolicyDrafters maintenance plan, that is our legal team. The owner knows the process, the legal reviewer reads the new rule, and the revision block records both readings.
What do the standards and the law ask for?
The question is not only one of good housekeeping, because the standards and rules businesses are measured against each ask for review in their own words. ISO/IEC 27001:2022 asks top management to establish an information security policy and keep it available as documented information in clause 5.2, and to review the management system at planned intervals in clause 9.3; Annex A control 5.1 adds that the policies themselves are reviewed at planned intervals and when significant changes occur [1]. That second condition is the trigger clock written into the standard.
ISO 9001:2015 is broader, because it governs all documented information rather than security policy alone. Clause 7.5.2 asks that documented information be reviewed and approved for suitability and adequacy when it is created and when it is updated, and clause 7.5.3 asks that it be controlled so that the current version is the one in use [2]. ISO has since withdrawn the 2015 edition and replaced it with ISO 9001:2026; the clauses cited here are from the 2015 text. An auditor working to either standard will ask for the date of the last review and the name of the reviewer before asking anything about the content.
Data protection law runs both clocks. Article 24(1) of the GDPR requires a controller's technical and organisational measures to be reviewed and updated where necessary, and Article 24(2) says those measures include appropriate data protection policies where that is proportionate [3]. California fixes the calendar outright: Civil Code section 1798.130(a)(5), part of the CCPA, requires a business to update the information in its online privacy policy at least once every 12 months [4]. For that document, an annual review is a requirement of the statute rather than a convention.
For firms under anti-money-laundering rules, the FATF Recommendations ask for policies, controls and procedures approved by senior management (paragraph 13 of the interpretive note to Recommendation 1), and for internal programmes with an independent audit function to test them (paragraph 1 of the note to Recommendation 18): cycle review by another name [5]. Paragraph 12 of the note to Recommendation 1 asks firms to keep risk assessments current. Recommendation 15 asks for one before a new product, business practice or technology launches. Financial services firms face the question most sharply: the examiner reads the revision history before the policy.
Where is a review recorded?
A review that leaves no record did not happen, as far as any reader can tell. The record is the revision block: a short table on the front or back page of the document carrying the document ID, the revision code, the date, the name and role of the reviewer, the name and role of the approver, and one line saying what changed and why. Each review adds a row. A reader who opens the document a year from now can see when it was last read, who read it, and whether the change was a cycle review that found nothing or a trigger review that rewrote clause six.
The document ID matters for the same reason. A policy saved as "Leave policy v3 final (2)" cannot be told apart from its predecessors, and an auditor who finds two versions in circulation has found a finding. A document ID in the form the organisation uses for every document, with the revision code beside it, makes it possible to say which version was in force on a given date, which is the question an auditor, a regulator or a court will eventually ask.
Where the document is drafted against a rule, the revision block also names the rule and the version of it the document was last checked against. That line is what makes a trigger review possible, because it tells the owner what to watch.
How does the trigger clock keep running?
The cycle clock is easy to run: a date in a calendar, an owner with a reminder. The trigger clock is harder, because it needs someone to be watching the rule, and most owners have a job that is not watching regulations. This is what the maintenance plan is for.
Each document on the plan lists the rules it was drafted against in its revision block, and the firm tracks those rules. When one changes we revise the affected sections, our legal team reviews the revision, and a new version arrives in Word and PDF with every change marked and a new revision code. Changes to the facts that you tell us about, a new tool or a new office, produce a revised document the same way. The plan is $29 to $99 a month, billed monthly, depending on how many documents we track, and the figure is in the quote.
Documents we did not draft come onto the plan after a policy review and update, which reads each document against the current text of the rules it names, returns a marked-up copy with the changes tracked and a change note, and adds the document ID and revision block that make tracking possible. A small business with a handbook written three years ago by someone who has since left usually starts here.
When should the cycle be shorter than a year?
Annually is the convention, not the ceiling. Some documents want a shorter cycle because the facts in them change faster than the rules. A procedure that names a tool changes when the tool does, which can be quarterly, and a privacy notice that lists processors changes when a processor is added. An AML risk assessment is read again before a new product or delivery channel launches, as Recommendation 15 asks, rather than waiting for its anniversary.
The right cycle is the one that is shorter than the usual interval between triggers for that document. If triggers arrive every few months, an annual cycle is a formality and the trigger clock is doing the real work.
The reverse is also true. A policy that states a rule and names no tools, a code of conduct or a conflicts policy, can run on an annual cycle with little risk, because almost nothing in it changes between reviews. The point of naming the cycle in the document is that the reader knows which kind of document it is, and the owner knows when it is due.
Questions
- Is an annual policy review a legal requirement?
- For most policies, an annual review is a convention rather than a legal requirement. ISO/IEC 27001:2022 asks for policy review at planned intervals and when significant changes occur, and leaves the interval to the organisation. A few rules do fix a cycle: California Civil Code section 1798.130(a)(5) requires the information in a business's online privacy policy to be updated at least once every 12 months.
- Who signs off a policy review?
- The owner named in the policy records the review in its revision block. A change to the rule goes back to the approver, usually leadership or the board. A change to a fact, such as the name of a tool, can usually be approved by the owner alone if the policy says so.
- What if nothing has changed at a policy review?
- A policy review that finds nothing to change is still recorded. A revision block row dated on the day of the review, with the reviewer's name and a note that the policy was reviewed with no change, is the evidence an auditor asks for. A policy with no such row is treated as unreviewed.
- How does the maintenance plan know when a rule changes?
- Each document on the PolicyDrafters maintenance plan lists the rules it was drafted against in its revision block. PolicyDrafters tracks those rules and, when one of them changes, sends a revised version with the changes marked, reviewed by our legal team.
Sources
- ISO/IEC 27001:2022, clauses 5.2 and 9.3, Annex A 5.1iso.org
- ISO 9001:2015, clauses 7.5.2 and 7.5.3iso.org
- Regulation (EU) 2016/679 (GDPR), Article 24eur-lex.europa.eu
- California Civil Code section 1798.130(a)(5) (CCPA)leginfo.legislature.ca.gov
- FATF Recommendations 1, 15 and 18 and their interpretive notes, updated June 2026fatf-gafi.org
The documents this guide is about
Applies to
Policy review and update
Policy review and update is a check of an existing policy against the current text of the rules it names and the facts it states, returned as a marked-up copy, a revised version with every change tracked and a change note saying what moved and why.
$350 to $500 per document reviewed
5 working days
Employee handbook
An employee handbook is the document that sets out an employer's rules, benefits and procedures for its staff in one place, with an acknowledgement form that each person signs to record that they have read it.
$1,200 to $2,500
10 working days