Appearance
Policy Governance
The Policy Governance domain provides end-to-end management of corporate policies, institutional charters, and procedural standards, proving policies exist, are current, are approved by authorized authorities, and are operationalized into daily controls.
Pages in this area
| Page | Route | What it does |
|---|---|---|
| Policy Overview | /governance | High-level dashboard of the policy estate, review status, and operationalization posture |
| Policy Library | /governance/library | Internal policy register, atomic statement editor, versioning, and redline diffs |
| Content Library | /governance/packs | Authoritative Content 2.0 catalog: 110 certified governance instruments and 5 domain packs |
| Policy Assessments | /governance/assessments | Upload & Assess engine for structural extraction, expectation snapshots, and coverage evaluation |
| Gap Workbench | /governance/gaps | Deficiency triage and remediation workbench with cross-links to tasks, risks, and exceptions |
| Operationalization | /governance/operationalization | Statement-level mapping to controls, risks, owners, evidence expectations, and scopes |
| Change Impact | /governance/change-impact | Regulatory and content change detection with maker-checker impact assessments |
| Policy Exceptions | /governance/exceptions | Governed temporary deviations with compensating control evaluation and renewal alerts |
| Expiry Monitor | /governance/expiry | Automated tracking of approaching and overdue periodic review milestones |
| Policy Comparison | /governance/compare | Deterministic structural comparison between policy versions |
| Employee Portal | /my-policies | Self-service portal for version-pinned employee attestations and reading verification |
Documentation for this area
| Article | What it covers |
|---|---|
| Policy Governance Overview | Architecture, workflows, and core operational patterns |
| Policy Register | Fields, statuses, versions, sections, and atomic statements |
| Content Library & Content 2.0 | 110 certified instruments, 5 domain packs, and decoupled adoption |
| Policy Assessments | Upload & Assess workflow, segment extraction, and coverage determination |
| Gap Workbench | 12 remediation pathways, lifecycle states, and independent closure validation |
| Operationalization & Traceability | Atomic statements, 10 target types, forward/reverse traceability, and invariants |
| Regulatory & Content Change Impact | Change events (CHG-), candidate triage, and maker-checker impact assessments (IMP-) |
| Policy Exceptions & Governed Deviations | Governed deviations (EXC-), raw vs derived labels, and compensating controls |
| Policy Lifecycle | Draft to published to revision, review dates, and renewal |
| Review and Publication | Governed multi-eye approval chains, redline reviews, and publication locking |
| Policy Attestation | Administrative campaign orchestration, target groups, and progress monitoring |
| Employee Policy Portal | Self-service /my-policies experience, reading verification, and reasoned declines |
| Manage Policies Guide | Step-by-step operational walkthrough for compliance officers |
Semantic Doctrine
Semantic Doctrine: Policy Governance
OrviQ enforces strict separation between written policy documentation and operational assurance:
- Mapping != compliance: Linking a policy clause to a regulatory standard demonstrates structural intent; it does not certify operational compliance.
- Adoption != compliance: Adopting Content 2.0 governance packs instantiates internal draft policies; it does not prove adherence.
- Published != compliant: Having an approved, published policy establishes that an internal rule exists; it does not prove personnel or systems comply with it.
- Attestation != effectiveness/compliance: An employee signing an attestation confirms document acknowledgement; it does not prove operational control effectiveness.
- Traceability != compliance/effectiveness: Complete bi-directional traceability demonstrates governance architecture; control effectiveness requires testing, indicator evaluation, and evidence.
- Evidence != effectiveness: Having observation records demonstrates telemetry; operating effectiveness is established only through indicator thresholds and human verification.
Permissions and Entitlements
Requires the policy_governance entitlement. Browsing and adopting from the Content Library catalog requires content_library.
policy.attest is available to every workspace user to access /my-policies; creating and managing policies or campaigns requires policy.write. Approving reviews and exceptions requires policy.review or exception.approve.