Nobody is certain which version is current
Several copies circulate across drives and mailboxes, and the one people actually follow is not necessarily the one that was approved.
Policy and SOP
The current version, the approval behind it, and proof that people have read it
A policy framework is only as good as the answer to three questions: which version is current, who approved it, and can you show that the people it binds have seen it. This module holds policies and standard operating procedures in one governed library — drafting and approval on a workflow, versions and effective dates on record, acknowledgement tracked by employee, review dates that come up on their own, and a mapping to the risks, controls and processes each document governs.
Where it usually goes wrong
Most teams know how to do this work. The trouble is that it lives in workbooks, mail threads and shared folders, and keeping them in sync becomes a job of its own.
The approval trail is in an old mail thread
When the auditor asks who approved a policy and on what date, the answer has to be reconstructed from inboxes and minutes.
Reviews are missed until something happens
Documents carry no review date, so a policy written against superseded law stays in force until an audit notices.
Policies sit apart from the controls they govern
A policy change does not reach the control description or the SOP that depends on it, so the framework drifts out of alignment.
With Policy and SOP
- One library with a single current version of every document
- Drafting, review and approval recorded as workflow, not as email
- Effective dates, version history and superseded copies retained
- Acknowledgement tracked by employee and reportable
- Review dates that raise themselves before they lapse
- A visible map from policy to process, risk and control
What Policy and SOP does
Hold policies and SOPs in one library with version history, review dates and approval trails. Each document can be mapped to the risks and controls it governs, so a policy change is visible wherever it matters.
Governed document library
Policies, SOPs, charters, manuals and formats held in one structured library with the metadata that makes them governable.
- Owner, approver and approving authority
- Document number, version and effective date
- Category, entity and applicability
Drafting and approval workflow
A document moves from draft through review to approval on a defined route, and the trail is captured as it happens.
- Configurable review and approval routes
- Reviewer comments held with the draft
- Board or committee approval reference recorded
Version control and change log
Each revision is a version with a change summary, and superseded versions are retained rather than overwritten.
- Version history with change summary
- Superseded versions archived, not deleted
- What changed between versions
Publication and acknowledgement
Publish to the audience a document applies to, and track who has read and acknowledged it — with reminders for those who have not.
- Applicability by entity, function or grade
- Employee-wise acknowledgement record
- Reminders and an acknowledgement status report
Review calendar
Every document carries a next review date, and the owner is prompted ahead of it so periodic review happens on schedule.
- Review frequency per document
- Advance reminders to the document owner
- Review-due and overdue dashboard
Mapped to risk and control
Link each document to the processes, risks and controls it governs, so a policy change can be traced to what it affects.
- Policy to process and SOP linkage
- Policy to risk and control mapping
- Processes without a governing policy identified
Exception and waiver register
Where a deviation is approved, record it as an exception with a validity period rather than leaving it undocumented.
- Exception request with justification
- Approval authority and validity period
- Alerts as an exception approaches expiry
Search and controlled access
People find the current version by searching for it, with access governed so confidential documents reach only their intended audience.
- Full-text search across the library
- Role-based visibility and download control
- Read access logged for sensitive documents
Policy and SOP on screen
Screenshots taken from the live product.
Where each person stands
What is assigned to someone, what they have acknowledged and what is still outstanding — with the pending policies listed oldest due date first, and the same list tracked across the department. This is the view that turns acknowledgement from an assumption into a record.
How a cycle runs
The steps in the order your team will actually work through them.
- 1
Draft
The owner drafts against the approved template and the document numbering convention.
- 2
Review
Reviewers comment on the draft in place, and the comments stay with the version they relate to.
- 3
Approve
The approving authority signs off, and the approval reference and date are recorded against the version.
- 4
Publish
The document goes live with an effective date, and the previous version is superseded and archived.
- 5
Acknowledge
The applicable audience reads and acknowledges, with reminders until the record is complete.
- 6
Review cycle
The next review date comes up on its own; the document is reaffirmed, revised or retired.
What you have at the end
The records the module produces, and the regulations and frameworks they help you meet.
Reports and records
- Policy and SOP master list with current versions
- Approval trail with authority and date per document
- Version history and change log
- Employee acknowledgement status report
- Review-due and overdue dashboard
- Exception and waiver register
- Policy to risk and control coverage map
- Archive of superseded versions
Built around
- Companies Act 2013 — board-approved policies
- Supports CSR, related party, vigil mechanism and similar policies requiring Board approval and disclosure.
- SEBI LODR — Reg 9 and Schedule II
- Preservation of documents and maintenance of the policies listed entities must keep current.
- SEBI PIT Regulations
- Code of conduct and its acknowledgement by designated persons.
- ISO 9001 / ISO 27001
- Documented information control — approval, version, distribution and retention.
- DPDP Act 2023
- Maintenance of the privacy notice and the internal policies around it.
These references describe the context the module is designed to support. They are not a statement of certification, and do not replace professional judgement on your reporting obligations.
Who works in it
Everyone works on the same record. Each person sees the part they are responsible for.
- Company Secretary
- Maintains board-approved policies with their approval references and disclosure obligations.
- Compliance and risk teams
- Keep the framework aligned to current law and track review cycles.
- Process owners
- Own the SOPs for their process and revise them when the process changes.
- Employees
- Find the current version and record acknowledgement where it is required.
Questions we usually get
Don't see your question here? Write to us and we'll answer it for your setup.
Can we keep our own document numbering and templates?
Yes. Numbering conventions, categories and templates are configured to your framework, and existing documents retain their numbers when they are brought into the library.
How is acknowledgement recorded?
A published document is assigned to its applicable audience, and each person's acknowledgement is recorded with a timestamp. Pending acknowledgements are reportable and can be reminded automatically.
Are superseded versions retained?
Yes. Superseded versions are archived with their effective and supersession dates, so it is possible to establish which version was in force on a given date.
How does this help during an audit?
For any document, the auditor can be shown the current version, who approved it and when, the change history, the acknowledgement position and the controls it governs — without assembling it from separate sources.
See Policy and SOP on your own data
Book an hour with our team. We will run the module on your own process and control matrix, so you can see how a full cycle would look for you.
Other RiskMan GRC modules
View the full product- Enterprise Risk ManagementA live risk register feeding heat maps and management reporting.
- Risk Based Internal AuditPlan by risk, approve the plan, assign it process-wise and execute it.
- Control TestingRun a testing project end to end — RCM, IDR, testing, approval, management response and report.
- Action Taken ReportTrack every observation through to closure, with owners and due dates.
- Global SOXFor groups testing the same SOX controls across many entities. One control library, one approved scope, and projects that end in a signed-off report.