Policies that are owned, current and actually read
Every standard asks for documented information under control. In practice that means someone owns each policy, it has been approved, it is the current version, the people it applies to have acknowledged it, and it connects to the controls it governs.
The failure mode auditors see most often
A folder of well-written policies, approved two years ago, referencing a job title nobody holds, acknowledged by half the people it applies to, and disconnected from the controls it describes. The words are fine. The governance around them is not — and that is what gets written up as a nonconformity.
What the platform does
Guided drafting with AI assistance
Versioning and approval history
Owners and review intervals
Acknowledgement campaigns
Linked to controls and standards
Audit-readiness checks
Where policies sit in the cycle
Policies describe intent; controls deliver it. Policy governance links back to risks, controls and evidence and forward to internal audit, which tests whether the policy is being followed rather than whether it exists.
Related: policy attestations · the policy management lifecycle guide
Answers buyers, procurement and auditors want
Is this just a document store?+
No. A document store holds files. Policy governance holds ownership, approval, version history, review dates, acknowledgement records and the link from each policy to the controls and standards it supports.
How does AI-assisted drafting work?+
Guided completion asks plain-English questions about how your organisation actually works, explains why an auditor asks for each answer, and drafts the wording. A human reviews and approves before anything is published.
How do we prove staff have read a policy?+
Policies are issued for acknowledgement to named people, chased automatically, and recorded with a timestamp — which is the evidence an auditor asks for.
Can we keep our own branding?+
Yes. Published policy documents and PDF exports carry your workspace branding.
What happens at review time?+
Each policy carries an owner and a review interval. When a review falls due the owner is reminded, the change is versioned, and the previous version stays in history.
See how your existing risks, controls and evidence could become one integrated management system
Bring your current policy set and see what is out of date, unowned or unacknowledged in a single pass.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.