Policy Review and Approval Workflow

Why should we automate policy review instead of managing it by email and spreadsheets?

Manual policy review typically relies on scattered emails, shared drives and manual status tracking, which makes it hard to know what stage a policy is at or who is holding it up. This workflow creates a single record per policy with a reference number, status and timeline, so stakeholder review, legal review, revisions and approval are all visible in one place. It also reduces the administrative burden of chasing reviewers, since tasks carry their own deadlines and the record moves automatically once a task is completed.

What is the ROI of using this workflow for policy governance?

The main return is time saved by staff who no longer need to manually track policy versions, chase reviewers, or reconcile which draft is current. Because the workflow is template-based, a workspace can publish it and start running live policy reviews within minutes rather than commissioning a development project. Over time, the policy register table view and status dashboard also reduce the effort spent compiling reporting for audits or management reviews.

How does this compare to handling policy review manually?

Manually, a policy owner would need to individually email stakeholders and legal reviewers, track responses, and manually update a document or spreadsheet with status changes. This workflow automates those steps: it sets record status automatically at each stage, sends acknowledgement and outcome emails, and stores stakeholder and legal comments plus review results directly on the record. This reduces the chance of a policy stalling unnoticed and gives everyone involved a consistent, timestamped record of what happened.

Who is involved in reviewing and approving a policy in this workflow?

The policy owner submits the draft and revises it when changes are requested. Stakeholders complete a review task recording comments and a result, legal or compliance reviewers do the same when that review is required, and an approval authority makes the final approve or reject decision. A document controller then publishes the approved policy, recording the published date, superseded confirmation and next review date.

What happens if stakeholders or legal reviewers request changes?

If the stakeholder review result is 'Changes needed', the record status is set to In Revision and the policy owner is given a task to upload a revised draft within 5 days, which is then saved to the record and sent back into stakeholder review. The same pattern applies after legal or compliance review: the owner revises the draft for legal feedback, the revised draft is saved, and the policy returns to stakeholder review for another cycle. This looped structure allows multiple revision cycles until reviewers mark the draft ready.

Is legal or compliance review always required?

No — the workflow branches based on the 'Needs Legal or Compliance Review?' answer submitted with the policy request. If the answer is yes, the record status moves to Legal Review and a legal/compliance review task is created; if no, the policy proceeds directly toward approval authority review. This lets a workspace apply legal review only where it's actually needed, without adding extra steps to every policy.

What happens if the approval authority rejects the policy?

If the approval outcome is a rejection, the record status is set to Rejected and the policy owner is emailed to let them know the policy was not approved. The rejection and the review history leading up to it remain visible on the record's timeline, giving the owner and governance staff a clear reference for what was decided and why. This keeps a documented trail without requiring separate rejection tracking outside the record.

Can this workflow be customised to match our own policy approval process?

Yes, changes can be made either by describing the desired change in plain English or by editing steps directly in the workflow editor, and earlier versions of the workflow are kept. This means a workspace can adjust review deadlines, add extra revision cycles, or change what information is captured on tasks without needing a development project. Because it is template-based, these adjustments can be made after the workflow is already running live.

Do policy owners, stakeholders or legal reviewers need an account to take part?

Policy owners submit their initial request through a public request form and receive review, revision and outcome tasks by email without needing to create an account. Stakeholders and legal reviewers likewise interact with their review tasks through emailed forms. This keeps participation simple for people who are only occasionally involved in policy review.

How is the publication and next review date tracked once a policy is approved?

When the approval authority approves the policy, a document controller completes a publication task within 3 days, recording the published date, confirmation that the prior version was marked superseded, and the next review date. These values are saved to the policy record and the status is set to Published, after which the policy owner is emailed with the next review date. Each business should confirm that the fields recorded here meet its own internal record-keeping requirements.