Module Overview
The Policy Library is the central repository for all organizational policies, featuring version control, approval workflows, mandatory acknowledgment tracking, and automated review scheduling.
What is the Policy Library?
The Policy Library module enables organizations to create, manage, and distribute policies with full lifecycle management. Policies can be uploaded as documents (PDF, DOC, DOCX, TXT) or written directly in the rich text editor. The module supports versioning, so policy updates are tracked, and previous versions remain accessible.
Version Control
Track every policy revision with automatic version numbering and full history
Approval Workflow
Optional approval gate requiring authorized reviewers before policies become active
Acknowledgment
Track which users have read and acknowledged each policy
Review Scheduling
Set review dates and get automated reminders for upcoming and overdue reviews
Policy Lifecycle
Key Features
Policy Creation
Create policies with title, description, category, owner assignment, and supporting document upload. Supports PDF, DOC, DOCX, and TXT formats up to 10MB.
Search & Filter
Full-text search across policy titles, descriptions, and content. Filter by category, owner, status (Active/Draft/Archived), and approval status.
Dashboard Widget
Quick overview with stats cards showing total policies, pending approvals, overdue reviews, and policies due within 30 days.
Approval History
Complete audit trail of approval decisions stored in policy_approval_history table with timestamps and reviewer comments.
Policy Structure
Policy Fields
| Field | Description | Required |
|---|---|---|
| Title | Name of the policy | Yes |
| Description | Brief summary of policy purpose and scope | Optional |
| Category | Maps to audit universe item name for organizational alignment | Yes |
| Owner | Assigned policy owner responsible for maintenance | Optional |
| Status | Active, Draft, or Archived | Yes |
| Version | Auto-incrementing version number (1.0, 2.0, etc.) | Auto |
| Document | Uploaded file (PDF/DOC/DOCX/TXT, max 10MB) | Optional |
| Policy Text | Inline rich text content | Optional |
| Review Dates | Last review date and next scheduled review date | Optional |
Policy Statuses
- Active - Published and currently enforceable
- Draft - Being prepared, not yet active
- Archived - Superseded or retired
- Pending Approval - Awaiting review (only when approval workflow is enabled)
Version Control
How Versioning Works
Each policy maintains version history through the is_latest_version flag. When a new version is created:
- The current version's
is_latest_versionis set to0 - A new record is created with the next version number and
is_latest_version = 1 - Previous versions remain accessible for audit and reference purposes
Versioning Flow
Original
Updated
Current
Previous versions: Read-only access
Audit Trail
All version changes preserve the complete policy record, providing a full audit trail for compliance and regulatory purposes.
Approval Workflow
Optional Approval Gate
Organizations can enable the approval workflow via the enable_policy_approval setting. When enabled:
- New policies start in Draft status with
approval_status = 'pending_approval' - Only users with
policy_createpermission can approve or reject - Approval action sets status to Active (approved) or keeps it in Draft (rejected)
- Reviewer can add comments explaining the decision
Approval States
| State | Description | Next Action |
|---|---|---|
| Pending Approval | Awaiting reviewer decision | Approve or Reject |
| Approved | Policy is active and enforceable | Proceed to acknowledgment |
| Rejected | Policy requires revision | Edit and resubmit |
Approval History
Every approval decision is logged in the policy_approval_history table with the reviewer ID, timestamp, and comments, providing a complete audit trail.
Acknowledgment Tracking
Mandatory Policy Read Receipts
Organizations can require users to acknowledge they have read and understood each policy via the enable_policy_acknowledgment setting. When enabled:
- Users must explicitly acknowledge each policy before it is considered accepted
- Unacknowledged policies are flagged for follow-up
- Provides compliance evidence that policies were communicated and understood
Compliance Evidence
Acknowledgment records serve as auditable proof that employees have read and understood organizational policies, critical for regulatory compliance (SOX, ISO 27001, etc.).
Review Scheduling
Policy Review Dates
Each policy can have a Last Review Date and Next Review Date to ensure policies remain current and relevant. The system automatically tracks:
| Status | Condition | Color |
|---|---|---|
| Current | Next review date is more than 30 days away | Green |
| Due Soon | Next review date is within 30 days | Yellow |
| Overdue | Next review date has passed | Red |
The dashboard widget prominently displays counts for overdue and soon-due policies, helping administrators prioritize review activities.
Notifications
Automated Policy Notifications
The cron/policy_notifications.php script runs on a schedule and sends automated email notifications for:
- Overdue Reviews - Policies past their next review date
- Upcoming Reviews - Policies due for review within 30 days
- Pending Approvals - Policies awaiting approval decision
Suggested Schedule
Configure the notification cron to run daily to ensure timely policy review reminders.
Module Integrations
Control Library
Policies define the control environment. Controls are tested against policy requirements, linking policy content to control effectiveness.
Audit Management
Audit findings may reference specific policies. Policy compliance can be verified during audit engagements.
Compliance Management
Policies map to regulatory frameworks. Acknowledgment tracking provides compliance evidence for regulators.
Risk Management
Policy gaps may indicate control weaknesses that translate to risk scenarios requiring mitigation.
Best Practices
Regular Review Cycles
Schedule annual policy reviews and set the next review date when creating or updating each policy.
Enable Approval Workflow
Use the approval gate for critical compliance policies to ensure appropriate oversight before publication.
Document Attachments
Upload formal policy documents as PDF attachments while using the description field to summarize key points for quick reference.
Consistent Categorization
Use the audit universe categories consistently to maintain alignment between policies, controls, and audit areas.