How often should policies be reviewed or updated?

It is considered general best practice to review your internal compliance policies at least annually. However, this should be conducted more frequently if there have been significant changes within your organisation, infrastructure, or compliance obligations. For example, the creation of new departments, leadership changes, updates to compliance regulations, or tooling/infrastructure changes should all be followed by a review of internal documentation, which should include the following:

Confirm that scope and responsibilities are still accurate.
Check that referenced tools or platforms are up to date.
Ensure any legal or regulatory references reflect current obligations.
Update version history, review date, and next scheduled review.
Record who reviewed the policy and whether it was re-approved.

Polices that are considered to be 'out-of-date', or 'inaccurate' by auditors will results in failed audits, which can significantly impact the business, both financially and reputationally.

Updated on: 21/03/2025