Before you start

You need the relevant document or policy permissions and an accountable policy owner.

Step by step

  1. Open Policies and find the existing policy before adding a replacement.
  2. Review the owner, current version, status and review timing.
  3. Use the available drafting or amendment controls to prepare a revision. Check any AI-generated wording against organisational practice.
  4. Route the policy for the required human review and approval.
  5. Confirm the resulting status and retain the prior version and decision history.

What happens next

A draft is not an approved policy. Use the approved version for assurance responses and review it when organisational practice changes.

If something does not look right

If the policy says something your organisation does not do, correct the wording or assign remediation. Do not treat generated text as proof that a control operates.