If half of our policies are past their review date, then how do we recover?

Start

Half the policies are past their review date

A document past its next review date has the status Review overdue. It stays in force and people keep following it until the review is approved, so the risk is out-of-date rules, not missing ones. A missed review date is not an exception either: it is Review overdue, and it is reported.

• Then: Is every document on the register, with a tier and one owner?

Decision

Is every document on the register, with a tier and one owner?

Recovery needs a list you can trust. Collect every security document wherever it lives: the policy library, shared drives, onboarding packs. A document not on the register is not in force. A committee is not an owner, and when an owner has left, their line manager is the owner until a new one is named.

• Yes: Does every document in use have a recorded approval?
• No, or not known: Give each a tier, an owner and an ID, and enter it

Step

Give each a tier, an owner and an ID, and enter it

Enter each document with its tier, owner, version, approval date and next review date. The owner is a role held by someone with the authority to make the document work, usually the head of the function that must follow or operate it.

• Then: Does every document in use have a recorded approval?

Decision

Does every document in use have a recorded approval?

An overdue document with a valid approval is still in force. A document people are told to follow with no recorded approval at the right level is a worse problem: it counts in the measure of documents in force without approval, whose target is zero.

• Yes: Order the reviews: triggered first, then policies, then the oldest
• No, or not known: Approve or withdraw those within 30 calendar days

Step

Approve or withdraw those within 30 calendar days

Bring each one for approval at its tier's level, or withdraw it, within 30 calendar days of finding it, in the pack's default. Give each newly approved document a next review date from its new approval date, not its original one.

• Then: Order the reviews: triggered first, then policies, then the oldest

Step

Order the reviews: triggered first, then policies, then the oldest

A document with a review trigger, such as an audit finding or an incident, needs review now whatever its date. A policy past its review date is the most visible gap to an auditor or supervisor, and the target for policies is zero. Then work down by days overdue. The pack sets no order of its own: its review schedule lists every document in force by review date, earliest first.

• Then: Name every overdue document in the quarterly report

Step

Name every overdue document in the quarterly report

The quarterly report to management names each document that is Review overdue, with its owner and days overdue, and states the decisions management needs to take. Keep naming each one until its review is approved. The pack's target is zero policies overdue and no document more than 30 days overdue.

• Then: Has each owner agreed a date to finish their review?

Decision

Has each owner agreed a date to finish their review?

The owner decides the review outcome and is accountable for it. Every document 30 calendar days overdue is escalated anyway, but an owner with no date is the one to push first. Watch capacity too: information security should own no more documents than it can review on time.

• Yes: What does the review find?
• No, or not known: Escalate to executive management, asking for a decision

Step

Escalate to executive management, asking for a decision

At 30 calendar days overdue, information security escalates to executive management. The escalation states the document, the owner, the date missed, the days overdue and the decision needed. It asks for a decision, not just attention: in the pack's worked example, management accepted the owner's plan and date.

• Then: What does the review find?

Decision

What does the review find?

The owner checks whether the document is still accurate, complete and followed, looking at triggers, exceptions granted against it, audit findings, incidents and acknowledgement coverage. If the owner and information security disagree on whether a change is material, it is material.

• Nothing to change: Approve a minor version in writing
• A change that is not material: Approve a minor version in writing
• A material change: Draft a major version: consult, approve, re-acknowledge
• No longer needed: Retire it through the tier's approver

Step

Approve a minor version in writing

Prepare the next minor version, recording 'Reviewed — no change' where nothing changed. It can be approved in writing without a meeting, with no consultation and no new acknowledgement, so existing acknowledgements still count. This is the quickest route through a backlog.

• Then: Set each next review date from the new approval date

Step

Draft a major version: consult, approve, re-acknowledge

Prepare the next major version. It is consulted on for at least 10 working days, approved at its tier and published, and everyone in scope acknowledges it within 30 calendar days. Meanwhile the register keeps the overdue status of the version in force, with the revision's stage in its notes.

• Then: Set each next review date from the new approval date

Outcome

Retire it through the tier's approver

If the document is no longer needed, the owner proposes retirement with the reason and says where any requirement that still applies now lives. The tier's approver decides in writing, and the document is withdrawn, archived and marked Retired.

Step

Set each next review date from the new approval date

The next review date is the approval date plus the tier's maximum interval: 12 months for policies and standards, 24 months for procedures and guidelines. The owner may set an earlier date, never a later one. Documents approved in the same month fall due together next time, so an earlier date can spread the load.

• Then: Send review notices 90 days before each date

Step

Send review notices 90 days before each date

Information security tells each owner at least 90 calendar days before the next review date. In the pack's worked example, a review started when the notice fell due would have covered drafting, consultation and a meeting of the approver, and the policy would never have been overdue.

• Then: At quarter end, is any document still past its review date?

Decision

At quarter end, is any document still past its review date?

Read it from the register at each quarter end. The recovery is done when no policy is past its review date and no document is more than 30 days overdue.

• Yes: next in order: Order the reviews: triggered first, then policies, then the oldest (back to an earlier step)
• No: Back in date; keep the schedule running

Outcome

Back in date; keep the schedule running

Reconcile the register with the policy library every quarter and keep a copy of it as at each quarter end. Watch the reviews due soon, so each review starts when its notice falls due rather than when its date passes.