Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires registered persons to have "systems or processes established and operated effectively to ensure compliance" with regulatory requirements — including the secure maintenance of "accurate, complete, contemporaneous" records. In practice, that means the CQC expects to see policies that are current, approved, and evidenced as reviewed — not merely filed.

This guide covers what CQC expects to find, which policies matter most at inspection, and how small GP practices can stay on top of the review cycle without it consuming the practice manager's week.

What CQC Actually Looks for in Policy Governance

CQC inspectors work through the five key questions — Safe, Effective, Caring, Responsive, Well-led — and policies come up most consistently under Safe and Well-led. The inspector is not looking for a specific word count or template. They are looking for evidence of governance: that someone owns each policy, that it was reviewed and approved within a reasonable period, and that the approved version is what staff are actually using.

The common governance failures CQC finds at GP practices:

Out-of-date policies. A medicines management policy that still references the 2018 NICE guidance when the practice updated its prescribing protocols in 2023. The policy says one thing; practice does another.

No approval record. A policy revised by a partner, saved over the previous version, but never taken to the full partnership for approval. There is a current-looking document and no audit trail.

Version conflicts. Two copies of the safeguarding policy — one on the shared drive, one printed and in the reception folder — that differ in the referral telephone numbers. Staff are using different versions.

No review trigger for regulatory changes. The IPC guidance was updated. Nobody reviewed the IPC policy. There is no mechanism that would have prompted a review.

A policy register with review dates addresses all four. What CQC wants to see is not a perfect archive — it is a governance system that catches problems before they create risk.

The Policies That Come Up Most at CQC Inspection

CQC does not publish a single required policy list for GP practices. The relevant requirements come from Regulation 17, the CQC guidance on Regulation 17, and the specific key questions the inspection addresses. The policies that consistently come up:

Under Safe (S key question):

• Infection prevention and control policy — reviewed against the latest IPC guidance (updated regularly)
• Medicines management policy — covering prescribing, dispensing, controlled drugs
• Safeguarding children and vulnerable adults policies — must reflect current national and local guidance
• Health and safety policy
• Significant event (critical incident) policy

Under Effective (E key question):

• Clinical audit policy — how the practice reviews and acts on clinical data
• Patient records policy — accuracy, access, retention

Under Responsive (R key question):

• Complaints policy and procedure — with evidence of how complaints have been handled

Under Well-led (W key question):

• Governance framework document — who owns what, how decisions are made
• Confidentiality and data protection policy — aligned with UK GDPR
• Staff recruitment and employment policies

This is not an exhaustive list. Different inspections raise different policies depending on what the inspection finds. But these are the areas where inadequate policy governance is most likely to affect the overall rating.

The Review Cycle Problem at GP Practices

GP practices typically have thirty to fifty policies. At an annual review cycle, that is one policy review every one to two weeks on a sustained basis. Add triggered reviews — when the IPC guidance changes, when a significant event triggers a policy look, when the practice expands or restructures — and the volume is significant.

The review cycle fails in small practices for a predictable reason: it relies on the same person who manages appointments, staffing, premises, compliance, and supplier contracts to also track when forty policies need reviewing. That person is the practice manager, and their time is not unlimited.

The standard failure mode is that reviews happen in clusters — typically before an inspection — rather than continuously. The inspection then finds a cluster of policies all reviewed in the same month, which may prompt questions about whether the reviews were substantive or perfunctory.

A structured approach distributes the workload:

1. Categorise by review frequency. Infection control policies reviewed every six months when guidance changes. Clinical governance policies reviewed annually. Administrative policies reviewed every two years. The Policy Review Schedule Generator helps you map this across your full policy library.

2. Assign owners. Not all policies need to be reviewed by the practice manager. Clinical policies are reviewed by clinical leads. Safeguarding is reviewed by the designated safeguarding lead. Distributing ownership spreads the workload and puts subject-matter expertise in the review.

3. Calendar the reviews. Tie review months to the clinical year — September safeguarding reviews aligned with the new academic year, February clinical governance reviews before the annual NHS England returns, and so on.

4. Record the review, not just the date. CQC wants to see evidence of a substantive review. That means a record of who reviewed, what was checked, whether anything changed, and who approved the updated version. A date in a footer is not enough.

Our free CQC Compliance Policy Checker lists the policy areas CQC inspectors cover under each key question. It is useful both for identifying gaps and for structuring a pre-inspection self-assessment.

Common Questions From Practice Managers

How far back do CQC reviews actually go? Inspectors typically look at the most recent review date and whether the policy has been reviewed since any material changes in relevant guidance. For IPC policies, this means reviews against current national guidance. For safeguarding, alignment with the current Working Together to Safeguard Children guidance. Policies unchanged for more than three years will draw scrutiny regardless of the dates.

Do we need a policy for everything? No. Policies need to be proportionate to your operating context. A two-partner practice does not need the same governance structure as a Primary Care Network with fifteen partners. CQC assesses policies relative to the complexity and risk profile of the service.

Can we use national template policies? Yes, with adaptation. Template policies from Practice Index, the BMA, or NHS regional support organisations are a reasonable starting point. CQC expects them to be adapted to reflect your practice's actual arrangements — named staff, local referral pathways, specific premises. A generic template with no adaptation is a governance weakness.

What if a policy was reviewed but not approved at partnership level? This is common and carries risk. A policy revised by one partner but not brought to the full partnership for sign-off lacks governance authority. The revision may be clinically correct but lacks the formal accountability CQC is looking for. Bring all policy revisions to the next partnership meeting and minute the approval.

Managing Policy Governance Across a Primary Care Network or Merged Practice

PCN arrangements complicate policy governance. Multiple practices may share policies on safeguarding, IPC, or clinical audit. The governance question becomes: who owns the shared policy, who approves changes, and how do individual practices evidence that they are operating to the current version?

The answer is usually a shared register with named leads for each policy and a clear approval chain. A policy shared between three practices but owned by nobody is a governance gap waiting to surface at inspection.

PolicyBoard is designed to handle this kind of multi-site arrangement — shared policies with a clear owner, practice-specific review records, and an audit trail that holds up at inspection. Join the waitlist to be notified when it launches.

Sources

• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17
• CQC: Regulation 17 — Good Governance guidance

This guide is written for practice managers, GP partners, and PCN leads managing policy governance at small UK primary care services. It covers general principles based on published CQC guidance and regulatory requirements. It is not legal or clinical advice — always verify requirements against current CQC inspection guidance and seek professional support for specific compliance questions.

SharePoint is where this story starts. It is rarely where it ends well.

What SharePoint Actually Does for Policy Management

It is worth being precise about what SharePoint does well before getting to where it does not, because the failure mode often comes from expecting SharePoint to be something it was not built to be.

SharePoint does document storage competently:

• Version history — every time a file is saved, SharePoint creates a new version. You can retrieve earlier drafts, see who saved them, and recover from overwritten changes.
• Permissions — you can restrict who can view, edit, and manage documents. Policy documents containing personal data or commercial-in-confidence information can be controlled.
• Search — within a Microsoft 365 tenancy, SharePoint search surfaces policies from any connected device.
• Co-authoring — multiple people can edit a document simultaneously. Useful when a policy owner and their line manager are working through a revision together.
• Integration with Teams and OneDrive — policies in SharePoint are accessible directly from Teams channels, which is where many staff spend their working day.

For an organisation with fewer than twenty policies and one person who owns the management process, SharePoint does most of what is needed without any additional cost.

Where SharePoint Runs Out of Road

The limitations are not random — they follow directly from what SharePoint is: a file management system, not a policy governance system. Once you start expecting policy governance from it, the gaps become visible.

Review scheduling is entirely manual

SharePoint has no concept of a "review date." There is no field in the document library that triggers a notification when a policy is due for review. The closest you can get is:

• Add a custom metadata column called "Next Review Date"
• Configure an alert that emails you when the column value equals today's date (which requires Power Automate, custom flows, and ongoing maintenance)
• Or rely on a separate spreadsheet

Most organisations do the third. The spreadsheet works until the person who built it leaves, or it is not shared with the right people, or it gets out of sync with the actual document versions in SharePoint. At that point you have the GP surgery situation: a document library and a spreadsheet that are telling different stories.

The Policy Review Schedule Generator does this in a browser in a few minutes — but the point is that SharePoint requires you to build your own scheduling system around it.

Approval workflows require technical configuration

For a policy to be formally approved — by a governing body, trustee board, practice partners, or council — someone needs to confirm the approval and timestamp it. SharePoint has approval workflows through Power Automate, but they require:

• Knowledge of Power Automate (a separate Microsoft tool)
• Building the workflow for each policy type or routing requirement
• Maintaining the workflow when approval authorities change
• Troubleshooting when it stops working

Small regulated organisations do not have IT departments. Expecting the school business manager or the parish clerk to configure and maintain Power Automate approval flows is not realistic. In practice, approvals happen via email and the record is an email chain that nobody can find at inspection time.

Compliance dashboard does not exist

You cannot open SharePoint and see: "12 policies current, 3 due for review within 30 days, 1 overdue, 4 no review date." That view does not exist. You can create it with SharePoint lists, calculated columns, and conditional formatting — but it will take half a day to build, will break when someone renames a column, and needs someone to maintain it.

The absence of a compliance view matters most when an inspection is announced. The first thing an inspector asks — whether CQC, Ofsted, or the Charity Commission — is "show me your policy register and tell me when each policy was last reviewed." In SharePoint, answering that question accurately requires manually checking every file's metadata.

No sector-specific context

SharePoint does not know that your school needs the statutory policies maintained-schools guidance requires, or that your GP practice needs policies covering every regulation CQC will inspect against. You have to build that context yourself: categories, required policies per regulator, sector-appropriate review frequencies. A policy management system designed for regulated organisations has that built in.

Not accessible without Microsoft 365

Parish councils, small charities, and independent schools often do not use Microsoft 365. Their staff may use a mix of Google Workspace, paper-based systems, or minimal IT infrastructure. For these organisations, SharePoint is simply not an option.

When SharePoint Is the Right Answer

The cases where SharePoint is genuinely the right answer for policy management:

• Fewer than 30 policies and one person managing them
• No regulatory inspection requirement (the organisation is not CQC-registered, Ofsted-inspected, Charity Commission-regulated, or subject to external audit for governance)
• Already deep in Microsoft 365 with IT support to configure and maintain workflows
• No multi-site complexity — single location, single management layer

If all four are true, the cost of moving to a dedicated tool is hard to justify.

The Signals That Tell You SharePoint Has Run Out of Road

Most small UK regulated organisations discover SharePoint's limits at one of three moments:

The inspection prep moment. An inspection notice arrives and someone needs to produce a complete, accurate policy register with last-reviewed dates within 48 hours. Producing that from SharePoint requires manual checking of every file. The first time this happens under pressure, organisations start looking for something better.

The version conflict moment. Two people update the same policy. SharePoint creates versions, but the metadata — the review date, the owner, the approver — may not be updated consistently. An inspector asks for the current approved version and there is uncertainty about which one it is.

The team handover moment. The person who built and maintained the SharePoint structure leaves. Their successor inherits a document library with inconsistent metadata, unmaintained workflows, and a spreadsheet that is three months out of date.

If any of these situations describes your organisation's current experience, the question is not whether SharePoint is the right long-term answer — it is not — but what you are moving to.

What a Dedicated Policy Management System Does Differently

The difference is not additional features bolted onto a document management system. It is a different design intent from the ground up:

• Review dates are the core data structure, not a metadata field. The system is built around the assumption that every policy has a review cycle. Reminders fire automatically. Overdue reviews surface in a dashboard without anyone checking.
• Approval workflows are configured, not built. Different policies can route to different approvers — the governing body for statutory policies, the practice manager for clinical policies — without Power Automate.
• The compliance dashboard is the starting point. What is current, what is due, what is overdue — visible at login, not at the end of a manual audit.
• Sector context is built in. The system knows what a CQC-registered practice needs. The system knows what maintained schools guidance requires. You do not have to replicate that knowledge in a document library column.

PolicyBoard is designed for exactly this: small UK schools, GP practices, charities, and councils that have outgrown SharePoint for policy management. Automated review reminders, approval workflows, compliance dashboard, and audit trail — without requiring Microsoft 365 or IT support to configure. Join the waitlist to be notified when it launches.

SharePoint Policy Management: The Practical Summary

SharePoint works for policy management when the portfolio is small, the team is stable, and no regulator will ask for a timestamped compliance picture. It runs out of road when review scheduling needs to be reliable, when approval governance needs an audit trail, or when an inspection requires a complete compliance overview in minutes rather than hours.

The policy management beyond SharePoint guide covers the common patterns in more detail. If you are evaluating alternatives, the what to look for in policy management software guide covers the criteria that matter for small regulated organisations.

This guide is written for compliance leads, school business managers, practice managers, and council clerks at small UK regulated organisations evaluating their current policy management arrangements. It is not legal advice and is not an endorsement or criticism of any specific technology platform.

That mismatch is the whole problem. Most small UK regulated organisations do not need a compliance platform. They need to know which policies are due for review, get reminded before the deadline, and prove at inspection that every policy is current. This guide covers what policy tracking software actually has to do for a small organisation, the features worth paying for, and the ones marketed at you that you can safely ignore.

What "Policy Tracking" Means (and Why It's Different from Document Storage)

Policy tracking is keeping a live picture of your policies' review status: what exists, when each was last reviewed, when each is next due, who owns it, and which ones are overdue right now. That is a different job from storing the documents.

A shared drive or document library stores files. It does not track them. Nothing on a SharePoint folder tells you that the safeguarding policy is six weeks overdue for review, reminds the owner before the deadline, or produces an at-a-glance view of which policies are current. Storage answers "where is the file?" Tracking answers "is this policy current, and who needs to act?"

That distinction matters because the failure that surfaces at inspection is almost never "we lost the file." It is "the file exists but it is out of date and nobody noticed." Tracking software exists to catch the second one. (For the wider question of why document control matters in the first place, see our guide on why document control matters in regulated UK organisations.)

The Features That Actually Matter for a Small Organisation

When you strip away the enterprise marketing, a small regulated organisation needs five things from policy tracking software:

1. A policy register you can see at a glance. Every policy in one list with its owner, last-reviewed date, review cycle, and next-review date. If you cannot get the whole picture on one screen, the tool is working against you. Building one from scratch is straightforward — our step-by-step guide to building a policy register walks through the structure — but a tracking tool should give you this as the home screen.
2. Automated review reminders. Reminders that fire well before a deadline — not on the day it is already overdue — to the named policy owner, with escalation if the date passes. This is the single feature that prevents the expired-policy-at-inspection scenario.
3. A traffic-light status view. Green for current, amber for due soon, red for overdue. A compliance dashboard you can show an inspector or a board in ten seconds beats a spreadsheet you have to interpret.
4. An audit trail. A record of when each policy was reviewed, what changed, and who approved it. When an inspector asks for evidence of review, the audit trail is the answer — a date in a document footer is not.
5. Export for inspection or audit prep. The ability to produce a clean register or compliance report when you need to hand evidence to CQC, Ofsted, an auditor, or a board.

If a tool does those five well, it solves the actual problem. Everything beyond that is a question of whether the extra features earn their cost.

The Features You Can Probably Skip

Enterprise policy and compliance platforms bundle a lot that a small organisation will never use — and you pay for all of it. Be honest about whether you need:

• Staff attestation at scale. Tracking that every one of 5,000 employees has read and acknowledged each policy is genuinely useful at enterprise scale. For a 60-person practice or a single school, it is often more process than the risk warrants.
• Multi-framework control mapping. Platforms that map policies to dozens of compliance frameworks simultaneously are built for organisations juggling many overlapping regimes. A single-sector UK organisation usually answers to one main framework.
• Workflow automation engines. Configurable approval workflows with conditional routing are powerful and complex. A small organisation's approval route is usually short enough to handle with a simple sign-off step.
• Integrations you have no system to integrate with. Connectors to enterprise HR, GRC, and identity platforms add to the price and the setup. If you do not run those systems, the integrations are dead weight.

None of these features is bad. They are simply priced and designed for organisations far larger than the typical small UK regulated body — and paying for them is how small organisations end up with software that costs more than the problem it solves.

How to Tell Enterprise Tools from Small-Organisation Tools

The clearest signals that a tool is built for someone bigger than you:

• Pricing is "contact us" rather than published. Hidden pricing usually means enterprise-tier, sales-led, and negotiated — a sign you are not the target customer.
• Onboarding requires an implementation project. If you need a consultant to get started, the tool assumes a scale and complexity you may not have.
• The free tier is a 14-day trial, not a usable free plan. Tools built for small organisations often let you start free at a sensible limit and pay only when you outgrow it.
• The feature list leads with governance, risk, and compliance breadth rather than the basics — register, reminders, dashboard. Breadth-first marketing targets buyers managing many regimes; small organisations are better served by depth on the basics.

You are looking for a tool whose default configuration matches a small organisation out of the box — not one you have to scale down.

A Quick Way to Decide

Before you book a single demo, write down three things:

1. How many policies do you actually track? Twenty? Forty? Eighty? The number tells you whether you need a tool at all or whether a well-maintained register plus a review schedule is enough for now.
2. What is the one failure you are trying to prevent? For most small regulated organisations it is "an expired policy is found at inspection." A tool that prevents that specific failure — through reminders and a status dashboard — is worth more than one with a hundred features that do not.
3. What can you realistically maintain? A tool only works if someone keeps it current. Match the complexity to the time you have. For a fuller decision framework, our guide on what to look for in policy management software covers the evaluation criteria in depth.

Pick the simplest tool that prevents your one failure and that you can keep up to date. Anything more is paying for someone else's scale.

Frequently Asked Questions

What is policy tracking software?

Policy tracking software keeps a live record of your organisation's policies and their review status — what exists, when each was last reviewed, when each is next due, who owns it, and which are overdue. It typically adds automated review reminders, a traffic-light status dashboard, and an audit trail, so you can prove every policy is current.

How is policy tracking different from storing policies on a shared drive?

A shared drive stores the files; it does not track them. It cannot tell you a policy is overdue for review, remind the owner before the deadline, or show an at-a-glance view of which policies are current. Tracking software adds the review-status layer on top of storage.

Do small organisations need policy tracking software?

Not always. If you have a handful of policies, a well-maintained register and a review schedule may be enough. The case for software grows with the number of policies, the number of owners, and the cost of an expired policy being found at inspection. The trigger is usually when a spreadsheet stops being reliable.

What should I look for in policy tracking software as a small UK organisation?

Five things: a policy register you can see at a glance, automated review reminders before deadlines, a traffic-light status dashboard, an audit trail of reviews and approvals, and export for inspection or audit prep. Features built for enterprise scale — attestation across thousands of staff, multi-framework mapping, complex workflow engines — are usually more than a small organisation needs.

Sources

• CQC: Regulation 17 — Good governance
• DfE: Maintained Schools Governance Guide

This guide is designed for UK practice managers, compliance leads, school business managers, and governance officers evaluating how to keep their policies current. It is general guidance, not a product endorsement or legal advice — assess any tool against your own sector's requirements and your organisation's governance framework.

A policy review template fixes that. It turns "we looked at it" into a documented, repeatable process: what the reviewer checked, what changed, who approved it, and when the next review is due. This guide gives you a reusable framework you can apply to any policy, in any sector — schools, GP practices, housing associations, councils, or charities — plus the specific things each review must confirm and the review cycles UK regulators expect.

What a Policy Review Template Actually Needs to Capture

A useful policy review template is not a form you fill in once. It is a record that proves the review happened and shows what it found. At a minimum it should capture:

• Policy name and reference — the exact title and any internal reference number, so the review maps to a specific document in your register.
• Version reviewed — which version you checked, so the audit trail links the review to the actual text.
• Review date and reviewer — who did the review and when.
• Statutory or regulatory basis — the legislation, regulation, or guidance the policy exists to satisfy (e.g. a CQC regulation, an Education Act section, a Health and Safety requirement).
• What was checked — a short checklist confirming the policy is still accurate, legally current, and reflects actual practice.
• Changes made — what was amended, or an explicit "no changes required" with a reason.
• Approval — who approved the reviewed version and at what governance level (board, governing body, committee, or manager).
• Next review date — driven by the policy's review cycle, not a guess.

The difference between a real review and a footer date is the middle three rows: what was checked, what changed, and who approved it. Those are the rows an inspector or auditor reads.

The Three Questions Every Policy Review Must Answer

Most policy reviews fail not because the reviewer is careless but because "review this policy" is too vague. Break it into three concrete questions:

1. Is it still legally accurate?

Has the underlying law, regulation, or guidance changed since the last review? This is where most policies decay silently. Legislation gets amended, guidance gets reissued, and regulators update their frameworks — but the policy sits unchanged because nobody mapped it to its source.

A worked example of how fast this moves: in March 2024 the DfE withdrew its standalone "Statutory Policies for Schools and Academy Trusts" publication and folded its content into the governance guides. A school whose policy review process pointed only at the old publication would have been checking against withdrawn guidance. Mapping each policy to its current source — and re-checking that source at review time — is the single most valuable habit a review process can build in.

2. Does it match what you actually do?

Inspectors weight policy-to-practice alignment heavily. A policy that describes a process nobody follows is worse than no policy, because it documents a gap. The review must confirm the written policy reflects current practice — and where practice has drifted, decide whether to fix the practice or update the policy.

3. Is it owned, dated, and findable?

Who owns the policy? When was it last approved, and by whom? Can a member of staff find the current version in under a minute? A policy that exists but cannot be located is functionally missing at the moment it matters.

A Reusable Policy Review Checklist

Use this as the body of your review template. Run every policy through it:

1. Confirm the source. Identify the legislation, regulation, or guidance the policy satisfies. Check whether that source has changed since the last review.
2. Check currency. Are all dates, named roles, contact details, and references still correct? Are any cited documents withdrawn or superseded?
3. Check accuracy against practice. Does the policy describe what your organisation actually does? Interview the process owner if you are unsure.
4. Check scope and completeness. Does it still cover everyone and everything it should? Have new activities, sites, or staff groups appeared that it does not address?
5. Check readability. Can the people who must follow it understand it? A policy nobody reads is not a control.
6. Record the outcome. Note changes made (or "no changes required"), the version number, and the reviewer.
7. Route for approval. Send to the correct governance layer. Record who approved it and when.
8. Set the next review date. Based on the policy's review cycle, not the calendar default.

A 40-policy register run through this checklist annually is a working compliance system. Run through it once and forgotten is theatre.

How Often to Review: What UK Regulators Expect

Review frequency is not one-size-fits-all. It depends on the sector and the specific policy. The most common cycles across UK regulated organisations:

• Health and social care (CQC-regulated). CQC Regulation 17 (Good Governance) requires providers to "assess, monitor and improve the quality and safety of the services" and to "maintain securely an accurate, complete and contemporaneous record" of their governance. Outdated policies are routinely cited in inspection reports as evidence of a governance failing, so most providers review core policies at least annually and immediately when guidance changes.
• Schools (Ofsted / DfE). The DfE governance guides recommend that governing bodies review statutory policies annually, with one notable exception: governing bodies "must also: agree on one or more equality objectives every 4 years, which must then be published." Safeguarding policies aligned to Keeping Children Safe in Education need annual review at minimum, and immediate review whenever KCSIE is reissued.
• Charities. There is no fixed statutory review cycle for most charity policies, but regular review is widely treated as good governance. Time policy reviews to the trustee meeting cycle so changes are formally approved and minuted.
• Housing associations and councils. Review cycles are usually set by the organisation's own governance framework and the relevant regulatory standards rather than a single statutory cadence — annual review of core compliance policies is the common baseline.

The practical rule that holds across every sector: a regulatory change is an immediate review trigger, not a "wait for the annual cycle" event. For a fuller multi-regulator breakdown of review frequencies, see our guide on how often UK policies should be reviewed.

Turning the Template Into a Schedule

A review template tells you how to review one policy. The harder problem is keeping forty review dates from slipping. A register with mixed review cycles produces dozens of due dates a year, and they do not arrive conveniently spaced.

Two things make this manageable:

1. A single register that lists every policy, its source, owner, last-reviewed date, review cycle, and next-review date in one place. If you do not have one yet, our plain-English guide to policy management explains how the register sits at the centre of the whole process.
2. A schedule built from the register, with reminders that fire well before each deadline — not on the day it is already overdue. The free Policy Review Schedule Generator takes your policies and last-reviewed dates and produces a colour-coded review schedule you can export to a calendar, so the next-review dates from your template stop living only in a spreadsheet nobody opens.

The template is the quality control for each review. The schedule is what makes sure the reviews actually happen. You need both. For context on where the review stage fits across the full policy journey — from drafting through approval, distribution, and eventual retirement — see the policy lifecycle management guide.

Frequently Asked Questions

What should a policy review include?

A policy review should confirm the policy is still legally accurate, matches actual practice, covers everyone and everything it should, and is owned and findable. It should record what was checked, what changed (or that no changes were needed), who approved the reviewed version, and when the next review is due.

How do you review a policy?

Map the policy to its legal or regulatory source and check whether that source has changed. Confirm the policy still reflects what your organisation actually does. Check dates, named roles, and references are current. Record the outcome, route it to the right governance layer for approval, and set the next review date based on the policy's review cycle.

How often should policies be reviewed?

It depends on the sector and the policy. Many UK regulated organisations review core compliance policies at least annually. Schools review statutory policies annually (equality objectives every four years). Any regulatory or legislative change should trigger an immediate review regardless of the scheduled cycle.

What is the difference between a policy review and a policy rewrite?

A review checks whether a policy is still fit for purpose and records the outcome — it may conclude that no changes are needed. A rewrite is what you do when the review finds the policy is out of date, inaccurate, or no longer matches practice. Most reviews should result in either confirmation or targeted amendments, not a full rewrite.

Who should approve a reviewed policy?

It depends on the policy and your governance structure. Safeguarding, finance, and major compliance policies typically need board, trustee, or governing-body approval. Operational policies can often be approved at committee or management level. Record the approver and the approval date in the review template so the audit trail is complete.

Sources

• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17
• DfE: Maintained Schools Governance Guide
• DfE: Keeping Children Safe in Education
• Charity Governance Code

This guide is designed for UK compliance leads, governance officers, school business managers, and practice managers who need a repeatable way to review their policies. It is general guidance based on published regulations and DfE guidance — verify against the current rules for your sector and your own governance framework before relying on any review cycle. It is not legal advice.

That question — which policies must a school have, by law — sounds simple. The honest answer is that there is no single clean list. Statutory policy requirements come from different pieces of education legislation, different bits of DfE guidance, the Equality Act, data protection law, and Ofsted publishing rules. The combined list is real but it lives across half a dozen sources.

This guide pulls those sources together for school business managers, MAT clerks, governors, and anyone whose job description quietly includes "make sure the policies are right." It covers what counts as statutory, the policies that must exist, the ones that must be on the school website, and the practical question most lists skip — how to keep forty-plus policies current without it eating a working week every term.

What "Statutory" Actually Means

A policy is statutory when a piece of legislation, statutory regulation, or DfE guidance under statutory powers requires the school to have it. Three categories of source create the requirement:

1. Primary legislation — Acts of Parliament that name the policy or require the school to have one (e.g. the Education Act 2002, Equality Act 2010, Data Protection Act 2018).
2. Statutory regulations — secondary legislation under those Acts that adds detail.
3. Statutory DfE guidance — guidance issued under statutory powers that schools "must have regard to." Schools can deviate only with good reason and a documented rationale.

Non-statutory policies are policies the school chooses to have because they are useful or expected — anti-bullying frameworks, mobile-phone policies, uniform policies — but where no specific law mandates them. Many schools treat non-statutory policies as functionally mandatory anyway, because Ofsted inspectors expect to see them and because they are good practice.

This guide focuses on the statutory list. The DfE's standalone "Statutory Policies for Schools and Academy Trusts" publication was withdrawn on 7 March 2024 — its content now sits inside the governance guides. For the current canonical view, cross-reference the Maintained Schools Governance Guide and the Academy Trust Governance Guide, which set out the statutory-policy expectations and review cycles this guide draws on throughout.

Different School Types, Different Lists

Statutory policy requirements are not identical across school types. The differences matter:

• Maintained schools — the local authority is the employer; statutory requirements come through the Local Government Act, Education Act, and DfE guidance for maintained schools.
• Academies and academy trusts — the trust is the employer; the Academies Act 2010 and the Academy Trust Handbook overlay additional requirements (financial regulations, scheme of delegation, conflict-of-interest declarations).
• Free schools and special schools — additional sector-specific requirements depending on the school's funding agreement and pupil cohort.
• Independent schools — different framework entirely; Independent School Standards Regulations 2014 set the requirements rather than the maintained-schools rules.

This guide focuses on maintained schools and academies, which together cover most state-funded education in England. If you run an independent school, the policy list looks similar but the underlying authority is different — start with the Independent School Standards Regulations, not the DfE governance guides.

The Core Statutory Policies (England, 2026)

The list below is grouped by theme. Each entry names the policy, the source of the requirement, and a one-line note on what it has to cover. Cross-check every entry against the current DfE governance guides — categories occasionally shift, and academy trusts may have additional requirements via the Academy Trust Handbook.

Safeguarding and Child Protection

• Child protection policy — required under Keeping Children Safe in Education (KCSIE). Must be reviewed annually, approved by the governing body, and published on the school website.
• Behaviour policy — required under the Education and Inspections Act 2006 and Education Act 2011. Must cover sanctions, rewards, and a written statement of behaviour principles set by governors.
• Anti-bullying — most schools embed within or alongside the behaviour policy. Section 89 of the Education and Inspections Act 2006 requires "measures to prevent all forms of bullying."
• Online safety policy — required by KCSIE alongside the child protection policy; covers filtering, monitoring, and acceptable-use rules.

Equality and Inclusion

• Equality information and objectives — required by the Equality Act 2010 (specifically the Public Sector Equality Duty). Schools must publish equality information annually and review objectives at least every four years.
• Special Educational Needs and Disability (SEND) policy and information report — required under the Children and Families Act 2014 and SEND Regulations 2014. Must be published on the website and reviewed annually.
• Accessibility plan — required under the Equality Act 2010, Schedule 10. Must show how the school will improve access to the curriculum, the physical environment, and information for disabled pupils. Reviewed at least every three years.
• Supporting pupils with medical conditions — required under Section 100 of the Children and Families Act 2014.

Curriculum and Assessment

• Curriculum policy — required for maintained schools under the Education Act 2002; expected for academies via funding agreement.
• Relationships, Sex and Health Education (RSHE) policy — required under the Children and Social Work Act 2017 and the RSHE Regulations 2019. Must be published on the school website and consulted on with parents.
• Collective worship — maintained schools must provide a daily act of collective worship under the School Standards and Framework Act 1998. Most schools embed in the curriculum policy.
• Charging and remissions policy — required by Section 457 of the Education Act 1996.
• Provider access policy (Baker Clause) — required under Section 42B of the Education Act 1997 (as amended); maintained schools and academies must publish how they enable providers of technical education and apprenticeships to access pupils in years 8 to 13.

Data Protection, Records, and Records Management

• Data protection policy — required under the UK GDPR and Data Protection Act 2018. Schools are data controllers and must have a written policy.
• Information security / records retention — schools must have records-management arrangements that satisfy data protection law. Many schools document this as a separate policy or schedule.
• Freedom of Information publication scheme — required for maintained schools (which are public authorities under the Freedom of Information Act 2000). Academies are also public authorities under FOIA.
• CCTV / surveillance policy — required if the school operates CCTV, under the Data Protection Act 2018 and the Protection of Freedoms Act 2012 surveillance camera code.

Health, Safety, and Premises

• Health and safety policy — required under the Health and Safety at Work etc. Act 1974 (for any employer with five or more employees).
• First aid policy — required under the Health and Safety (First-Aid) Regulations 1981 and the DfE first-aid guidance for schools.
• Fire safety arrangements — required under the Regulatory Reform (Fire Safety) Order 2005. Most schools document this as a fire safety policy plus the fire risk assessment.
• Educational visits / off-site activity policy — expected by DfE guidance and HSE publications on off-site visits; treated as functionally statutory by most schools and trusts.

Staffing and Employment

• Pay policy — required for maintained schools under the School Teachers' Pay and Conditions Document. Academies typically have an equivalent under their funding agreement.
• Capability and disciplinary procedures — required for maintained schools under the Education (School Teachers' Appraisal) Regulations 2012.
• Whistleblowing policy — required by the Public Interest Disclosure Act 1998. Academies must include whistleblowing arrangements under the Academy Trust Handbook.
• Code of conduct for staff — expected via KCSIE and DfE guidance; most trusts treat as mandatory.

Complaints and Governance

• Complaints procedure — required for maintained schools under Section 29 of the Education Act 2002, and for academies under their funding agreement and the Education (Independent School Standards) Regulations 2014.
• Governors' allowances policy — maintained schools must publish allowances arrangements; academies do so through the trust scheme of delegation.
• Scheme of delegation — required for academy trusts under the Academy Trust Handbook. Sets out who decides what across the trust, the local governing body, and individual schools.
• Conflict of interest policy — required for academy trusts under the Academy Trust Handbook.

That list is not exhaustive — it covers the statutory items that affect almost every school. Specialist provision (alternative provision, special schools, sixth-form colleges) adds further requirements; international links and boarding schools add more.

Policies That Must Be on the School Website

Statutory policy requirements are one thing; statutory website-publishing requirements are a separate, narrower list. The DfE's guidance for maintained schools and guidance for academies, free schools and colleges are the canonical sources.

The policies and information that must appear on the school website typically include:

• Admissions arrangements
• Behaviour policy
• Charging and remissions policy
• Complaints procedure
• Curriculum information
• Equality information and objectives
• SEND information report (and SEND policy)
• Pupil premium strategy and use-of-funds report
• PE and sport premium funding statement (primary)
• Year 7 catch-up funding (where applicable)
• RSHE policy
• Safeguarding/child protection policy
• Supporting pupils with medical conditions policy
• Accessibility plan
• Provider access policy

There are also required information items that are not policies but must be published — last Ofsted report, exam and assessment results, governors' details, and so on. The DfE guidance covers the full list. Treat the website list as a hard checklist: missing items create direct compliance gaps that Ofsted, the ESFA (for academies), and the DfE flag specifically.

Statutory Policies for Multi-Academy Trusts

Multi-academy trusts (MATs) layer additional requirements on top of the school-level list. The Academy Trust Handbook (annual edition published by the DfE / ESFA) sets out trust-level statutory requirements:

• Master funding agreement and supplemental funding agreements — the legal contracts under which each academy operates.
• Articles of association — the trust's governing document, agreed with Companies House and the DfE.
• Scheme of delegation — describing decision-making authority across trustees, the executive team, and local governing bodies.
• Reserves and investment policies — required by the Academy Trust Handbook.
• Conflict of interest register — required by the Academy Trust Handbook for trustees, members, and senior leaders.
• Whistleblowing arrangements — required across the trust, with route to trustees.
• Anti-fraud and anti-bribery policy — expected under the Academy Trust Handbook.

In a MAT, the question of which policies live at the trust level (single policy applied across all schools) and which live at school level (each school adapts to local context) is a governance design choice. Most trusts standardise safeguarding, finance, and HR at the trust level and let each school adapt curriculum, behaviour, and SEND policies to local need.

For a practical view of what trust-level governance looks like in practice, the DfE's Academy Trust Governance Guide sets out the principles and the roles. For the maintained-schools equivalent, see the Maintained Schools Governance Guide.

Review Frequencies: How Often to Update Each Policy

Statutory review frequency varies by policy. The most common cycles:

• Annually: child protection, KCSIE-aligned policies (online safety, behaviour, anti-bullying), SEND policy, complaints procedure, health and safety.
• Every two years: RSHE policy (review and consultation cadence is typically biennial).
• Every three years: accessibility plan, equality objectives review.
• Every four years: equality objectives are required to be reviewed at least every four years (Public Sector Equality Duty).
• As needed (event-driven): any policy where legislation, KCSIE, the Academy Trust Handbook, or local safeguarding partnership procedures change. Treat regulatory changes as immediate review triggers, not as a "wait until the annual cycle" event.

The full review-cadence picture is more nuanced — different funding agreements, Local Authority requirements, and trust-level rules can shift the dates. For a multi-regulator view of how cadence varies across CQC, Ofsted, the Charity Commission and councils, see our guide on how often UK policies should be reviewed.

What Goes Wrong (And What Inspectors Find)

Three patterns recur across schools that fail their first Ofsted policy check:

1. Out-of-date child protection policy. KCSIE is updated annually, usually published in the summer term to take effect from 1 September. A child protection policy still referencing the previous year's KCSIE version on inspection day is a flag.
2. Missing website items. Ofsted, ESFA, and the DfE all routinely check the published website list. Missing items (commonly: SEND information report, pupil premium strategy, provider access policy, accessibility plan) trigger immediate follow-up.
3. Policy and practice mismatch. The policy says one thing; staff describe a different practice. Inspectors look for alignment between the documented policy, what staff describe, and the evidence (training records, incident logs).

The first and second are operational. The third is a governance question — and it is the one inspectors weight most heavily. A current, well-aligned policy library is not just compliance; it is evidence of leadership.

A Practical Workflow for Managing the List

Forty-plus policies across multiple cycles, multiple owners, and multiple regulatory updates is not a job for a spreadsheet kept by one person. The practical workflow at school or trust level:

1. Build a policy register. Every statutory policy in one list with policy name, statutory source, owner, last reviewed, review frequency, next review date, and link to the live document. Our step-by-step guide to building a policy register covers the methodology, and the free Policy Register Template provides a starting structure.
2. Set automated reminders. A register without reminders becomes a static list. Reminders need to fire at 90, 60, and 30 days before review date, to the named policy owner, with escalation if the deadline passes.
3. Map to statutory sources. Every policy in the register should link to its source of authority — KCSIE section, Education Act section, Academy Trust Handbook clause, ICO guidance. When the source updates, you can immediately see which policies are affected.
4. Use the Ofsted statutory checklist. Our Ofsted Statutory Policies Checklist walks through the policies inspectors expect to find at a maintained school or academy, with the legislation behind each one. Run it annually as a gap check.
5. Calculate the review schedule. A 40-policy register with mixed cycles produces 40+ review dates per year. The free Policy Review Schedule Generator builds the schedule from your register and exports to your calendar so review deadlines don't get missed.
6. Review at the right governance layer. Some policies (child protection, finance, scheme of delegation) require trust-board or governing-body approval. Others can be approved by a committee or executive. Map the approval route in the register so the right people are signing off.

This is the work that turns a folder of forty-six documents into a working compliance system. Done well, it is invisible. Done poorly, it is the recurring fire your school business manager fights every term.

Frequently Asked Questions

What is a statutory policy in a school?

A statutory policy is one that legislation, statutory regulations, or DfE statutory guidance requires the school to have. The requirement may come from primary legislation (e.g. the Education Act 2002), secondary regulations, or guidance the school "must have regard to" (e.g. KCSIE).

How many statutory policies does a school need?

There is no fixed number. The DfE governance guides set out the statutory policies that apply to most schools — broadly in the region of 25-30 categories — but the precise number depends on the school type (maintained, academy, free school, special, sixth-form), pupil cohort, and the trust-level rules for academies.

Which policies must be on the school website?

The DfE guidance on what schools must publish online lists the policies and information that must appear on the website. The full list varies by school type — academies and maintained schools have slightly different requirements — but commonly includes the behaviour policy, SEND policy and information report, complaints procedure, RSHE policy, accessibility plan, equality information, and child protection policy.

What is the difference between statutory and non-statutory school policies?

Statutory policies are required by law or statutory guidance. Non-statutory policies are policies the school chooses to have because they are useful, expected, or good practice — but no specific law mandates them. Many non-statutory policies (anti-bullying frameworks, uniform, mobile-phone, lettings) are treated as functionally mandatory because Ofsted expects to see them.

How often should statutory school policies be reviewed?

Most statutory policies require annual review. KCSIE-aligned policies (child protection, online safety, behaviour) need annual review at minimum, and immediate review whenever KCSIE is updated. Some policies have longer cycles — accessibility plans run on a three-year cycle, equality objectives on a four-year cycle. Trigger-based reviews override the schedule when legislation or guidance changes.

Who approves statutory school policies?

Approval routes vary by policy and school type. Safeguarding, finance, and major operational policies typically require governing-body or trust-board approval. Curriculum and operational policies can often be approved at headteacher or executive level depending on the scheme of delegation. Academy trusts must follow the approval routes set out in their scheme of delegation.

Sources

• DfE: Keeping Children Safe in Education
• DfE: What Maintained Schools Must Publish Online
• DfE: What Academies, Free Schools and Colleges Should Publish Online
• DfE: Maintained Schools Governance Guide
• DfE: Academy Trust Governance Guide

This guide is designed for UK school business managers, MAT clerks, governors, and trustees who need a practical view of statutory policy requirements. It is not legal advice. Statutory requirements change — verify against current DfE guidance and your funding agreement before treating any policy list as exhaustive.

That is the absence of document controlling — and it is the daily working reality of most small UK regulated organisations. The phrase "document controlling" sounds technical, ISO-flavoured, and somebody else's problem. In practice, for any organisation that has to evidence governance to a regulator or auditor, it is the difference between a controlled record and a guess.

This guide covers document controlling as a working compliance practice — what it means, why it matters in UK regulated organisations, and how to do it without an ISO 9001 certification programme. It is written for the people who actually have to do the work: school business managers, practice managers, council clerks, charity governance leads, and anyone whose job description includes "make sure the policies and procedures are current".

What "Document Controlling" Actually Means

The term comes from quality management — specifically ISO 9001, which sets out documented information requirements as part of a quality management system. In that context, document controlling is a formal process: every controlled document has a unique identifier, an owner, an approval record, a review cycle, and a controlled distribution list.

Outside ISO certification, document controlling means the same five things in plain language:

1. You can find the current version. Not three versions, not last year's version, not "the one in Sarah's email" — the current version, in a known place, in under a minute.
2. You know who owns it. A named person responsible for keeping the document accurate. Not a generic "shared drive owner" or a job role no one currently holds.
3. You know who approved it. A documented approval — name, date, and ideally what they approved (a version, a change). Without this, the document has no governance authority.
4. You know when it was last reviewed and when it is next due. Not a date in the footer that no one checks. A live review schedule that surfaces what is due, what is overdue, and what is current.
5. You can see what changed. A version history showing what was different in the previous version. This is the audit trail an inspector or auditor will ask about.

If your organisation cannot answer all five for any given policy, procedure, or governance document, it is not under document control. It is under document storage — which is a different thing.

Document Controlling vs Document Storage

The distinction is not academic. It is the difference between two organisations sitting through the same inspection:

Organisation A has a SharePoint site with 200 files in a folder hierarchy. Files are named informally. Some have approval dates in the footer; most do not. The practice manager knows where most of them are. When the inspector asks for the current safeguarding policy, the manager opens four files before finding the one that looks most current.

Organisation B has the same 200 documents in a register. Each shows owner, status, last review date, next review date, and a clear "current version" marker. When the inspector asks for the safeguarding policy, the manager opens the register, exports the current document, and shows the audit trail of approvals.

Both organisations have the same documents. Only one is under document control. The first is taking notes during the inspection; the second is answering questions.

Why It Matters in UK Regulated Organisations

Every UK regulator that conducts inspections or audits expects evidence that documents are controlled — even when they do not use the phrase. Specifically:

CQC (GP practices, dental practices, primary care)

Regulation 17 requires records to be "accurate, complete and contemporaneous" and that systems "assess, monitor and improve" service quality. In practice, inspectors check whether policies are dated, approved, reviewed within stated timeframes, and known to the staff who follow them. An undated or unsigned policy fails Regulation 17 even if its content is good.

For CQC-specific policy expectations, the CQC policy requirements guide covers the categories inspectors expect to find at a GP practice.

Ofsted (schools, MATs, early years)

The DfE's Keeping Children Safe in Education is updated regularly. Schools must show their safeguarding policy reflects the current version of the guidance — and that staff have been notified of changes. An out-of-date safeguarding policy contributes directly to a "safeguarding is not effective" judgement, one of the most serious findings a school can receive. Document controlling is what makes "current and notified" auditable.

Charity Commission

Trustees are accountable for ensuring the charity is well-run. Outdated policies are evidence of poor governance. The Commission's annual return asks whether the charity has reviewed its governing document — a "no" answer invites scrutiny. For charities working with children or adults at risk, safeguarding documentation is checked against the documented review cycle.

ICO (data protection — all sectors)

The UK GDPR's accountability principle requires organisations to demonstrate compliance — not just be compliant. The ICO accountability and governance guidance sets out the documentation expected: data protection policy, records-of-processing register, breach response procedure, subject access request procedure. After a breach, the ICO will ask for evidence the documents were current at the time of the incident. Document controlling provides that evidence.

Internal and external audit

For councils, NHS organisations, and audited bodies, internal auditors check governance documents are reviewed within stated timeframes. External auditors will note governance weaknesses where document review schedules have slipped. Persistent issues can lead to a qualified audit opinion.

The common thread: every regulator checks both the content and the control. A well-written policy that is not under document control is evidence the system is not working.

What Document Controlling Looks Like Day-to-Day

Theory is one thing. The day-to-day practice of document controlling at a small UK regulated organisation looks like this:

A central register

One list of every controlled document — policies, procedures, SOPs, protocols, terms of reference, code of conduct, scheme of delegation. Each entry shows:

• Document name and category
• Document type (policy, procedure, register, etc.)
• Owner (named person)
• Last review date
• Next review date
• Approval status (approved, draft, under review)
• Current version
• Where the actual document lives

If you are starting from scratch, our free Policy Register Template is a working example of the columns this register needs. The same structure works for procedures with one extra column for "parent policy".

A review schedule

Different document types have different review cadences. A safeguarding policy is reviewed annually (more often when guidance changes). A medication-administration procedure is reviewed annually or when the prescribing system changes. A schedule of delegation is reviewed when governance arrangements change.

The schedule should surface what is due in the next 30, 60, and 90 days — not require someone to manually scan the register each month. Our free Policy Review Schedule Generator builds this calendar from a list of policies.

For regulator-specific cadences, the policy review frequency guide covers what each regulator expects across CQC, Ofsted, the Charity Commission, and audit cycles.

An approval record

Every controlled document needs an approval record showing who approved which version, when. The approval record sits alongside the document, not inside it — so updating the record does not require reopening the document.

For policies, the approval body is typically formal (governing body, trustees, partners, full council). For procedures, the approval body is often just a line manager or department head. The approval workflow should match the document type.

A version history

Previous versions preserved (not overwritten) and accessible. Each version dated and labelled. When an auditor asks "was this policy current at the time of the incident on 14 March?", you can show the version that was in force on that date.

Distribution and acknowledgement

For critical documents (safeguarding, data protection, health and safety, infection control, medicines management), staff need to know about updates. At small scale, distribution is usually by email with an acknowledgement reply. Larger organisations may use formal attestation. The principle is the same: there is evidence staff know about the current version.

An audit trail

Every change recorded — who edited what, when, and what the change was. This is the difference between document storage (which most organisations already have) and document controlling (which most do not).

Common Document Controlling Failures

The same patterns appear in inspection reports and audit findings across sectors:

Policies in document footers, not in a register. The "next review" date is in the footer of the Word document. To find what is overdue, someone has to open every file. So no one does, and policies drift past their review dates without anyone noticing.

Multiple versions of the same document. "Safeguarding Policy v3", "Safeguarding Policy v3 AMENDED", "Safeguarding Policy v3 FINAL", "Safeguarding Policy 2024". No clear current version. Staff working from different files.

No approval record. The policy exists. There is no record of who approved it or when. Governing body minutes do not reference the policy review. From a governance perspective, the document is not controlled — it is just a file.

Owners who left the organisation. The policy register lists owners who left 18 months ago. Reviews are not happening because the named owner is no longer there to do them.

Updated procedures, unchanged policies. Operational procedures get updated when systems change. The underlying policy still references the old procedure. Inspectors find the mismatch.

Filing-cabinet documents. Still common in small GP practices, parish councils, and charity offices. Printed, signed, filed. No search, no version control, no reminders. When asked for a specific document, someone rummages through a cabinet.

All of these are document controlling failures. None of them are about the content of the documents — every example assumes the policies and procedures themselves are well-written. The failure is in the controlling.

Document Controlling Without ISO Certification

Most small UK regulated organisations do not hold ISO 9001 and do not need to. The full ISO documented-information apparatus — controlled distribution lists, formal change management procedures, mandatory training records — is overkill for a 30-person council or a five-trustee charity.

What they need is the practical principles of document control, applied at the right scale:

• A central register, not a quality manual. One spreadsheet or one tool, not a stack of binders.
• Lightweight version control, not formal change management. Previous versions accessible, dated, labelled. Not a 12-step change process for every typo correction.
• Practical approval workflows, not committee structures. Policies route to the approving body that already exists (trustees, governors, partners). Procedures route to the line manager who already approves operational changes.
• Reasonable review cadences, not annual full audits. Annual minimum for policies, more frequent for procedures and operationally critical documents. Triggered reviews when systems or staff change.
• Inspection-ready, not certification-ready. The output is evidence for inspectors and auditors — not a recertification audit by a third party.

For organisations that want a deeper read on the document-control framework that applies in regulated UK contexts (rather than ISO/manufacturing contexts), the control of documentation guide covers the regulator-by-regulator picture.

A Practical Checklist for Compliance Officers

If you are responsible for documents in a small UK regulated organisation and want to know whether you are under document control, work through these:

1. Can I list every controlled document in under five minutes? If the list is in someone's head or scattered across folders, it is not a register.
2. For each document, do I know the current version, owner, last review date, and next review date? Without all four, you have document storage, not document control.
3. Can I produce evidence of approval for every policy and procedure? Name, date, version. Not "we discussed it at trustees in March 2023."
4. Do I know what is due for review in the next 90 days? If the answer is "I would need to check each file", the schedule is not working.
5. Can I show what changed between the current version and the previous version of any document? Version history matters when an inspector asks about the policy at the time of an incident.
6. Do staff know about updates to critical documents? Distribution and acknowledgement, not just "it is on the shared drive."
7. Could I evidence document control to an external auditor without preparation? If an auditor walking in tomorrow would catch you scrambling, the system is not yet working.

If you cannot answer "yes" to all seven, the gap is not in your policies — it is in your document control.

Connecting It to Policy Management

Document controlling sits at the centre of policy management. A policy without document control is a statement of intent without evidence the organisation is following its own commitments. The five principles above — current version known, owner known, approval recorded, review cycle live, change history kept — are the working definition of policy management at small-organisation scale.

Most small UK regulated organisations already have the policies. They have the procedures. They have the people who care about getting it right. The gap is the controlling layer — the register, the schedule, the approval record, the version history. Once that is in place, inspections become an evidence-gathering exercise, not a panic.

PolicyBoard is designed to be that controlling layer for small UK councils, MATs, GP practices, and charities — a central register of policies and procedures, automated review reminders, lightweight approval workflows, version history, and inspection-ready exports. Join the waitlist to be notified when it launches.

Sources

• ISO 9001:2015 — Quality Management Systems Requirements
• CQC Regulation 17: Good Governance
• DfE: Keeping Children Safe in Education
• ICO: Accountability and Governance

This guide covers general principles of document controlling for small UK regulated organisations. It is not legal, audit, or ISO certification advice. Always check the specific requirements of your regulator and seek professional advice where needed.

The policy is what you commit to. The procedure is what people actually do. They are not the same document, and managing only one of them is a quiet governance failure that surfaces at the worst possible moment.

Most small UK regulated organisations track policies in a spreadsheet, if they track them at all. Procedures live in shared drives, on practice intranets, in the head of the person who has been there longest, or in a folder labelled "SOPs" that has not been opened in two years. When an inspector or auditor asks "show me how you do X", the panic is the gap between the policy you have and the procedure no one can find.

This guide covers what policy and procedure management actually involves at small-organisation scale, what software needs to do, and how to evaluate options when most tools on the market are priced for organisations 10× your size.

Policy vs Procedure: Why The Distinction Matters

In governance theory, policies set principles and procedures set practice. In small UK regulated organisations, the practical distinction is sharper:

• A policy is what trustees, governors, councillors, or partners approve. It sets out what the organisation commits to and why. It is reviewed annually by the body that approved it. It is the document an inspector asks for first.
• A procedure is what staff follow day-to-day. It is updated by the person who owns the activity, often without formal approval. It changes more often than the policy — when systems change, suppliers change, or the person who used to do it leaves.

Both are needed. A safeguarding policy without a referral procedure is a statement of intent without a process. A medication-administration procedure without a medicines policy has no governance authority — staff are following an unapproved process.

The mismatch most small organisations live with: policies are formal, infrequently reviewed, and inspector-facing. Procedures are informal, frequently updated, and staff-facing. Tracking them in different systems (or different parts of the same shared drive) means the two drift apart. The policy still references the 2022 procedure. The procedure still references the 2021 policy. No one has noticed.

Why Manage Them Together

Three reasons one tool, not two, is the right answer for small UK regulated organisations:

1. Inspectors and auditors look at the link

The CQC inspector does not just want the safeguarding policy — they want evidence that the procedure matches the policy and that staff follow the procedure. The Ofsted inspector who asks about behaviour management wants the policy, the procedure, and the staff training records. The internal auditor who reviews financial controls wants the financial regulations (policy) and the day-to-day procedures (cash handling, expense approval, supplier onboarding) that operationalise them.

Managing them in one register makes that link auditable. Managing them in two systems means evidencing the link is a manual exercise every inspection.

2. Procedures change more than policies — but still need governance

A practice manager updates the appointment-booking procedure because a new locum joined and the old SOP referenced a phone system that was replaced. The change is sensible and operationally correct. The change has not been recorded against the underlying policy that says the practice will respond to patient appointment requests within agreed timeframes.

Six months later, an audit finds that a third of repeat-prescription requests were not actioned within the policy commitment. The reason is in the procedure update — but no one connected the dots because the policy and the procedure live in different files.

Lightweight version control across both gives the audit trail inspectors expect.

3. The person managing one usually manages both

In a small UK regulated organisation, the person responsible for policies is usually also responsible for procedures: the school business manager, the practice manager, the charity governance lead, the council clerk. They do not need two systems and two sets of reminders. They need one register that shows what is current, what is due for review, and where the gaps are between policies and procedures.

Two systems double the cost, the maintenance overhead, and the risk that something falls between them.

What Small UK Regulated Organisations Actually Need

The features list for a policy and procedure management tool that fits a small council, GP practice, MAT, or charity is shorter than enterprise vendors imply:

A unified register

One list of every governance document — policies, procedures, SOPs, protocols — with a clear marker for each type. Filterable by category, owner, status, or document type. Searchable by keyword.

Linked relationships between policies and procedures

When you open the safeguarding policy, you see the procedures that operationalise it. When you open the safeguarding referral procedure, you see the policy it sits under. This is not a complex graph database — it is a simple "parent policy" or "related procedures" field that makes the relationship explicit.

Different review cadences for different document types

Policies typically reviewed annually by the approving body. Procedures often reviewed more frequently — sometimes quarterly, sometimes when triggered by an operational change. The review cadence should be configurable per document, not assumed to be the same across the register.

The policy review frequency guide covers regulator-specific cadences for policies. Procedures generally need more frequent review than that — at minimum, after any operational change to systems, suppliers, or staff who carry out the procedure.

Different approval workflows for different document types

Policies route to a formal approval body (governing body, trustees, partners, council). Procedures usually need only departmental or line-manager sign-off. The workflow should reflect that, not force every procedure update through the trustees.

Audit trail across both

Who changed what, when. Previous versions accessible. The same audit trail standard for both document types — because an inspector or auditor will ask about both.

Inspection-ready exports

Pull a current-status report for an inspector or board: all policies and procedures, owners, last review dates, next review dates, approval status. Without a custom report builder. The free Policy Register Template is a working starting point for the columns this report needs.

Where Enterprise Tools Misfit

Mature enterprise GRC tools (NAVEX, MetaCompliance, Workiva, Mitratech, and the rest) handle policy and procedure management well at large scale. They do not fit small UK regulated organisations for the same reasons enterprise policy management software does not fit:

• Pricing model. Per-user or per-module pricing assumes a compliance team. A 30-staff organisation with one part-time governance lead pays for capacity that is not used.
• Implementation effort. Enterprise tools assume someone configures the document taxonomy, imports the library, and trains users. In a small organisation, that configuration time exceeds the time saved by the tool in its first year.
• Feature surface. Attestation programmes, learning management integrations, advanced analytics — useful at large scale, friction at small scale. The school business manager does not need a heatmap of policy attestation rates by department.
• Sales motion. Demos, scoping calls, security questionnaires, procurement sign-off. Small organisations need to sign up, import, and use the tool the same week.

The mismatch is not feature scope but assumed buying process and operational scale. A tool for a 30-staff council needs to be self-serve, transparently priced, and usable in an afternoon. Most enterprise tools fail all three tests.

For organisations that need to manage policies across multiple sites or services (a multi-academy trust, a council with several departments, a charity with branches), the corporate policy management guide covers the multi-site coordination requirements that overlap with policy-and-procedure scope.

A Practical Evaluation Checklist

Before paying for any tool, run through these questions:

1. Does it handle both policies and procedures in one register? If you need two separate modules with two separate licences, you are buying enterprise tooling.
2. Can document types have different review cadences and approval workflows? Procedures are not policies — the tool should not pretend they are.
3. Is the link between a policy and its procedures explicit and visible? Without this, you have document storage, not policy and procedure management.
4. Can a non-IT person configure it in an afternoon? Setup workshops are a sign of enterprise pricing.
5. Is pricing transparent and based on organisation, not user? "Contact sales" usually means a price designed for organisations 10× larger.
6. Can I export the full register at any time? If export needs a support ticket, the data is locked in.
7. Does it work for me without configuration on day one? A traffic-light dashboard, a register, automated reminders — these should be the default behaviour, not configurable extras.

If a vendor pushes back on more than one of these, they are selling to a different buyer.

Sector-Specific Notes

GP practices and primary care (CQC)

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires "systems and processes" — not just policies. In practice, CQC inspectors look at the procedures that operationalise each policy: the safeguarding referral procedure, the medicines management protocol, the infection control cleaning schedules, the significant event analysis process. Policies without matching procedures fail the "well-led" assessment.

The CQC policy requirements guide lists the policy categories inspectors expect to find. Each category typically has one or more procedures sitting beneath it.

Schools and MATs (Ofsted)

The DfE's Keeping Children Safe in Education guidance is procedural as much as it is policy — it sets out what schools must do, not just what they must commit to. Inspectors will check the policy, then test whether the procedure matches the policy and whether staff follow it.

Charities (Charity Commission)

The Charity Governance Code is policy-level guidance. The Commission's expectations on safeguarding, financial controls, and risk management require both the policy (trustees commit to X) and the procedure (this is how X happens day-to-day). Trustees cannot delegate accountability for procedures, even though they do not write them.

Health and safety (HSE — all sectors)

The Health and Safety at Work Act 1974 requires a written health and safety policy for organisations with five or more employees. HSE guidance on writing a health and safety policy covers the policy itself; the procedures (risk assessments, accident reporting, COSHH, manual handling, lone working) sit beneath it.

Data protection (ICO — all sectors)

UK GDPR requires accountability — the ability to demonstrate compliance. The ICO accountability and governance guidance sets out the documentation expected: the data protection policy, the records-of-processing register, the breach response procedure, the subject access request procedure. Each policy implies one or more procedures.

Connecting the Pieces

Policy and procedure management at small-organisation scale is not a procurement project, and it is not two separate problems. It is one coordination problem: making sure every governance commitment has a working procedure, every procedure has an approved policy, and someone owns the link between them.

Enterprise tools solve this at a scale and price built for organisations with a compliance team. Small UK regulated organisations need the same coordination at a scale and price the existing person-who-also-does-policy-and-procedure can sign off without a procurement committee.

If you are evaluating tools, the policy management software evaluation guide covers the policy half in more depth, and the policy document management guide covers what to do when the documents themselves (versions, attachments, file storage) are part of the problem.

PolicyBoard is designed to manage policies and procedures together — one register, configurable review cadences and approval workflows per document type, explicit links between policies and the procedures that operationalise them, and inspection-ready exports. Join the waitlist to be notified when it launches.

Sources

• CQC Regulation 17: Good Governance
• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17
• DfE: Keeping Children Safe in Education
• Charity Governance Code
• HSE: Write a Health and Safety Policy
• ICO: Accountability and Governance

This guide covers general principles for small UK regulated organisations. It is not legal or procurement advice. Always check the specific requirements of your regulator and seek professional advice where needed.

Search the term and the top results are NAVEX, Xoralia, and Capterra. The pricing pages either say "contact sales" or assume an organisation with a compliance team. Your organisation has a school business manager who also runs HR. Or a clerk who also handles GDPR. Or a chief officer who also chairs the audit committee.

This guide covers what corporate policy management actually means at small-organisation scale, what the software needs to do for a UK council, MAT, or charity, and how to evaluate options when the buyers' guides on the SERP were written for a procurement team you do not have.

What "Corporate" Means at Small-Organisation Scale

In enterprise vendor copy, "corporate policy management" usually means the global function that sits inside Compliance, Legal, or Risk in a 5,000-person organisation. There is a head of compliance, a policy committee, and an attestation programme tied to annual training.

In a 30-person council, a 15-school MAT, or a five-trustee charity, "corporate" means something different and narrower:

• Multiple owners across functions. The data protection policy is owned by the DPO, the safeguarding policy by the safeguarding lead, the procurement policy by the chief officer. No single person sees the whole register.
• Multiple sites or teams. A MAT has 15 schools that share trust-level policies and add school-level ones. A council has a handful of departments. A charity may have head-office policies and project-level ones.
• Cross-cutting governance. Trustees, governors, councillors, or board members have legal accountability for ensuring the policies exist, are current, and are followed — even though they do not write them.
• Inspection-readiness. Corporate, in this context, means "ready to evidence governance" — to Ofsted, CQC, the Charity Commission, an internal auditor, or a Local Government Audit Service appointee.

What it usually does not mean: a 200-person policy team, an enterprise procurement budget, or a 12-month implementation cycle.

Why Enterprise Tools Do Not Fit

The corporate policy management category is mature. NAVEX PolicyTech, MetaCompliance, Mitratech, Workiva, and others have served large-enterprise compliance teams for years. Their feature lists are extensive — attestation tracking, policy authoring with templates, multi-language support, learning management integration, advanced analytics.

The mismatch for a small UK regulated organisation is not feature scope but assumed buying process:

• Pricing structure. Enterprise tools price by user, by module, or by negotiated annual contract. A 30-seat council quote can be £8,000–£20,000 a year before implementation services. The buyer at a small council does not have that line item available.
• Sales cycle. Enterprise tools assume a 3–6 month evaluation: discovery calls, scoping workshops, security questionnaires, procurement sign-off. A practice manager or charity CEO needs a tool by next month, not next financial year.
• Implementation effort. Enterprise tools assume someone configures the policy taxonomy, sets up the approval workflows, imports the policy library, and trains users. In a small organisation, that someone is also the person who would use the tool — so any time spent configuring is time not spent doing the day job.
• Feature surface. Attestation programmes, advanced reporting, integration with HRIS — these are valuable in large organisations but become friction at small scale. The school business manager just wants to know which policies are due for review next month.

For a small UK regulated organisation, "corporate" needs to mean light-touch coordination across functions and sites — not enterprise compliance tooling rebadged for smaller customers.

What Small UK Regulated Organisations Actually Need

Strip back the enterprise feature list and the requirement for small councils, MATs, and charities looks like this:

A central register that anyone can find

Every policy in one place, with its owner, category, status, and next review date visible at a glance. Not buried in a SharePoint folder hierarchy or in someone's spreadsheet. A school business manager covering for a colleague should be able to find the relevant policy in under a minute.

If your starting point is a spreadsheet, our free Policy Register Template is a working example of the columns and structure you will need.

Automated reminders that go to the right person

Reminders 90, 60, and 30 days before a review date — sent to the policy owner, not a generic shared inbox. The reminders should not need configuration; they should just work, by default, the day a policy is added to the register.

Manual reminder calendars fail for the same reason manual policy registers fail: someone has to remember to maintain the calendar.

Approval workflow that captures evidence

Trustees, governors, or councillors approve key policies. The approval needs to be evidenced — a name, a date, ideally a comment. When an inspector or auditor asks "who approved this version of the safeguarding policy?", the answer should not require opening the minutes of three different meetings.

For schools, the academic year imposes a natural cadence: many statutory policies are approved annually by the full governing body or trust board. The approval workflow should match that rhythm without requiring the clerk to chase signatures by email.

Multi-site visibility (where applicable)

A MAT needs to see which policies are trust-level and which are school-level. A council needs to see how each department's local procedures relate to corporate-wide policies. A federated charity needs to see which policies are shared across branches and which are local.

This does not mean a complex hierarchy or permission system. At small scale, "multi-site" means the register can be filtered by site and a single dashboard can show overall status across the group.

Inspection-ready exports

Pull a current-status report for an inspector, an auditor, or a board meeting in under five minutes. Not a custom report builder — a standard "all current policies, owners, last review dates, next review dates" view that exports to PDF or CSV.

For CQC-regulated GP practices, the CQC policy requirements guide sets out what inspectors expect to see. For Ofsted-inspected schools, the Ofsted Statutory Policies Checklist is a good starting point. For all sectors, the policy review frequency guide sets the regulator-specific cadences inspection-ready exports need to support.

An audit trail

Every change recorded — who edited what, when, what the previous version said. This is the difference between a document store (which most organisations already have) and policy management (which most do not). Inspectors and auditors increasingly ask for the audit trail, not just the current document.

What Most Enterprise Features Are Not Worth Paying For (At Small Scale)

A small-organisation evaluation gets faster when you cross out features that look impressive but solve problems you do not have:

• Built-in policy authoring with template libraries. You already have the policies. They are in Word documents. Importing them is more useful than rewriting them in a vendor's editor.
• Attestation programmes with quizzes and certificates. For 30 staff, an email confirming "I have read the policy" is sufficient evidence. Quiz-based attestation is procurement theatre at this scale.
• Multi-language support. A small UK regulated organisation operates in English. This feature drives up enterprise pricing and is not used.
• Custom workflow configuration. Enterprise customers value the ability to design bespoke approval flows. Small organisations usually need one or two flows: "owner review → manager approve" or "owner review → committee approve."
• Advanced analytics dashboards. A traffic-light view (green / amber / red by status) is enough. Heatmaps and trend analysis sound useful but are not what an inspector asks to see.

The features worth paying for at small scale are the central register, automated reminders, lightweight approval workflow, multi-site filtering, and inspection-ready exports. Everything else is optional.

A Practical Evaluation Checklist

Before paying for any tool, run through these questions:

1. Is the price published? If the website says "contact sales," the pricing was designed for organisations 10× your size.
2. Can I import my existing policy list in under an hour? If the answer is "engage our professional services team," walk away.
3. Does it send reminders by default? Not "can be configured to" — does it, out of the box, the day after I add a policy.
4. Can I generate an inspection-ready report without a configuration project? If yes, demo it. If no, the tool is too heavy for small-org use.
5. What happens to my data if I cancel? Export should be a button. If it requires a support ticket and a notice period, the data is locked in.
6. Can a non-IT person set it up in an afternoon? If the trial requires a setup call, it is built for the enterprise sales motion.
7. Does pricing scale by organisation, not per user? Per-user pricing punishes multi-site organisations and small teams that share access.

The right tool for a small UK regulated organisation should pass all seven without explanation. If a vendor pushes back on any of them, they are selling to a different buyer.

Sector-Specific Notes

Small councils (parish, town, principal authority departments)

Standing orders, financial regulations, code of conduct, complaints procedure, risk management, data protection, health and safety — all reviewed annually as part of the audit cycle, alongside the Annual Governance and Accountability Return. The JPAG Practitioners' Guide sets the practical proper-practices framework smaller authorities work to.

What matters: a register that aligns with audit cycle review dates, evidence of annual approval (often at the annual council meeting), and exportable reports the internal auditor can drop into their working papers.

Multi-academy trusts (MATs)

Trusts operate two policy layers — trust-wide statutory policies (often standardised across all schools) and school-level addenda (e.g. site-specific safeguarding arrangements). The DfE's academy trust governance framework sets out the governance expectations across that two-layer structure.

What matters: a register that can show "all schools current on this policy" at a glance, distinct trust-level vs school-level views, and approval workflows that route to the right body (members, trustees, local governing bodies) for each policy type.

Charities

The Charity Governance Code recommends annual review of key policies and a fuller governance review every three years. The Charity Commission's essential trustee guidance (CC3) makes governance accountability explicit, and safeguarding duties for trustees applies wherever the charity works with children or adults at risk.

What matters: trustee-friendly approval workflow (trustees may not be in the office daily), evidence-of-review timestamps for the annual return, and the ability to attach policies to specific charitable activities for restricted-fund compliance.

Federations and group structures

Some charities, councils, and MATs share back-office services through a federation or strategic partnership. In these cases, a "central" register that spans organisational boundaries can be useful — but only if each organisation retains visible ownership of its own policies. A shared dashboard that obscures ownership undermines individual governance accountability.

Connecting the Pieces

Corporate policy management at small-organisation scale is not a procurement project. It is a coordination problem: making sure every policy has a known owner, a known review date, and a known approval status — visible to whoever needs to see it, without phoning round.

Enterprise tools solve the same problem at a scale and price built for organisations that have a compliance function. Small UK councils, MATs, and charities need the same coordination at a scale and price the existing person-who-also-does-policy can sign off without a procurement committee.

If you also need to think about policy and procedure management software, the requirements overlap heavily — most small organisations need both, in one tool, without paying for two enterprise subscriptions.

PolicyBoard is designed for exactly this gap: a central policy register, automated email reminders, lightweight approval workflow, multi-site filtering, and inspection-ready exports — at a price point a school business manager, council clerk, or charity CEO can approve without a committee. Join the waitlist to be notified when it launches.

Sources

• CQC Regulation 17: Good Governance
• DfE: Governance in Maintained Schools
• DfE: Academy Trust Governance Guide
• Charity Governance Code
• Charity Commission: The Essential Trustee (CC3)
• Charity Commission: Safeguarding Duties for Trustees
• JPAG Practitioners' Guide (Smaller Authorities)

This guide covers general principles for small UK regulated organisations. It is not legal or procurement advice. Always check the specific requirements of your regulator and seek professional advice where needed.

Most organisations handle the first two stages (creation and approval) and then lose control. The policy sits in a shared drive, unreviewed, until someone asks about it during an inspection. That is not lifecycle management — it is storage with a prayer.

This guide walks through each stage of the policy lifecycle and explains what UK regulated organisations need at every step.

The Six Stages of Policy Lifecycle Management

Stage 1: Creation

A new policy is needed because:

• A regulator requires it (CQC, Ofsted, Charity Commission)
• Legislation changes (new DfE guidance, updated KCSIE, UK GDPR amendments)
• An incident exposed a gap (a safeguarding concern with no documented procedure)
• The organisation starts a new activity (opening a new site, offering new services)

Before drafting, check whether the policy already exists. Duplicate policies with conflicting content are common, especially in MATs and GP practice groups where some policies are set centrally and others locally. Search your shared drives, the policy register, and ask colleagues before creating a new document.

Drafting tips for small organisations:

• Start with a sector-specific template where available — the DfE governance guides and professional associations publish templates for common school and healthcare policies
• Focus on what staff actually need to do, not abstract principles. "If a child discloses abuse, do X, then Y, then Z" is more useful than "the organisation is committed to safeguarding"
• Include the scope — who does this policy apply to? Which sites? Which staff groups?
• Name the policy owner — who is responsible for maintaining and reviewing this policy going forward?

Stage 2: Approval

A policy is not live until it is formally approved. The approval process depends on your organisation type:

What the approval record should capture:

• Which version was approved
• Who approved it (by name or body)
• The date of approval
• Any conditions or caveats ("approved subject to updating the safeguarding lead's contact details")

An email saying "looks fine" is not a formal approval. An undated signature on a document footer is better, but a timestamped record in meeting minutes or an approval system is best.

Stage 3: Distribution

An approved policy is useless if nobody can find it. Distribution means:

Making it accessible. Staff need a single, known location where they can find current policies. Not a folder with 200 files — a structured, searchable location organised by category.

Removing old versions. When a new version is approved, the old version should be archived (not deleted) and removed from general access. If staff can still find the old version in a shared drive, they may follow outdated procedures.

Confirming awareness. For critical policies (safeguarding, data protection, health and safety), there should be evidence that staff have read them. This might be a sign-off sheet at a staff meeting, a record in the training log, or an attestation in a policy management system. The evidence level should match the risk — a sign-off sheet for safeguarding, verbal confirmation at a team meeting for less critical policies.

Publishing where required. Schools must publish certain statutory policies on their website. Charities may need to share specific policies with the Charity Commission. Make sure published versions match the current internal versions.

Stage 4: Implementation

A policy only works if staff follow it. Implementation bridges the gap between documentation and practice:

Training. When a new or significantly updated policy is introduced, affected staff need training on what has changed and what they need to do differently. This does not have to be a formal training day — a 15-minute briefing at a staff meeting may be sufficient.

Embedding in processes. The policy should be reflected in the processes it governs. If the complaints policy says "acknowledge within 3 working days," the complaints workflow should include that deadline. If the safeguarding policy says "contact the designated lead immediately," staff should know who the designated lead is and how to reach them.

Monitoring compliance. After implementation, check whether the policy is being followed. For clinical policies, this might be a spot audit. For governance policies, it might be checking that approval records match the policy requirements. For safeguarding, it might be a scenario exercise at a training day.

Stage 5: Review and Update

Every policy has a scheduled review date. The review process:

1. Check against current requirements. Has legislation changed? Has regulatory guidance been updated? Has the organisation changed its operations?
2. Check against practice. Is the policy still reflected in how things actually work? If staff have developed workarounds, the policy may need updating to match reality (or the practice needs changing to match the policy).
3. Consult stakeholders. For significant changes, consult the people affected — staff, governors, trustees, or service users as appropriate.
4. Update the document. Increment the version number, update the date, revise the content. Keep a record of what changed and why.
5. Re-approve. Route the updated version through the approval process. Minor editorial changes (typo fixes, formatting) may not need full approval, but substantive changes always do.
6. Redistribute. Replace the old version with the new one in all distribution locations. Update the website if the policy is published.

Triggered reviews happen outside the schedule when:

• Legislation or regulatory guidance changes
• An incident or complaint reveals a gap in the policy
• The organisation changes its operations, staffing, or premises
• An audit or inspection identifies a concern

Stage 6: Retirement

Policies are retired when they are no longer needed — because the activity they governed has ceased, the regulation they addressed has been repealed, or they have been consolidated with another policy.

Retirement is not deletion. Archive the final version with a note explaining:

• When it was retired
• Why it was retired
• What replaced it (if anything)

Regulators, auditors, or legal proceedings may require access to historical policies. An organisation that cannot produce its safeguarding policy from three years ago during a historical investigation has a problem.

Where Organisations Lose Control

The lifecycle is not complicated on paper. In practice, control is lost at the transitions:

Creation → Approval: Policies are drafted but never formally approved. They enter circulation as "working documents" and nobody goes back to get sign-off.

Approval → Distribution: The policy is approved in a governors' meeting but the document in the shared drive is not updated. Staff continue following the previous version.

Distribution → Review: The policy is distributed and then forgotten. Nobody tracks the review date, and the policy drifts out of date.

Review → Retirement: Outdated policies are left in circulation indefinitely because nobody has a process for retiring them. Staff are confused about which policies are current.

Practical Lifecycle Management for Small Organisations

You do not need an enterprise platform to manage the policy lifecycle. You need:

1. A policy register that tracks every policy through every stage — creation date, approval date, version, owner, review date, status
2. Automated reminders that flag upcoming reviews before they become overdue
3. Approval records — minutes, sign-off records, or timestamped approvals in a system
4. A single source of truth for current policy documents — one location that staff know about
5. An archive for superseded and retired versions

PolicyBoard is designed to automate the lifecycle — from review reminders and approval workflows to compliance dashboards and audit trails. Built for UK schools, GP practices, charities, and councils. Join the waitlist to be notified when it launches.

This article covers general principles of policy lifecycle management. It is not legal advice.

But if you run a school, GP practice, charity, or council in the UK, document control means something more specific: can you prove to your regulator that your policies, procedures, and records are current, approved, and accessible?

This guide covers document control from the perspective of UK regulated organisations — not ISO certification, not manufacturing quality systems, but the practical governance requirements that CQC, Ofsted, the Charity Commission, and auditors expect to see. For the underlying argument on why document control matters in regulated UK organisations, start there and come back.

Document Control in Regulated UK Organisations

For most regulated UK organisations, document control applies primarily to:

• Policies and procedures — safeguarding, health and safety, data protection, complaints, clinical governance, financial regulations
• Registers and records — risk registers, asset registers, training records, DBS check records, accident logs
• Governance documents — minutes, terms of reference, schemes of delegation, standing orders
• Compliance evidence — audit reports, inspection action plans, incident records, complaints logs

The common requirement across all regulators: these documents must be current, approved, accessible, and traceable. An outdated policy is not just a paperwork problem — it is evidence that your governance systems are not working.

What Each Regulator Expects

CQC (GP practices, dental practices, health services)

Regulation 17 requires records that are "accurate, complete and contemporaneous." For document control, this means:

• Every clinical and governance policy has a named owner and a review date
• Previous versions are retained (regulators may need to see what a policy said at a specific point in time)
• Changes are traceable — who updated it, when, and why
• Staff can locate and follow current procedures

CQC inspectors follow threads: they ask a receptionist about a procedure, then check whether the documented policy matches. If the policy is version 2 but the practice is following version 1's procedures, that is a Regulation 17 concern.

Ofsted (schools, academies, MATs)

Schools must maintain statutory policies that are current and — for many — published on the school website. Ofsted checks:

• Statutory policies are in place and have been reviewed within required timeframes
• The safeguarding policy reflects the latest Keeping Children Safe in Education guidance
• Governing body minutes reference policy approvals
• Published website policies match the internal current versions

For schools in MATs, document control is more complex. Some policies are trust-level (standardised across all schools), others are school-level. Without clear version control, individual schools may be operating under outdated trust policies.

Charity Commission

The Charity Governance Code expects trustees to review governance arrangements regularly. Document control evidence includes:

• Board minutes showing policy approval decisions
• A register of policies with review dates
• Version history for key policies
• Evidence that policies are distributed to staff and volunteers

Local authority audit

Parish, town, and district councils are audited annually. Auditors check:

• Standing orders and financial regulations have been formally adopted at a council meeting
• Governance documents are dated and signed
• Risk management policies are current
• Previous versions are archived (not overwritten)

The Five Elements of Document Control

Regardless of your regulator, effective document control covers the same five areas:

1. Identification

Every controlled document has:

• A unique title
• A version number (v1.0, v2.0, v2.1)
• A date
• A document owner

Without identification, you cannot answer: "Which version is current?" If your safeguarding policy is stored as "Safeguarding Policy FINAL (2).docx" with no date or version number, it is not controlled.

2. Approval

Every document goes through a formal approval process before it becomes the current version. The approval record includes:

• Who approved it (governing body, trustees, practice manager)
• When it was approved
• Which version was approved

Verbal approval is not an audit trail. You need written evidence — ideally timestamped in a system, or at minimum recorded in meeting minutes.

3. Distribution

Controlled documents must be accessible to the people who need them. For policies, this means:

• Staff know where to find current policies
• Outdated versions are not accessible (or are clearly marked as superseded)
• For critical policies, there is evidence staff have read them (training records, sign-off sheets)

4. Review and Revision

Every document has a scheduled review and a process for updating it when circumstances change. The review cycle includes:

• Checking content against current legislation and guidance
• Updating the version number and date
• Routing through the approval process
• Replacing the previous version in all distribution locations

5. Retention and Archiving

Previous versions are not deleted — they are archived. Regulators may need to see what a policy said at a specific point in time (for example, during an investigation into a historic safeguarding concern). Archived versions should be clearly labelled and inaccessible to general staff to prevent confusion.

Common Document Control Failures

The shared drive problem. Policies live in a folder structure with no version control. Staff save working copies to their desktop. Three versions exist with different dates. Nobody is sure which is current.

The website lag. The internal policy is updated but the version published on the school website is not. An inspector or parent reads an outdated version.

The email approval. A policy is sent for approval via email. The practice manager replies "looks fine." Six months later, nobody can find the email, and there is no formal record of approval.

The single point of failure. One person maintains the policy register, knows where everything is, and manages the review schedule. When they are on leave or leave the organisation, the system stops.

The annual scramble. Policies are not reviewed on schedule. Instead, all reviews happen in a two-week panic before an inspection. The resulting reviews are superficial because there is no time to do them properly.

Building Better Document Control

Start with a register

You cannot control documents you have not catalogued. Build a policy register that lists every policy, its owner, version, and review date. Our free Policy Register Template does this in minutes.

Set up automated reminders

Manual tracking fails at scale. Use our Policy Review Schedule Generator to calculate review dates and import them into your calendar. Better still, use a system that sends reminders automatically.

Separate the document from the tracking

The policy document itself (a Word file, PDF, or web page) is not the same as the document control record (who approved it, when, which version). Keeping these separate means you can update tracking information without opening every document.

Standardise naming and versioning

Adopt a consistent format: "Policy Name v[version] [date]". For example: "Safeguarding Policy v3.0 2026-01-15". Avoid dates in filenames that do not match the actual review date, and never use "FINAL" or "LATEST" — these become meaningless after the second revision.

Document Control Is Not ISO

If you searched for "control of documentation" expecting ISO 9001 guidance, you may be wondering why this article has not mentioned clause 7.5. The reason: most small UK regulated organisations do not hold ISO certification and do not need to. The document control requirements from CQC, Ofsted, and the Charity Commission overlap with ISO principles but are specific to the regulatory context.

That said, if your organisation does hold ISO 9001 or is working toward it (some councils and NHS organisations require it), the document control framework described here aligns with clause 7.5 — you would simply add ISO-specific elements like documented information scope and external document control.

For the day-to-day mechanics of running document control — naming, versioning, approval, and review — our practical guide to document controlling walks through the process step by step.

PolicyBoard is designed to automate the document control that UK regulators expect — version tracking, approval workflows, review reminders, and a compliance dashboard. Join the waitlist to be notified when it launches.

Sources

• CQC Regulation 17: Good Governance
• DfE: Keeping Children Safe in Education
• Charity Governance Code

This article covers document control principles for UK regulated organisations. It is not legal advice.

None of that is relevant if you are a school business manager managing 80 statutory policies, a practice manager tracking CQC compliance, or a governance officer at a small charity. Your requirements are different from a multinational corporation — and so is your budget.

The Enterprise vs. Small Organisation Divide

Enterprise policy management tools are built for organisations with dedicated compliance teams, hundreds of employees who need to attest to policies, and procurement processes that span months. They can cost thousands of pounds per year and require significant configuration.

Small UK regulated organisations have a different profile:

• 50-500 staff — the policy owner is also doing their main job (teaching, clinical work, financial management)
• No dedicated compliance team — the school business manager or practice manager handles governance alongside everything else
• Budget under £50/month — the tool needs to cost less than the admin time it saves
• No procurement process — the buyer can expense a modest subscription without board approval
• Regulatory-specific requirements — CQC Regulation 17, Ofsted statutory policies, Charity Commission governance code

The gap between what enterprise tools offer and what small organisations need is where time and money get wasted.

Features You Actually Need

1. A Policy Register That Tracks Everything

The foundation. Every policy in one place with its owner, category, version, review frequency, and status. Not a shared drive folder — a structured register that you can filter, sort, and export.

This replaces the spreadsheet that nobody updates and the shared drive that nobody checks. You should be able to answer "how many policies are overdue?" in under 10 seconds.

2. Automated Review Reminders

The single most valuable feature for time-poor organisations. Email reminders sent automatically to policy owners — 90, 60, and 30 days before review deadlines. With escalation if the deadline passes without action.

Without this, you are relying on someone remembering to check a spreadsheet. The review frequency varies by regulator, and the consequences of missing a deadline range from audit findings to enforcement action.

3. Simple Approval Workflow

When a policy is reviewed, the updated version needs formal approval. For schools, that means the governing body. For charities, the trustees. For GP practices, the partners or practice manager.

You need: route the policy to the right approver, record their approval with a timestamp, store the approved version. You do not need: multi-level approval chains, parallel approval tracks, or conditional routing based on content analysis.

4. Compliance Dashboard

A visual overview showing the health of your policy portfolio. Traffic-light status: green (current), amber (due within 90 days), red (overdue). Filterable by category, owner, or site.

This is what you show at a governors' meeting or pull up when an inspector asks about your governance. It takes the register data and makes it instantly understandable.

5. Audit Trail

Every review, approval, edit, and version change recorded with a timestamp and user name. This is not optional for regulated organisations — CQC, Ofsted, and auditors expect evidence that your governance processes work.

6. Export for Inspections and Board Reports

Generate a compliance report showing the status of every policy. PDF for board papers, CSV for further analysis. This should take minutes, not hours of compiling data from multiple sources.

Features You Can Skip

Employee Attestation at Scale

Enterprise tools track whether every employee has read and acknowledged every policy, with e-signatures, completion dashboards, and non-compliance escalation. If you have 80 staff and a termly staff meeting, this is overkill.

What you actually need: evidence that staff know where to find policies and understand the key ones (safeguarding, data protection, H&S). A sign-off sheet at a staff meeting meets this requirement. A five-figure attestation module does not add proportionate value.

AI Policy Drafting

Several newer tools offer AI-generated policy templates. For most small organisations, this solves a problem that does not exist — you already have your policies. You need help managing them, not writing new ones from scratch. When you do need a new policy, sector-specific templates from bodies like the DfE or professional associations are more reliable than AI-generated content.

GRC Platform Integration

Governance, Risk, and Compliance platforms are enterprise tools. If you are a school, charity, or GP practice, you do not have one and do not need one. Integration with a tool you do not use adds cost without benefit.

Custom Branding and White-Labelling

Useful if you are a consultancy selling policy management as a service. Irrelevant if you are managing your own policies. The time spent configuring brand colours is time not spent on actual governance.

Per-User Pricing

Enterprise tools often charge per user because they assume every employee needs an account (for attestation). For small organisations, this model is punitive — you might need 3-5 admin users but the tool charges for 80 staff accounts. Look for per-organisation pricing instead.

The Buying Process for Small Organisations

The buyer at a school, GP practice, or small charity is not going through an RFP process. The practical buying criteria:

1. Can I try it without a sales call? If "request a demo" is the only option, the tool is probably priced for enterprise.
2. Is pricing published? Hidden pricing means the sales team adjusts based on your budget. Published pricing means you know what you are getting.
3. Can I set it up in a day? Enterprise tools require weeks of configuration. Small organisations need something that works within hours.
4. Does it handle my regulatory context? UK regulatory requirements (CQC, Ofsted, Charity Commission) are specific. A tool designed for US HIPAA compliance will not help you prepare for a CQC inspection.
5. Can I cancel without penalty? Monthly subscriptions with no lock-in reduce risk. Annual contracts with early termination fees are a commitment you may not want to make before proving the tool works for you.

Existing Options for Small Organisations

The current market breaks into three tiers:

Free / manual: Spreadsheets, shared drives, document footers. No cost, but no automation. Works for under 20 policies with a dedicated person tracking them. Breaks down at 50+ policies or when that person leaves.

Mid-range (£19-80/month): Purpose-built tools targeting small-to-mid organisations. Some are sector-specific (schools, healthcare), some are cross-sector. This is the sweet spot for most regulated UK organisations.

Enterprise (£5,000+/year): Full lifecycle management with attestation, AI, GRC integration. Designed for organisations with dedicated compliance teams and large procurement budgets.

The challenge in the mid-range tier is finding tools that understand UK regulatory requirements specifically. Most mid-range tools are US-focused or industry-agnostic.

How to Evaluate Before You Buy

1. Build a policy register — understand your policy portfolio before choosing a tool
2. Use the free Policy Register Template — get structured data on what you have
3. Calculate your review schedule — understand the workload
4. Review the buyer's guide — criteria-based evaluation checklist
5. Consider whether you also need procedure management — most small UK organisations need policy and procedure management together rather than two separate tools

PolicyBoard is designed for exactly this gap — mid-range pricing, UK regulatory context, and the features that matter for schools, GP practices, charities, and councils. Join the waitlist to be notified when it launches.

This article helps UK organisations evaluate policy management tools. It is not a product comparison or endorsement of specific vendors.

A policy register fixes that. It is the single source of truth for every policy your organisation holds — and building one takes less time than you might expect.

What Is a Policy Register?

A policy register is a structured record of every policy in your organisation. For each policy, it captures:

• Policy name — the official title
• Category — safeguarding, health and safety, governance, data protection, HR, clinical, finance, or operational
• Owner — the person responsible for reviewing and maintaining the policy
• Approver — who formally approves the policy (governing body, trustees, practice partners)
• Current version — version number and date
• Review frequency — how often the policy should be reviewed (6 months, 12 months, 24 months, or 3 years)
• Last reviewed date — when the policy was last formally reviewed
• Next review date — calculated from last reviewed + frequency
• Status — current, due soon (within 90 days), or overdue
• Location — where the policy document is stored

The register is not the policies themselves — it is the index that tracks them. Think of it as the table of contents for your governance.

Why You Need One

For inspections

CQC, Ofsted, and internal auditors will ask about your policy governance. A register lets you answer confidently: "We have 85 policies. 78 are current. 5 are due for review this quarter. 2 are overdue and under active review. Here is the full list."

That answer, with evidence behind it, demonstrates well-led governance. "I think we have most of them up to date" does not.

For handovers

When a school business manager, practice manager, or governance officer leaves, the policy register ensures their successor knows exactly what exists and what needs attention. Without it, institutional knowledge walks out the door.

For efficiency

Checking 100+ policy documents individually to find review dates takes hours. A register puts every deadline in one place. Combined with automated reminders, it removes the manual tracking entirely.

Step 1: Audit Your Existing Policies

Before building the register, you need to know what you have. Go through every location where policies might be stored:

• Shared drives and document management systems
• SharePoint libraries
• The school/practice website
• Email attachments (policies that were approved via email and never filed properly)
• Physical filing cabinets
• Personal folders belonging to the previous policy owner

For each policy you find, record:

• Name
• Date (from the document — look in the footer, header, or metadata)
• Location

Expect duplicates. You will likely find two or three versions of the same policy in different locations. Note them all — you will deduplicate in the next step.

Step 2: Deduplicate and Identify the Current Version

For each policy with multiple versions, identify which is current:

• The most recently dated version is usually current — but check that it was formally approved
• If you find a newer draft that was never approved, the last approved version is still current
• Mark superseded versions for archiving (do not delete them — you may need them for audit purposes)

Step 3: Set Up Your Register Structure

You can build a policy register in a spreadsheet, but an interactive template is faster. Our free Policy Register Template lets you build the register in your browser and export it as CSV.

If you prefer a spreadsheet, create columns for:

Category options to use:

• Safeguarding
• Health & Safety
• Data Protection
• HR & Employment
• Governance
• Clinical / Care (for GP practices)
• Finance
• Operations

Step 4: Populate the Register

Work through your audited policy list and add each current policy to the register. For each one:

1. Assign a category — this lets you filter the register when preparing for a specific inspection or audit
2. Assign an owner — the person accountable for reviewing and updating the policy. For schools, this is often the head teacher (safeguarding), school business manager (finance, HR), or SENCO (SEND). For GP practices, it is often the practice manager or a named clinical lead.
3. Record the approver — who formally signs off the policy. For schools: governing body. For charities: board of trustees. For GP practices: partners or practice manager.
4. Set the review frequency — see our guide to review frequencies by regulator for specific guidance. As a starting point:
   • Safeguarding: 12 months (some schools review termly)
   • Health and safety: 12 months
   • Data protection: 12 months
   • Clinical policies: 12 months
   • Governance/strategic: 24-36 months
   • Operational: 18-24 months
5. Calculate the next review date — last reviewed date plus the review frequency. Our Policy Review Schedule Generator does this automatically and exports to your calendar.
6. Assess the status — current (next review is more than 90 days away), due soon (within 90 days), or overdue (past the review date)

Step 5: Identify Gaps

With the register populated, you can now see what is missing. Cross-reference against regulatory requirements:

• Schools: Use our Ofsted Statutory Policies Checklist to identify any missing statutory policies, and cross-check against our guide to statutory policies for schools for the full picture
• GP practices: Check against CQC policy requirements and Regulation 17 — safeguarding, IPC, medicines management, information governance, complaints, health and safety
• Charities: Check safeguarding (mandatory if working with children/vulnerable adults), data protection, health and safety, conflicts of interest, reserves
• Councils: Standing orders, financial regulations, risk management, data protection, complaints

Any gap is a priority — create the missing policy and add it to the register.

Step 6: Maintain the Register

A policy register is only useful if it is maintained. Build these habits:

After every policy review: Update the version, last reviewed date, and next review date in the register. This should take 30 seconds.

Monthly check: Scan the register for policies due within 90 days. Chase the policy owner if they have not started the review.

After staff changes: When a policy owner leaves, reassign their policies immediately. Do not wait until the next review date — by then, nobody will remember who was responsible.

After regulatory changes: When CQC, Ofsted, DfE, or the Charity Commission publish new guidance, check which policies are affected and bring forward their review dates.

When to Move Beyond a Spreadsheet

A spreadsheet register works for small portfolios (under 30 policies) with a single person managing them. You will outgrow it when:

• You have 50+ policies and reminders are getting missed
• Multiple people own policies and coordination is difficult
• You need approval workflow (who approved what, when)
• Inspection prep requires generating compliance reports
• You manage multiple sites with shared policies

At that point, a purpose-built policy management system — with automated reminders, approval workflow, compliance dashboard, and audit trail — saves more time than it costs. See our guide to choosing policy management software for what to look for, and our policy tracking software comparison for a breakdown of what compliance teams actually need from a tracking tool. If you run a council, MAT, or charity with multiple sites, our guide on what corporate policy management means at small-organisation scale covers the multi-site evaluation in more detail.

PolicyBoard is designed to replace the spreadsheet register with automated tracking for UK schools, GP practices, charities, and councils. Join the waitlist to be notified when it launches.

This guide covers general principles of policy register management. It is not legal advice. Always check the specific requirements of your regulator.

That is a document control failure — and it happens in organisations of every size. The difference between a well-run organisation and one that scrambles before inspections often comes down to whether their documents are controlled or just stored.

Document Control vs. Document Storage

Document storage is putting files somewhere people can find them. Document control is knowing which version is current, who approved it, when it was last reviewed, and who has access to it.

The distinction matters because regulators do not ask "do you have policies?" — they ask "are your policies current, approved, and followed?" An organisation with 100 policies in a well-organised shared drive but no version control, no approval records, and no review schedule has document storage. It does not have document control.

What Regulators Actually Check

CQC (GP practices, dental practices)

Regulation 17 requires records that are "accurate, complete and contemporaneous." In practice, CQC inspectors look for:

• The current version of key policies (safeguarding, IPC, medicines management)
• Evidence that policies have been reviewed and approved — not just that they exist
• An audit trail showing when policies were updated and by whom
• Staff awareness — can team members find and describe the policies relevant to their role?

A policy with no review date, no approval record, or no evidence of staff awareness is a governance concern regardless of how well-written the content is.

Ofsted (schools)

Ofsted expects statutory policies to be current and accessible. The governing body must approve them, and certain policies must be published on the school website. Inspectors follow threads — they ask about safeguarding procedures and then check whether the safeguarding policy matches what staff describe.

Schools with poor document control often discover during inspection that their published website policies are outdated versions while the current version sits in a folder only the head teacher can access.

Charity Commission

The Charity Governance Code expects trustees to maintain oversight of policies. Outdated or unapproved policies are evidence of weak governance — and in serious cases, the Charity Commission can open a regulatory compliance case.

Internal and external audit (councils)

Parish and town councils are subject to annual audit. Auditors check that standing orders, financial regulations, and governance policies are current and have been formally adopted. An outdated financial regulation is an audit finding that appears in the annual report.

What Goes Wrong Without Document Control

Version confusion. Multiple copies of the same policy in different locations, with different dates. Staff follow the wrong version. Inspectors find contradictions between the version on the website and the version in the policy folder.

Missed reviews. Without a review schedule, policies silently expire. A policy due for annual review in September 2024 is still the "current" version in March 2026. Nobody noticed because nobody was tracking it.

No approval evidence. The policy was reviewed — someone updated it, saved it, and moved on. But there is no record of who approved the updated version. When an inspector asks, the answer is "I think the governing body discussed it," which is not evidence.

Orphaned policies. The person who owned a policy leaves the organisation. Nobody inherits it. The policy drifts, unreviewed, for years.

Inconsistency across sites. MATs, GP practice groups, and multi-site charities often have different versions of the same policy at different locations. Without central document control, consistency is impossible.

The Five Pillars of Document Control

Effective document control for a regulated organisation covers five areas:

1. Version Management

Every policy has a version number, a date, and a clear indicator of which version is current. Previous versions are archived, not deleted — regulators may need to see what a policy said at a specific point in time.

2. Approval Records

Every policy has a formal approval — who approved it, when, and which version. For schools, this means governing body minutes. For GP practices, partner or practice manager sign-off. For charities, trustee approval.

3. Review Scheduling

Every policy has a defined review frequency and a scheduled next review date. Someone is responsible for each policy, and reminders go out before the deadline.

4. Distribution and Access

Staff know where to find current policies and can access them when needed. For critical policies like safeguarding and data protection, there is evidence that staff have read and understood them.

5. Audit Trail

Every action on a policy — creation, review, approval, distribution — is recorded. This is what you show an inspector, auditor, or governing body to prove your document control works.

Practical Steps to Improve Document Control

For organisations currently using shared drives

1. Audit your policy folder. List every policy document, its date, and its owner. Delete or archive duplicates, drafts, and superseded versions.
2. Create a policy register. Use our free Policy Register Template to build a structured register with owners, review dates, and version numbers.
3. Set review dates. Use our Policy Review Schedule Generator to calculate review dates and export them to your calendar.
4. Establish naming conventions. "Safeguarding Policy v3.0 - Approved 2026-01-15" is findable. "safeguarding policy FINAL (2).docx" is not.
5. Record approvals separately. Do not rely on document footers — maintain a register or minutes that record approval dates and approvers.

For organisations ready to move beyond spreadsheets

A purpose-built policy management system automates version control, reminders, approvals, and audit trails. For an overview of what to look for, see our buyer's guide to policy management software.

Document Control is Not a Filing Task

The most common mistake is treating document control as administration — something the office manager does when they have time. In reality, document control is a governance function. It is how you prove to your regulator that your organisation is well-managed, that your policies are current, and that your staff follow documented procedures.

For organisations subject to CQC, Ofsted, Charity Commission, or audit scrutiny, document control is not optional. It is the evidence base for your governance. If you are new to the discipline, our document controlling guide for compliance officers sets out the practical steps.

PolicyBoard is designed to automate the document control functions that matter most for regulated UK organisations — version tracking, automated review reminders, approval workflows, and a compliance dashboard. Join the waitlist to be notified when it launches.

This article covers general principles of document control for UK regulated organisations. It is not legal advice.

Then someone asks: "Which policies are due for review this quarter?" And the answer is: open every policy document, check the footer, and add the dates to a spreadsheet. That is the moment SharePoint stops being a policy management system and starts being a filing cabinet with better search.

What SharePoint Does Well

Credit where it is due — SharePoint handles several parts of policy management effectively:

• Document storage and version control — every edit is tracked, previous versions are accessible, and you can see who changed what
• Permissions — granular access controls mean the right people can edit and the right people can only view
• Search — staff can find policies by keyword (assuming they are named sensibly)
• Co-authoring — multiple people can work on a policy draft simultaneously
• Familiarity — most organisations with Microsoft 365 already have SharePoint, so there is no new tool to learn

If your only requirement is "store policy documents where staff can find them," SharePoint does the job. The problems start when you need to actively manage the review cycle.

Where SharePoint Falls Short for Policy Management

No Automated Review Reminders

SharePoint does not know when a policy is due for review. You can add a "Next Review Date" column to a document library, but SharePoint will not email the policy owner 90 days before that date arrives. Someone has to check the library, compare dates, and send reminders manually.

For a school with 80+ statutory policies or a GP practice with 40+ clinical and governance policies, that manual check is a job in itself. And it is the job that gets deprioritised when inspection prep, staffing issues, or daily operations take over.

No Approval Workflow (Without Significant Setup)

SharePoint has approval features, but configuring them for policy-specific workflows — route to the governing body for statutory policies, to the practice manager for clinical policies, to the data protection officer for GDPR policies — requires Power Automate flows, custom columns, and ongoing maintenance.

Most small organisations do not have the IT capacity to build and maintain these workflows. The result: policies are reviewed informally, approvals are verbal or via email, and there is no audit trail when an inspector asks "who approved this policy, and when?"

No Compliance Dashboard

There is no built-in way to see a traffic-light view of your entire policy portfolio. You cannot open SharePoint and immediately see: 8 policies are current, 3 are due for review within 30 days, and 2 are overdue.

You can build a dashboard using SharePoint lists, calculated columns, and conditional formatting — but it requires technical knowledge, maintenance, and breaks when someone edits the list structure.

No Sector-Specific Structure

SharePoint is a general-purpose platform. It does not know that your school needs 25 statutory policies for Ofsted, or that your GP practice needs specific policies for CQC Regulation 17. You have to build that structure yourself — and keep it updated when regulatory requirements change.

The Microsoft 365 Dependency

SharePoint requires Microsoft 365 infrastructure. Many small organisations — parish councils, small charities, independent schools — do not use Microsoft 365. They use Google Workspace, or a mix of platforms, or minimal IT infrastructure. For these organisations, SharePoint is not an option at all.

The Real Cost of SharePoint Policy Management

The licence cost is not the problem. Most organisations already pay for Microsoft 365. The real cost is time:

• Setup time — building document libraries, metadata columns, views, and (if ambitious) Power Automate flows
• Maintenance time — fixing broken views, updating metadata schemas, troubleshooting permission issues
• Manual tracking time — checking review dates, chasing policy owners, compiling reports for governors or inspectors
• Training time — teaching staff where to find policies, how to use metadata, and why they should not save policies to their desktop

For a school business manager who spends 2-3 hours per week on policy administration, the question is not "can SharePoint do this?" but "is SharePoint the most efficient way to do this?"

What to Look for Instead

A purpose-built policy management tool replaces the manual tracking, ad-hoc workflows, and spreadsheet dashboards with a system designed for the job. The features that matter for small UK organisations are:

1. Policy register with custom review frequencies per policy — not a document library you have to configure yourself
2. Automated email reminders — 90, 60, and 30 days before review, sent to the policy owner without anyone having to check
3. Approval workflow — route to the right approver based on policy type, with timestamped records
4. Compliance dashboard — traffic-light status across your entire policy portfolio, visible in seconds
5. Audit trail — every review, approval, and edit recorded for inspectors and auditors
6. No infrastructure dependency — works in a browser, no Microsoft 365 required

The key difference: a policy management tool is active. It chases people, flags problems, and generates reports. SharePoint is passive — it holds documents and waits for someone to check them.

When SharePoint is Still the Right Choice

SharePoint remains appropriate if:

• Your organisation has fewer than 20 policies and a single person manages them
• You have IT capacity to build and maintain Power Automate workflows
• Your staff are already trained on SharePoint and comfortable using it for policy access
• You are not subject to regulatory inspection (no CQC, Ofsted, or audit requirements)

For larger policy portfolios, multi-site organisations, or any organisation where an inspector will ask "show me your policy governance" — a dedicated tool will save more time than it costs.

Next Steps

1. How often should policies be reviewed? — review frequencies by regulator
2. What to look for in policy management software — evaluation criteria for small UK organisations
3. What compliance teams need from a policy tracking tool — a practical breakdown of tracking requirements
4. Try the Policy Review Schedule Generator — calculate your review dates and export to calendar

PolicyBoard is designed for UK schools, GP practices, charities, and councils that have outgrown SharePoint for policy management. Automated reminders, approval workflows, and compliance dashboards — no Microsoft 365 required. Join the waitlist to be notified when it launches.

This article discusses general approaches to policy management. It is not an endorsement or criticism of any specific platform.

If the answer involves opening 40 Word documents to check footer dates, you already have a problem. This guide maps the policies CQC inspectors expect to find at GP practices, explains how they connect to Regulation 17 (Good Governance), and sets out a practical framework for keeping them current.

Scope: This article focuses on GP practices and primary care. CQC also regulates dentists, pharmacies, hospitals, and care homes — each has sector-specific requirements. Care home policy requirements are not covered here. If you run an education setting rather than a healthcare one, see our guide to statutory policies for schools for the equivalent list.

How CQC Inspections Work in Primary Care

CQC assesses GP practices against five key questions:

1. Safe — Are patients protected from abuse and avoidable harm?
2. Effective — Does care achieve good outcomes?
3. Caring — Do staff treat patients with compassion?
4. Responsive — Are services organised to meet patients' needs?
5. Well-led — Does leadership ensure high-quality, sustainable care?

Your policies sit under Well-led (governance and management) but evidence from those policies feeds into every other question. A safeguarding policy evidences "Safe." A complaints policy evidences "Responsive." An outdated infection control policy undermines "Safe" and "Effective" simultaneously.

Inspectors do not typically ask for a policy index and tick them off a list. Instead, they follow threads. They ask a receptionist: "What happens if a patient discloses abuse?" If the receptionist describes a process that matches the safeguarding policy, and that policy has been reviewed within the last year, and there is evidence staff were trained on it — that is good governance in action. If the policy says one thing and the receptionist describes something different, that is a Regulation 17 concern.

The Policies CQC Expects to See

There is no single definitive CQC list of required policies for GP practices. Instead, the expectation flows from the regulations themselves. Based on the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and published CQC inspection guidance, these are the policies inspectors expect to be in place:

Safeguarding (Regulation 13)

• Safeguarding adults policy — referral pathways, designated safeguarding lead, training requirements
• Safeguarding children policy — aligned with local safeguarding partnership procedures, including FGM and Prevent
• Chaperone policy — when chaperones are offered, how they are trained, and DBS check requirements
• Mental Capacity Act and Deprivation of Liberty Safeguards policy — staff understanding of MCA assessments

Review frequency: At least annually. Review immediately if local safeguarding procedures change or following any safeguarding incident.

Infection Prevention and Control (Regulation 12)

• Infection prevention and control (IPC) policy — hand hygiene, PPE, sharps disposal, decontamination of equipment
• Cleaning schedules — documented schedules with evidence of completion

Review frequency: At least annually. Review immediately after any infection outbreak or change to IPC guidance.

Medicines Management (Regulation 12)

• Prescribing policy — including repeat prescribing, high-risk drugs, and controlled drugs
• Medicines storage and security policy — fridge temperature monitoring, controlled drugs registers, access controls
• Vaccine management policy — cold chain management, fridge failure protocols

Review frequency: At least annually. Review if prescribing guidance changes or after medication incidents.

Staffing and Recruitment (Regulation 19)

• Recruitment policy — pre-employment checks (DBS, references, qualifications, right to work), locum procedures
• Induction policy — what new staff and locums must complete before seeing patients
• Training and development policy — mandatory training requirements, CPD tracking

Review frequency: At least annually. Review if recruitment legislation or DBS requirements change.

Information Governance (Regulation 17)

• Data protection and confidentiality policy — aligned with UK GDPR and Data Protection Act 2018
• Information security policy — password management, device security, remote access
• Subject access request procedure — how patients access their records
• Data breach response plan — notification procedures, ICO reporting thresholds

Review frequency: At least annually. Review immediately after any data breach or ICO guidance update.

Complaints and Feedback (Regulation 16)

• Complaints policy — aligned with the NHS complaints procedure, including timescales for acknowledgement and response
• Significant event analysis (SEA) policy — how the practice investigates incidents and near-misses, and what actions follow
• Duty of candour policy — the legal requirement to be open with patients when things go wrong (Regulation 20)

Review frequency: At least annually. Review after significant complaints or changes to NHS complaints framework.

Health and Safety

• Health and safety policy — risk assessments, fire safety, COSHH, lone working
• Business continuity plan — what happens if systems fail, premises are inaccessible, or key staff are unavailable
• Emergency drugs and equipment policy — what emergency equipment is held, where, and how it is checked

Review frequency: At least annually. Review after incidents, premises changes, or new risk assessments.

Clinical Governance

• Clinical audit policy — how the practice conducts and acts on clinical audits
• Consent policy — how consent is obtained, documented, and reviewed for different procedures

Review frequency: At least annually.

What Regulation 17 Specifically Requires

Regulation 17 does not list individual policies. It requires systems and processes that ensure compliance with all other regulations. In practice, this means:

1. Records must be "accurate, complete and contemporaneous" — your policies are records. An undated or unsigned policy does not meet this standard.
2. Systems must assess, monitor and improve quality — you need to show that policy review is part of a systematic governance cycle, not an annual panic.
3. Risks must be identified and mitigated — your policies should reflect current risks. If your practice started offering minor surgery last year but the clinical governance policy still only covers standard consultations, that is a gap.
4. Feedback must be sought and acted on — policy changes should be traceable to feedback, incidents, or audit findings.

Inspectors may ask:

• "How do you know which policies are due for review?"
• "Who is responsible for each policy?"
• "How do you ensure staff are aware of policy changes?"
• "Can you show me the approval record for this policy?"

If your answer to the first question is "we check the spreadsheet" or "the practice manager keeps track," the follow-up will test whether that system actually works.

Common Findings in GP Practice Inspections

Based on published CQC inspection reports, these are recurring policy-related issues:

Policies not reviewed within stated timeframes. The policy footer says "review annually" but the last review date is two years ago. This directly contradicts the practice's own governance standards.

Policies that do not reflect current practice. The infection control policy references procedures that predate the practice's refurbishment. The safeguarding policy lists a named lead who left 18 months ago.

No evidence of policy approval. The policy exists but there is no record of who approved it or when. Governing body minutes do not reference policy review.

Staff unaware of policy content. The policy is comprehensive but staff cannot describe the procedure it sets out. This suggests distribution and training are not working.

No systematic oversight. There is no schedule, no register, and no way to tell which policies are current and which are overdue. The practice relies on individuals remembering to check.

A Practical Framework for CQC Readiness

Step 1: Build Your Policy Register

List every policy the practice has. For each one, record:

• Policy name and category (safeguarding, IPC, governance, etc.)
• Current version date
• Policy owner (who is responsible for reviewing it)
• Review frequency
• Next review date
• Status (current, due soon, overdue)

Step 2: Map Policies to Regulations

Cross-reference your policy list against the categories above. Identify gaps — do you have a data breach response plan? A duty of candour policy? A locum induction procedure?

Step 3: Set Review Reminders

For each policy, set reminders 90, 60, and 30 days before the review date. Assign the reminder to the policy owner, not a generic practice inbox. Our Policy Review Schedule Generator can calculate your review dates and export them to your calendar. To check your overall coverage against what CQC inspectors expect, try our free CQC Compliance Policy Checker — it scores your coverage across all 24 policy categories and maps gaps to the five key questions.

Step 4: Document Approvals

Every policy review should produce a dated record: who reviewed it, what changed (if anything), who approved the updated version. Store this centrally — not in the document footer.

Step 5: Make Policies Accessible

Staff need to find and read policies quickly. A shared drive with 200 files in one folder is not accessible. Organise by category, label clearly, and ensure every team member knows where to look.

If you are evaluating systems to manage this process, see our guide to policy management software for evaluation criteria.

Connecting Policies to Your Wider Governance

Policy management is one part of your governance framework. It connects to:

• Clinical audit — audit findings should trigger policy reviews
• Significant event analysis — SEA outcomes should feed into policy updates
• Staff training — policy changes should trigger training updates
• Patient feedback — complaints and survey results should inform policy improvements

A well-managed policy register sits at the centre of this system. It is not a filing task — it is how you prove to CQC that your practice is well-led.

For a wider view of how each policy moves through creation, approval, distribution, review, and retirement, see our guide to policy lifecycle management.

PolicyBoard is designed to automate the policy register, review reminders, approval workflows, and compliance dashboard that CQC expects to see. Join the waitlist to be notified when it launches.

Sources

• CQC Regulation 17: Good Governance
• CQC: How We Monitor GP Practices
• BMA: How to Prepare for a CQC Inspection

This article covers CQC policy requirements for GP practices in England. It is not legal or clinical advice. Always refer to the latest CQC guidance and consult your professional advisors.

This guide is different. It covers the features that actually matter for small-to-mid UK regulated organisations — schools, GP practices, charities, and councils — and the features that sound impressive but add nothing at your scale.

The 7 Features That Matter

1. Policy Register with Review Dates

The single most important feature. A central list of every policy, who owns it, when it was last reviewed, and when the next review is due. Without this, everything else is decoration.

What to look for:

• Custom review frequencies per policy (safeguarding policies need different cycles to expenses policies)
• Category grouping by policy type or regulator (CQC, Ofsted, Charity Commission, H&S, GDPR)
• Status indicators — at a glance, which policies are current, due soon, or overdue
• Multi-site support if you are a MAT, GP practice group, or charity with branches

What to avoid: systems that force a single review frequency across all policies. Your safeguarding policy and your staff uniform policy do not have the same risk profile.

2. Automated Reminders

The reason spreadsheets fail. If the system does not actively chase policy owners before review deadlines, you are relying on someone remembering to check a spreadsheet every week. They will not.

What to look for:

• Email reminders at 90, 60, and 30 days before review date (configurable)
• Escalation to a line manager or governance lead if the deadline passes
• Reminders sent to the policy owner, not a generic inbox nobody checks

Review frequency varies by regulator, so reminders need to support different cycles for different policies. If you need a starting point, the policy review template framework covers how to categorise policies by review frequency and set up a rolling calendar. The test: if your practice manager is on leave for two weeks, will overdue policies still get flagged? If the answer is no, the reminder system is not robust enough.

3. Approval Workflow

When a policy is reviewed and updated, someone needs to formally approve the new version. For schools, that is the governing body. For charities, the trustees. For GP practices, the partners or practice manager.

What to look for:

• Configurable approval routes (different policies go to different approvers)
• Timestamped approval records — who approved, when, which version
• The ability to reject and return for revision with comments

Why it matters: CQC inspectors and Ofsted will ask who approved a policy and when. "I think the head teacher looked at it" is not an adequate answer. A timestamped audit trail is.

4. Compliance Dashboard

A visual overview showing the health of your policy portfolio. This is what you show inspectors, auditors, and governors to demonstrate that governance is under control.

What to look for:

• Traffic-light status (green / amber / red) across all policies
• Filterable by category, owner, site, or regulator
• Exportable reports for board meetings, inspections, and audits

What separates useful from useless: a dashboard that shows 100% green because it only tracks the 20 policies someone remembered to add is worse than no dashboard at all. The system needs to make it easy to capture your complete policy portfolio.

5. Audit Trail

Every action on every policy — creation, edits, approval, review — recorded with a timestamp and user name. This is not about catching people out. It is about proving to your regulator that your governance processes work.

Specific scenarios where the audit trail saves you:

• CQC asks when your infection control policy was last reviewed and who approved it
• Ofsted queries when your safeguarding policy was updated after the latest KCSIE guidance
• Your internal auditor needs evidence that financial policies were reviewed before year-end
• A trustee disputes whether they approved a particular policy

6. Version Control

When you update a policy, the previous version should be preserved — not overwritten. Regulators sometimes need to see what a policy said at a specific point in time, particularly during investigations.

What to look for:

• Automatic versioning on every save or approval
• The ability to view and compare previous versions
• Clear labelling of the current active version vs. archived versions

7. Export and Reporting

You need to get data out of the system — for board reports, inspection prep, and audit evidence.

What to look for:

• PDF or spreadsheet export of policy status, review history, and compliance reports
• Formatted reports suitable for presenting to governors, trustees, or auditors
• The ability to generate an evidence pack for a specific inspection or audit

Features That Sound Good but Don't Matter at Your Scale

AI policy drafting. Several enterprise tools now offer AI-generated policy templates. For a 200-person school or a GP practice, this adds cost without adding value. You already have your policies — you need help managing them, not writing new ones from scratch.

Employee attestation with e-signatures. Enterprise compliance tools track whether every employee has read and signed every policy. If you have 50 staff and a termly staff meeting where you cover key policies, a six-figure attestation module is overkill.

Integration with GRC (Governance, Risk, and Compliance) platforms. If you are a school, charity, or GP practice, you do not have a GRC platform. Integrations with tools you do not use add complexity without benefit.

Custom branding and white-labelling. Useful for consultancies selling policy management as a service. Irrelevant for an organisation managing its own policies.

The Pricing Reality for Small Organisations

Enterprise policy management tools can cost thousands of pounds per year. That pricing model assumes a large procurement team, a lengthy sales cycle, and an organisation with hundreds or thousands of employees.

For a school, GP practice, small charity, or parish council, the maths does not work. You need a tool that:

• Costs less per month than a few hours of admin time saved
• Does not require a procurement process or board approval for the budget
• Can be set up in hours, not months
• Charges by organisation, not per-user (otherwise multi-site costs spiral)

The buyer at these organisations is not a CTO or a VP of Compliance. It is a school business manager, a practice manager, or a governance officer who can expense a modest monthly subscription without a purchase order. The tool needs to match that buying process.

A Practical Evaluation Checklist

Before committing to any policy management tool, run through these questions:

1. Can I import my existing policy list? If the first step is manually re-entering 100+ policies, the migration cost may outweigh the benefit.
2. Does it send reminders automatically? Not "can it" — does it, by default, without configuration?
3. Can I see a dashboard within 10 minutes of setup? If the tool requires a week of configuration before it is useful, that is a week you will not have during inspection prep.
4. Does it handle different review frequencies? Your safeguarding policy and your social media policy are not on the same cycle.
5. Can I export an inspection-ready report? If you cannot pull a compliance summary for CQC, Ofsted, or your auditor in under five minutes, the tool is not solving your actual problem.
6. What happens if I cancel? Can you export your data, or are your policies locked inside a proprietary platform?
7. Is pricing transparent? If the website says "contact sales," the price is probably designed for organisations 10 times your size.

How PolicyBoard Fits

PolicyBoard is designed specifically for small-to-mid UK regulated organisations. Policy register with custom review cycles, automated email reminders, approval workflow, compliance dashboard, audit trail, and inspection-ready exports — at a price point a school business manager can approve without a committee.

If you are buying for a council, MAT, or charity with multiple sites, see our specific guidance on corporate policy management software — the same evaluation criteria, applied at small-organisation scale rather than enterprise.

If you also need to manage the policy documents themselves — versions, attachments, file storage — read our companion guide on what small UK organisations actually need from a policy document management system. And if your organisation tracks procedures alongside policies, our guide on policy and procedure management software covers what to look for when one tool needs to handle both.

Join the waitlist to be notified when PolicyBoard launches.

Sources

• CQC Regulation 17: Good Governance
• DfE: Keeping Children Safe in Education
• Charity Governance Code

This guide helps UK organisations evaluate policy management tools. It is not a product comparison or endorsement of specific vendors.

That is policy management, done badly. Here is what it looks like done properly.

Policy Management in 30 Seconds

Policy management is the process of creating, approving, distributing, reviewing, and retiring the policies your organisation needs to operate legally and effectively.

For UK regulated organisations — schools inspected by Ofsted, GP practices regulated by CQC Regulation 17, charities governed under the Charity Governance Code, and councils subject to audit — policy management is not optional. Your regulator expects you to have current, approved policies that staff can find and follow.

The word "management" is doing the heavy lifting. Having policies is easy. Keeping them current, getting them approved, proving staff have read them, and knowing which ones expire next month — that is the management part, and it is where most organisations struggle.

What Policy Management Actually Covers

Policy management has five stages. Most organisations handle the first two and neglect the rest.

1. Creation

Someone drafts a new policy — usually because a regulator requires it, legislation changes, or an incident exposed a gap. At this stage, the key question is: does this policy already exist somewhere else in the organisation? Duplicate policies with conflicting content are common, especially in multi-site organisations like MATs (multi-academy trusts) or GP practice groups.

2. Approval

The draft needs sign-off from the right people — a governing body, a board of trustees, a practice manager, or a line manager depending on the policy type. The approval workflow matters because your regulator may ask: who approved this, and when?

For schools, the governing body formally approves statutory policies. For charities, trustees are responsible. For GP practices, the practice manager or partners sign off. Without a clear approval trail, an inspector has no evidence the policy was properly authorised.

3. Distribution

Approved policies need to reach the people who follow them. A safeguarding policy locked in the head teacher's office is useless. Staff need to know where to find current policies, and for critical policies (safeguarding, data protection, health and safety), they need to confirm they have read and understood them.

4. Review

Every policy has a shelf life. Legislation changes, your services change, and what was accurate two years ago may be wrong today. How often you review depends on your regulator — but annual review is the practical minimum for most policies, with safeguarding and high-risk policies reviewed more frequently.

This is where manual tracking breaks. When review dates are stored in document footers, spreadsheet cells, or someone's memory, things get missed. A policy that was due for review six months ago will not remind you — it just sits there, quietly out of date, until an inspector asks to see it.

5. Retirement

Policies that are no longer needed should be formally retired — not just deleted. You may need to demonstrate to an auditor that a previous policy existed and when it was superseded. A clear archive with dates prevents confusion.

Why Manual Policy Tracking Fails

Most organisations under 500 staff track policies using one of these methods:

Spreadsheets. A shared Excel file or Google Sheet with columns for policy name, owner, review date, and status. This works until someone forgets to update the spreadsheet after reviewing a policy, or two people edit conflicting copies, or the spreadsheet grows to 200 rows and nobody checks the review dates anymore.

SharePoint or shared drives. Policies live in a folder structure. Review dates are either in the document footer, in the filename ("Safeguarding Policy v3 May 2024"), or nowhere. Version history exists but nobody checks it. Finding the current version of a specific policy means opening the folder and hoping you pick the right file.

Document footers. The review date is printed at the bottom of the policy PDF. This means someone has to open every document to check whether it is due for review. For 100+ policies, that is hours of work — so it does not happen.

Filing cabinets. Still common in small GP practices and parish councils. Policies are printed, signed, and filed. There is no search function, no version control, and no reminders. When an inspector asks for a specific policy, someone rummages through a cabinet.

All of these methods share the same weakness: they are passive. None of them tell you when something needs attention. The burden falls on a person — usually a school business manager, practice manager, or governance officer — to remember to check, chase, and follow up. That person is also doing their actual job.

What a Policy Management System Does

A purpose-built policy management system replaces the spreadsheet with something that actively manages the review cycle. The core features:

• Policy register — a central list of every policy, its owner, category, review frequency, and current status (try our free Policy Register Template to get started)
• Automated reminders — email notifications 90, 60, and 30 days before a policy review is due
• Approval workflow — route policies to the right approver (governing body, trustees, management team) and record their sign-off with a timestamp
• Compliance dashboard — a traffic-light view showing which policies are current (green), due for review soon (amber), or overdue (red)
• Audit trail — a complete history of who reviewed, approved, and updated each policy, and when
• Version control — previous versions are preserved and accessible, not overwritten
• Export — generate a compliance report for inspectors, auditors, or governors showing the status of every policy

The value is not in storing documents — you can store documents anywhere. The value is in the active tracking: reminders that go out automatically, dashboards that show problems before an inspector finds them, and an audit trail that proves your governance is current.

When Does Manual Tracking Stop Working?

There is no magic number, but common tipping points:

• 20+ policies — too many to track reliably in someone's head
• Multiple policy owners — coordination becomes difficult without a shared system
• Multi-site organisations — MATs, GP practice groups, and charity branches need consistency across sites
• Inspection preparation — pulling together evidence for CQC, Ofsted, or audit becomes time-consuming without a central register
• Staff turnover — when the person who "knew where everything was" leaves, institutional knowledge goes with them

If you recognise any of these, your current approach is probably costing you more time than it saves. For organisations that overlap with quality-management or ISO-adjacent obligations (councils, larger charities), our document control guide covers the same problem from the documentation-control perspective.

Next Steps

1. Read our guide to policy review frequencies to understand what your regulator expects.
2. Audit your current policies — how many do you have, and when was each last reviewed? Our step-by-step guide on how to build a policy register walks through the columns and categories you need.
3. Identify your biggest risk — which policies would cause the most damage if found to be out of date during an inspection?

PolicyBoard is designed for exactly this problem — automated review reminders, approval workflows, and a compliance dashboard for UK schools, GP practices, councils, and charities. Join the waitlist to be notified when it launches.

This article is a general guide to policy management for UK organisations. It is not legal advice.

This guide covers the actual review requirements for CQC-regulated GP practices, Ofsted-inspected schools, Charity Commission-registered charities, and local councils, with direct references to the regulations that apply to each. No generic advice — just the rules, the frequencies, and a practical framework for keeping on top of them.

The Short Answer: It Depends on Your Regulator

There is no single UK law that says "review all policies every 12 months." The review frequency depends on which regulatory framework your organisation operates under, the type of policy, and how your operating environment changes.

Here is how it breaks down:

The common thread: annual review is the practical minimum for most policies, but certain categories need more frequent attention, and any significant change to your organisation should trigger an immediate review regardless of schedule.

CQC-Regulated Organisations: What Regulation 17 Actually Requires

If you run a GP practice, dental practice, or other CQC-registered service, Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is the relevant provision.

Regulation 17 does not specify a calendar frequency. Instead, it requires providers to:

• Assess, monitor and improve the quality and safety of services through regular audits
• Maintain records that are "complete, legible, indelible, accurate and up to date"
• Identify risks to health, safety, and welfare, and implement proportionate mitigation
• Respond to findings without delay — waiting until an annual review date does not satisfy this requirement

In practice, CQC inspectors check whether your policies reflect your current operations. A policy written in 2022 that references pre-pandemic procedures will raise questions. The standard is currency, not a specific interval.

What this means for your review schedule: Set an annual review cycle as a baseline, but build in triggered reviews whenever your services, staffing, or clinical protocols change. CQC inspectors will look at the date on your policies, but more importantly they will check whether the content matches what they observe during inspection.

For a detailed breakdown of the policies CQC inspectors expect to see, read our CQC policy requirements guide.

High-priority policies for GP practices:

• Safeguarding (adults and children)
• Infection prevention and control
• Medicines management
• Complaints procedure
• Information governance and data protection
• Health and safety
• Staff recruitment and training

For a structured assessment of your coverage against the full CQC policy expectation, try our free CQC Compliance Policy Checker — it scores you across 24 policy categories and maps gaps to CQC's five key questions.

Ofsted-Inspected Schools: Statutory Policies and Review Cycles

Schools face a specific obligation: certain policies are statutory — meaning the school must have them by law. Ofsted inspectors confirm these are in place, current, and followed.

The DfE's governance guide for maintained schools and academy trust governance framework set out which policies schools and trusts must publish. Safeguarding is the area where currency is most heavily scrutinised.

Annual review (minimum) — these policies should be reviewed at least once per year:

• Child protection and safeguarding policy (many schools review termly)
• Behaviour policy
• SEND (Special Educational Needs and Disabilities) policy
• Complaints procedure
• Admissions policy (for admission authorities)
• Pay policy

Review when legislation changes:

• Relationships, Sex and Health Education (RSHE) policy — check the latest DfE RSHE guidance for current requirements and implementation dates
• Data protection policy — review whenever data processing activities change

Review when circumstances change:

• Accessibility plan — when building modifications or new SEND needs arise
• Health and safety policy — after incidents or changes to premises

Safeguarding deserves special attention. The DfE's Keeping Children Safe in Education guidance is updated regularly. When a new version is published, your safeguarding policy needs reviewing against the updated requirements — not at the next scheduled annual review, but immediately.

Governing bodies are ultimately responsible for ensuring statutory policies are in place and reviewed. In practice, school business managers often maintain the review schedule, chasing policy owners for sign-off before deadlines. Our Ofsted Statutory Policies Checklist lists every statutory policy schools need to have in place, and our full guide to statutory policies for schools explains which ones are required, which must be on the website, and how often each must be reviewed.

Charities: The Governance Code and Trustee Obligations

For Charity Commission-registered organisations, the Charity Governance Code is the primary best-practice framework. Compliance is voluntary (the code operates on an "apply or explain" basis), but the Charity Commission expects trustees to demonstrate good governance.

The code recommends:

• Full governance review every three years — covering board effectiveness, policies, and procedures
• Annual review of key policies by trustees — including safeguarding, conflicts of interest, reserves, and risk management
• Continuous monitoring — policies should be updated whenever the charity starts new activities, changes its operating model, or faces new legal requirements

Beyond the code, certain policies are mandatory under general UK law:

• Safeguarding policy — required if working with children or vulnerable adults (Charity Commission safeguarding guidance)
• Health and safety policy — written policy required for organisations with 5 or more employees
• Data protection policy — required under UK GDPR if processing personal data
• Equality and diversity policy — Equality Act 2010 obligations apply

The Charity Commission's essential trustee guidance (CC3) makes clear that trustees have a duty to ensure their charity is well run. Outdated policies are evidence of poor governance — and in serious cases, the Commission can intervene.

Local Councils: Audit and Governance Obligations

Small parish, town, and district councils face governance obligations through the Governance and Accountability for Smaller Authorities framework (published by the Smaller Authorities Proper Practices Panel) and their internal audit requirements.

Key review points:

• Standing orders and financial regulations — review annually, typically at the annual council meeting
• Risk management policy — review annually as part of the Annual Governance and Accountability Return (AGAR)
• Data protection policy — review annually
• Health and safety policy — review annually
• Code of conduct — review when local government standards guidance changes
• Complaints procedure — review annually

Internal auditors will check that policies are current as part of the annual audit cycle. The external auditor (appointed by Smaller Authorities' Audit Appointments Ltd) expects evidence that the council has reviewed its governance arrangements.

Building a Practical Review Schedule

Rather than reviewing all 150 policies in January, spread the workload across the year. Here is a framework — for a ready-to-use structure, see our practical policy review template which covers the full process from categorisation to sign-off:

Step 1: Categorise by Review Frequency

Step 2: Stagger Reviews Across the Year

Assign each policy a review month based on its category and natural timing:

• September — safeguarding and child protection (aligns with new school year and DfE guidance updates)
• October-November — operational policies (before winter term)
• January — financial policies (before year-end)
• March-April — data protection (aligns with ICO review cycles)
• May-June — governance policies (before AGM or annual council meeting)

Step 3: Set Up Triggered Reviews

Calendar-based reviews are not enough on their own. Build in triggers:

• Incident trigger — any safeguarding incident, data breach, or workplace accident triggers immediate review of the relevant policy
• Legislation trigger — new or amended legislation triggers review of affected policies within 30 days
• Organisational change trigger — new services, restructuring, or premises changes trigger review of operational policies
• Staff change trigger — new policy owners should review their inherited policies within their first month

Step 4: Track It

A review schedule only works if someone tracks it. Spreadsheets break down at scale — review dates get missed, version history is unclear, and there is no audit trail showing who approved what.

If you are evaluating tools, our guide to policy management software covers the features that matter for small UK organisations.

A policy register — even a simple spreadsheet — gives you a single view of every policy with its review date, owner, and approval status. This is what inspectors ask for, and building it before an inspection is announced means it is accurate rather than assembled under pressure.

At minimum, your tracking system needs:

• Each policy's review date and review frequency
• The policy owner responsible for the review
• A clear approval workflow (who reviews, who approves)
• Automated reminders before review dates
• An audit trail for inspections (when was it reviewed, by whom, what changed)

What Happens When Policies Expire

The consequences of an expired policy depend on which regulator finds it:

CQC: An outdated policy contributes to a finding of inadequate governance under Regulation 17. In serious cases, this can lead to enforcement action, requirement notices, or conditions on registration. CQC inspection reports are public — a governance failure is visible to patients, commissioners, and the public.

Ofsted: Missing or outdated statutory policies will be noted in the inspection report. For safeguarding policies specifically, an out-of-date policy can contribute to a "safeguarding is not effective" judgement — one of the most serious findings a school can receive.

Charity Commission: Failure to maintain adequate governance can lead to the Commission opening a regulatory compliance case. In serious cases, trustees can be suspended or removed. The Commission's annual return asks whether the charity has reviewed its governing document — a "no" answer invites scrutiny.

Internal/external audit: For councils and other audited bodies, an expired policy is a governance weakness that will appear in the audit report. Persistent issues can lead to a qualified audit opinion.

A Sector-by-Sector Summary

Next Steps

1. Audit your current policies — list every policy, its last review date, and its owner. Identify anything overdue. Not sure where to start? Read our guide to what policy management covers.
2. Map to your regulator's requirements — use the sector-specific guidance above to set the right frequency for each policy.
3. Stagger your review calendar — spread reviews across the year so they are manageable alongside day-to-day work.
4. Set up reminders — at minimum, calendar alerts 90, 60, and 30 days before each review date.
5. Document your reviews — keep an audit trail showing when each policy was reviewed, by whom, and what changed. This is what inspectors look for.

Tracking policy review dates in spreadsheets works for small portfolios, but once you have 50 or more policies across multiple categories, a purpose-built system saves hours and removes the risk of something slipping through. Try our free Policy Review Schedule Generator to calculate your review dates, or explore all our free policy management tools. If your current setup is SharePoint plus a spreadsheet, see why organisations are moving beyond SharePoint for the limitations to watch for. PolicyBoard is designed to automate review reminders, approval workflows, and compliance dashboards for exactly this situation — join the waitlist to be notified when it launches.

Sources

• CQC Regulation 17: Good Governance
• DfE: Keeping Children Safe in Education
• DfE: Governance in Maintained Schools
• DfE: Academy Trust Governance
• Charity Governance Code
• Charity Commission: The Essential Trustee (CC3)
• Charity Commission: Safeguarding and Protecting People
• Smaller Authorities Proper Practices Panel (JPAG)

This article covers general guidance for UK regulated organisations. It is not legal advice. Always check the specific requirements of your regulator and seek professional advice where needed.