Docs

Appearance

Manage Policies ​

This guide provides end-to-end instructions for authoring, adopting, reviewing, operationalizing, and maintaining corporate policies within OrviQ's Policy Governance domain (/governance).

1. Creating or Adopting a Policy ​

You can establish a new policy in your register using either of two methods:

Option A: Adopt from the Content Library ​

  1. Navigate to Policy Governance > Content Library (/governance/packs).
  2. Browse the certified Content 2.0 packs (e.g. ORV-PACK-CORE or ORV-PACK-BANKING).
  3. Click into a governance instrument to preview its structured sections and atomic statements.
  4. Click Adopt Policy (or Adopt Pack to ingest the full suite).
  5. The instrument is instantiated in your Policy Library (/governance/library) with status draft.
  6. Requires policy_pack.adopt and content_library entitlement.

Option B: Author In-Tenant ​

  1. Navigate to Policy Governance > Policy Library (/governance/library).
  2. Click + New Policy.
  3. Complete the required governance metadata:
    • Title: Formal name (e.g. Enterprise Information Security Policy).
    • Category: Classification taxonomy (e.g. Information Security, Prudential Risk).
    • Owner: Accountable executive owner and department.
    • Dates: Effective date, next review date, and expiry date.
  4. Click Save as Draft. Requires policy.write.

2. Structuring Sections and Atomic Statements ​

To make a policy auditable and operational, decompose its text into structured sections and atomic statements:

  1. Open your draft policy in the Policy Library.
  2. Under the Content tab, create numbered Sections (e.g. Section 4: Access Control Standards).
  3. Within each section, add or edit Atomic Statements (PST-):
    • Formulate each statement as an indivisible, actionable obligation.
    • Ensure each statement specifies clear responsibility and technical or operational criteria.
  4. If working with an adopted Content 2.0 instrument, review and customize any statements flagged as Pending Substantiation to reflect tenant-specific parameters.

3. Assessing Policy Coverage (Upload & Assess) ​

If you have an existing legacy policy document (PDF/DOCX) and wish to benchmark it against standard expectations:

  1. Navigate to Policy Governance > Policy Assessments (/governance/assessments).
  2. Click + New Assessment.
  3. Upload your document (or select an existing internal PolicyVersion) and choose your target benchmark (e.g. a certified Content 2.0 template version).
  4. Run deterministic extraction to decompose your document into candidate segments.
  5. Review proposed mappings, adjudicate alignments (accept, reject, modify), and record authoritative coverage results (addressed, partially_addressed, missing, not_applicable).
  6. Complete the assessment to freeze the evaluation snapshot. Any identified deficiencies route directly to the Gap Workbench.
  7. Requires policy_assessment.run and policy_assessment.review.

4. Operationalizing Atomic Statements ​

A policy achieves operational life by mapping its atomic statements to operating GRC objects:

  1. Open the policy and navigate to the Operationalization tab (/governance/policy/:pid/operationalization), or access the global view at /governance/operationalization.
  2. Select an atomic statement.
  3. Map the statement to operational targets:
    • Controls (CTL-): Assign primary, supporting, or compensating controls that execute the requirement.
    • Requirements (REQ-): Link to regulatory obligations.
    • Evidence Expectations: Define what documentary, technical, or attestation evidence must be gathered.
    • Owners: Designate accountable and implementation owners.
    • Scopes & Assets: Declare in-scope technology environments and populations.
  4. Observe the operationalization posture transition from NOT_MAPPED to OPERATIONALIZED.
  5. Requires policy.operationalize.

5. Governed Review & Publication ​

When drafting and operationalization are ready, submit the policy into the governed approval chain:

  1. In the Policy Library, click Submit for Review.
  2. The policy status transitions to in_review.
  3. The assigned reviewer receives a task in their Workbench and reviews the document, atomic statements, and redlines.
  4. Approval Chains:
    • Four-Eye Chain (Default): Author drafts $\rightarrow$ Compliance Manager approves $\rightarrow$ Published.
    • Six-Eye Chain (Board Policies): Author drafts $\rightarrow$ Compliance Review $\rightarrow$ Executive/CCO Approval $\rightarrow$ Published.
    • Hard Segregation of Duties: the author cannot approve their own policy.
  5. Upon final approval, the policy transitions to Published.

Semantic Doctrine: Published != Compliant

Publishing a policy establishes that an internal corporate rule is in force. It does not certify regulatory compliance, nor does it guarantee that personnel adhere to it or that controls operate effectively.

6. Launching Attestation Campaigns ​

To collect defensible employee acknowledgements:

  1. Open the published policy and navigate to the Attestations tab.
  2. Click + Create Campaign.
  3. Configure target audience (e.g. specific roles, departments, or all staff) and set a completion deadline.
  4. Click Activate Campaign.
  5. Staff members immediately receive notifications and can access the version-pinned policy in their self-service Employee Policy Portal (/my-policies).
  6. Employees read the document and submit Acknowledge or Decline with written rationale. (Opening the document records opened_at, but opened != acknowledged).
  7. Monitor real-time completion rates in the campaign dashboard. Requires policy.write.

7. Maintaining Periodic Reviews & Change Impact ​

  1. Periodic Review: The Expiry Monitor alerts owners when review dates approach. Record periodic reviews via policy.review to keep policies active and re-set review dates.
  2. Revisions: A published policy cannot be directly edited. Move it to under_revision to create a new draft version, edit statements, and re-submit through the approval chain.
  3. Change Impact: When statutory circulars or Content 2.0 updates arrive, inspect candidate alerts in Change Impact to determine required policy amendments.
  4. Governed Exceptions: If operational constraints temporarily prevent adherence, submit a time-bound Policy Exception with compensating controls.

OrviQ Enterprise Governance, Risk & Compliance Platform

Copyright © 2026 OrviQ. All rights reserved.