Policy Governance

The Policy Governance domain (/governance) provides end-to-end management of corporate policies, institutional charters, standards, and procedures. It transforms policy documents from static text into structured, living GRC instruments that connect directly to operating controls, risks, and regulatory requirements.

Requires the policy_governance entitlement.

---

Core Architecture: Atomic Governance

Traditional compliance approaches treat policies as monolithic documents or opaque PDFs. OrviQ decomposes governance into a structured hierarchy:

$$\text{PolicyRecord} \longrightarrow \text{PolicyVersion} \longrightarrow \text{PolicySections} \longrightarrow \text{PolicyStatements (Atomic)}$$

• Atomic Statements (PST-): Every distinct operational obligation is modeled as an atomic statement. This allows specific clauses to be independently mapped to internal controls, assigned to functional owners, linked to evidence expectations, and tracked through changes.
• Content 2.0 Corpus: Tenants can adopt pre-structured governance instruments directly from the Content Library, delivering 110 certified instruments across 5 banking and enterprise packs.

---

The Governed Lifecycle

Every corporate policy moves through six formal states:

1. Draft: Authored locally or adopted from the Content Library; editable by policy authors.
2. In Review: Submitted into a governed four-eye or six-eye approval workflow.
3. Under Revision: Returned by reviewers or reopened for amendment following periodic review.
4. Published: Formally approved by designated compliance and executive authorities; active across the enterprise.
5. Expired: Elapsed beyond its formal expiry date without a completed review; surfaces immediately in the Expiry Monitor.
6. Archived: Retired from active service when superseded or decommissioned.

---

Operationalization & Bi-directional Traceability

A policy achieves operational life through Operationalization:

• 10 Operational Target Types: Statements connect to Controls (CTL-), Requirements (REQ-), Evidence Expectations, Risks (RSK-), Owners, Scopes/Assets (SCP-/AST-), Tasks (ACT-), Metrics (IND-), Findings (FND-), and Exceptions (EXC-).
• Operationalization States: NOT_MAPPED, PARTIALLY_OPERATIONALIZED, OPERATIONALIZED, and GAP_IDENTIFIED.
• Bi-directional Traceability: Traverses forward from statutory regulations down to daily evidence assertions, or reverse from technical telemetry up to board-level policies.

---

Semantic Doctrine

Semantic Doctrine: Policy Governance

OrviQ enforces strict conceptual boundaries to eliminate false equivalence between policy documentation and regulatory adherence:

• Mapping != compliance: Linking a policy statement to a regulation indicates design alignment; it does not prove that operations adhere to the mandate.
• Adoption != compliance: Adopting certified Content 2.0 packs instantiates internal draft policies; it does not demonstrate compliance.
• Published != compliant: A published policy establishes an internal rule; compliance requires adherence, evidence, and control operation.
• Attestation != effectiveness/compliance: Employee acknowledgements confirm awareness; they do not establish that controls operate effectively.
• Traceability != compliance/effectiveness: Complete traceability proves governance structural integrity; operational effectiveness requires testing and indicator thresholds.
• Evidence != effectiveness: Ingested evidence records atomic observations; effectiveness requires threshold evaluation across declared scopes.

---

Key Modules & Workflows

• Policy Register: Authoritative inventory of corporate policies and atomic statements.
• Content Library: Browse and adopt 110 certified Content 2.0 governance instruments.
• Policy Assessments: Upload and assess internal policies against target standard expectations.
• Gap Workbench: Triage coverage deficiencies and track 12 structured remediation pathways.
• Change Impact: Horizon regulatory and content change monitoring with maker-checker impact analysis.
• Policy Exceptions: Governed, time-bound deviations with compensating control requirements.
• Employee Portal: Self-service /my-policies for version-pinned employee attestations.