A policy management system does not have to be software. It has to answer three questions in under a minute, and whatever does that is your system. Most organisations discover they do not have one at the moment somebody asks the third question and the honest answer is that a document was emailed once. This page sets out the three questions, why a folder answers none of them, and what the smallest real system looks like.
Question one: which version is current?
A folder answers this with a filename and a guess. Two files called final and final-v2 is a coin toss, and the person following the wrong one is usually the person who had the least context. The answer has to be on the face of the document, because that is where somebody following it will look, not in a file property.
Question two: whose job is it to check?
A name, not a department. Operations owns it means nobody owns it, and the most common finding in a neglected register is a procedure whose owner left. Without a name the review step is impossible: chasing a department is a task nobody completes and everybody agrees was somebody else's.
Question three: who has read the current one?
Not who has read it at some point. A signature bound to a version, with a date. This is the question a folder cannot answer at all, and it is the one that usually triggers the purchase, because it is asked after something has already gone wrong.
The smallest real system
A list with six columns and a place to sign: title, owner, version, review date, scope, status. That can be a spreadsheet if somebody maintains it, and it stops being one at the point where nobody can tell you the overdue share today. On the worked example that share is 14.4 of 48 documents, and 36 hours of work to clear.
Questions people ask about policy management system
Does a policy management system have to be software?
No. It has to answer three questions in under a minute. A maintained spreadsheet can, right up until nobody can state the overdue share.
What are the three questions?
Which version is current, whose job it is to check, and who has read the current one. A folder answers none of them reliably.
When does a spreadsheet stop being enough?
When nobody can tell you the overdue share today. On the worked example that is 14.4 of 48 documents and 36 hours to clear.