Policy acknowledgement: the joiner never asked

Every January, the compliance team sends the security policy to the whole company and chases signatures through February. By March, nearly everyone has accepted it.

The forty people who joined after the round went out were never asked. The auditor’s sample includes three of them.

Policy acknowledgement is the first part of compliance automation. It’s one of the simplest controls to describe, and one of the easiest to leave gaps in.

What is policy acknowledgement?

Policy acknowledgement records that each person has read and accepted the policies that apply to their role, starting from their first day. When a policy changes, everyone it applies to accepts the new version. Each acceptance is stored with its date and the version accepted.

Why acknowledgements have gaps

1. The round runs once a year. People who join after the round wait up to twelve months to be asked.
2. Role changes don’t trigger anything. Someone who moves into engineering never sees the engineering policies.
3. Changed policies go to nobody. A new version is published, and the old acceptances still count.
4. Reminders are manual. Compliance chases by email, and the chase ends when they run out of time.
5. Records live in a form tool. Acceptances sit in a spreadsheet export, with no link to the HR record.

What it costs

Each gap is an audit exception, and a sample is likely to find one. Chasing signatures takes weeks of the compliance team’s time every year. Policies that change mid-year go unread by the people they were written for.

What to fix first

1. Ask on the start date. The HR record sends the new joiner the policies for their role.
2. Ask again on a role change. A move to a new team sends that team’s policies.
3. Send a changed policy to everyone it covers. A new version starts a new round for that policy only.
4. Remind in chat. A Slack or Teams message with the policy and an accept button gets answers faster than email.
5. Store each acceptance with its version. Keep the date, the person and the version, and send them to the compliance tool as evidence.

The guide to building policy attestation tracking has the prompts for each step.

Where it fits

The same HR events that start acknowledgements also change access, covered in joiner, mover, leaver. Acceptance records are evidence, which audit evidence collection gathers with the rest.

For every part of compliance automation, from policy to audit evidence, see continuous compliance.