Policy Ownership & Governance

Clear ownership is the foundation of effective policy governance. Every policy in PolicySuite has a designated owner who is accountable for keeping it current, accurate, and reviewed on schedule. This guide explains how to assign owners, define their responsibilities, and use the ownership dashboard to stay on top of your governance programme.

1. Assigning policy owners

Every policy should have a single owner — the person ultimately responsible for its content and currency. You can assign an owner at two points:

• During creation — when you create a new policy, the "Policy owner" field in the metadata panel defaults to the author. You can change this to any team member with a policy_author, compliance_admin, or org_admin role.
• After creation — open any existing policy, click the Settings tab, and update the "Policy owner" field. Only compliance_admins and org_admins can reassign ownership on published policies.

Choose owners based on subject-matter expertise. For example, your Head of IT should own information security policies, your HR lead should own employment-related policies, and your CFO or Finance Director should own financial compliance policies.

2. Owner responsibilities

A policy owner in PolicySuite is expected to:

• Review the policy on schedule — when the review date arrives, the owner receives automated email reminders and should assess whether the policy still reflects current practices, regulations, and organisational needs
• Update content when needed — if regulations change, business processes evolve, or gaps are identified during audits, the owner should draft updates and submit them for approval
• Ensure compliance alignment — the owner should verify that the policy correctly maps to the relevant compliance frameworks (e.g. ISO 27001 controls, GDPR articles) and update framework tags as needed
• Respond to audit queries — during internal or external audits, the owner is the point of contact for questions about the policy's content, scope, and enforcement

3. Setting review dates and cadence

Each policy has a review date that determines when it should next be assessed. To set or update a review date:

1. Open the policy and go to the Settings tab
2. Set the Next review date field to the desired date
3. Click Save

Common review cadences include:

• Annually — suitable for most standard policies (e.g. acceptable use, data protection, HR policies)
• Semi-annually — recommended for policies in fast-changing regulatory areas (e.g. AI governance, financial compliance)
• Quarterly — appropriate for high-risk or rapidly evolving policies (e.g. incident response, access control)

PolicySuite sends automated reminders to the policy owner at 30 days, 7 days, and on the review date itself. If the review date passes without the policy being updated, it is flagged as overdue.

4. Ownership dashboard

The ownership dashboard gives compliance_admins and org_admins a centralised view of policy governance across the organisation. To access it:

1. Navigate to Policies > Lifecycle in the left sidebar
2. Use the filters to group policies by owner, or view all policies sorted by their next review date

The dashboard shows:

• Policies per owner — how many policies each team member owns, helping you spot imbalances
• Upcoming reviews — policies with review dates in the next 30, 60, or 90 days
• Overdue reviews — policies that have passed their review date without being updated, highlighted with a red indicator
• Unowned policies — any policies that do not have an assigned owner, which should be addressed immediately

5. Transferring ownership

When a team member leaves the organisation or changes roles, their policy ownership should be transferred promptly. To transfer ownership:

1. Open the policy and navigate to the Settings tab
2. Change the Policy owner field to the new owner
3. Click Save — the new owner will receive an email notification confirming the assignment

For bulk transfers (e.g. when an employee leaves and owns multiple policies), compliance_admins can filter the policy list by owner and reassign each policy individually. The audit trail records every ownership change, including who made the transfer and when.

Related Articles

• Policy Lifecycle & Version Control
• Roles & Permissions
• Setting Up Reminders