Auditors test three things about policies: that they exist, that they are approved by someone with authority, and that they are reviewed. The register answers all three in one page, which is why it is usually the first artefact requested.
Record who approved it and at what level. A policy approved by its own author carries no weight. Top-level policies generally need board or executive approval; subordinate ones need an owner at the right level. Record both the name and the date.
Spread reviews across the year. Setting every policy to review in January guarantees none get a real review. Stagger them so each month carries two or three.
Track acknowledgment per version. Acknowledgment of version 2 does not evidence agreement to version 4. Record which version each person accepted and require re-acknowledgment on material change.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Policy | Owner | Version | Approved by | Approved on | Last reviewed | Next review | Status | Acknowledgment required | % acknowledged |
|---|---|---|---|---|---|---|---|---|---|
| Information Security Policy | CISO | 4.0 | Board | 2026-02-10 | 2026-02-10 | 2027-02-10 | Current | All staff | 98% |
| Acceptable Use Policy | IT Director | 3.1 | CISO | 2026-08-15 | 2026-08-15 | 2027-08-15 | Current | All staff | 96% |
More free templates IT teams use alongside this one.
The information security policy is the parent document auditors ask for first. Its job is not to contain every control. It is to state the organisation's position, assign responsibility, and point to the specific policies that implement it.
Audit fieldwork goes badly when requests are tracked in email. Items get missed, two people produce the same artefact differently, and nobody can say what is outstanding, which is itself read as a control weakness.
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
Each policy with its owner, current version, who approved it and when, last review and next review dates, status, who must acknowledge it, and the acknowledgment rate. It is typically the first artefact an auditor requests.
Annually for most, more frequently for fast-moving areas such as AI usage. Spread review dates across the year. Scheduling every policy for the same month guarantees the reviews become a formality.
No. A review that concludes the policy remains fit for purpose is a valid outcome, but it must be recorded with a date and a reviewer. An unrecorded review is indistinguishable from no review at all.
