An annual policy review should test each policy against four things: the current rules, what the business actually does, what went wrong during the year, and related policies. The agent runs those tests for every policy due, drafts a review note and a redline, and tracks the schedule. Policy owners decide the changes, and the approving body signs off.
What is the annual policy review, and who owns it?
Most firms commit to reviewing each policy at least annually, or on a cycle set by risk. The review confirms the policy is still accurate, still compliant and still followed, and records that it was reviewed even if nothing changes. In practice, many reviews are a date change and a signature, because owners lack the time to test the policy properly.
Compliance or a policy governance team owns the schedule; each policy owner owns their review; a committee or senior manager approves. The agent turns a signature into a test. It reads the policy from the library, as described in connecting an agent to your policy library, and gathers the evidence the owner needs to decide.
What are the steps, and who acts at each?
- Agent, depth 1: maintains the schedule. Policies due for review in the coming period, with owners and approvers, and any overdue.
- Agent, depth 1: tests against the rules. Changes to the regulatory obligations mapped to this policy since the last review, from the change log and the obligations register.
- Agent, depth 1: tests against practice. Procedures that implement the policy, monitoring results, audit findings and exceptions granted under it. Frequent exceptions suggest the policy does not fit the business.
- Agent, depth 1: tests against events. Breaches, incidents, complaints and losses linked to the policy's subject during the period.
- Agent, depth 1: tests against other policies. Conflicts in definitions, thresholds and roles with related policies.
- Agent, depth 1: checks roles and names. Job titles, committees and systems mentioned that no longer exist.
- Agent, depth 2: drafts the review note and a redline. Findings from each test, proposed changes tied to findings, and a recommendation: no change, minor change or substantive change.
- Person, policy owner: decides. Accepts, edits or rejects the proposals, and confirms the policy is fit for purpose.
- Person, approver: approves substantive changes, or notes a no-change review.
- Agent, depth 1: updates the schedule and flags dependants affected by any change.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Schedule | Lists due and overdue reviews | 1 | None |
| Rules | Finds obligation changes | 1 | Interpretation |
| Practice | Reads procedures, monitoring, exceptions | 1 | Judging fit |
| Events | Links breaches and incidents | 1 | Judging relevance |
| Conflicts | Compares with related policies | 1 | Resolving conflicts |
| Housekeeping | Finds stale names and roles | 1 | None |
| Note and redline | Drafts findings and changes | 2 | Owner decides |
| Approval | Nothing | None | Approver |
| Update | Records outcome and dependants | 1 | Dependant owners act |
Which controls apply, and what evidence does each leave?
Review evidence, not just a signature. The review note shows the tests run and what each found. Evidence: a note per policy per year, which internal audit can sample.
Exceptions analysed. Exceptions granted under the policy are counted and categorised. Evidence: the exception analysis, which often tells you more than anything else about whether a policy works.
Owner's decision recorded. Including a decision that no change is needed, with the reason. Evidence: owner confirmation.
Approval against the exact version. Evidence: approved version in the library, matched to the redline.
Overdue reviews escalated. Evidence: escalation to the committee for policies past their date.
What should you measure?
- Reviews completed on time.
- Reviews that led to change, and the proportion driven by each test.
- Exceptions per policy, trending.
- Conflicts between policies found and resolved.
- Audit findings on policies that the review should have caught.
Where does it usually go wrong?
Everything due in one month. Reviews clustered at year end get rushed. Spread the schedule across the year.
Reviewing the words, not the practice. A policy can be perfectly drafted and widely ignored. The practice and exceptions tests matter most.
AI policies treated differently. The policy governing AI agents needs the same review, with tests against how agents are actually bounded and what they did. Starting from an AI agent policy template helps. Its review pairs naturally with running an access review for AI agents, which tests whether agents' actual permissions still match what the policy allows.
Too many changes at once. A review that rewrites a policy completely is hard to approve and hard to implement. Separate necessary changes from improvements.
Dependants forgotten. Procedures, training and agent briefs that rely on a changed policy must change with it.
Owners who have changed roles. A policy whose owner has moved on gets reviewed by whoever is nearest, without real accountability. The agent should check each owner against the current organisation chart before the review starts, so that ownership is fixed first and the review is done by someone who will answer for it.
The overall stance on compliance agents is in AI compliance agents.
Where Pryme fits
In Pryme, the agent reads policies as sealed facts with their version, so every finding in the review note cites the exact text tested. Proposing a redline is a depth 2 capability; approving or publishing is outside the agent's role scope. When a reviewed policy changes, agents whose briefs depend on it are flagged for update.
Questions people ask
Can the agent sign off a policy as reviewed if nothing has changed?
No. The owner confirms the policy is still fit for purpose. The agent's tests make that confirmation meaningful, but the confirmation is the owner's.
Should every policy be reviewed every year?
Your governance framework decides. Many firms review high-risk policies annually and lower-risk ones less often, with event-driven reviews when rules or the business change.
How long should the review note be?
One or two pages: tests run, findings, decision. The evidence sits behind it for anyone who wants to check.