07 July 2025 | Matt Carney, Senior Information Governance Consultant, Evolve North

Policies and procedures are intended to be living documents. In practice, many haven’t been reviewed since GDPR came into effect in 2018.

It’s not unusual - governance tasks often take a back seat to day-to-day operations. Where resource is limited, policy maintenance can lack clear ownership. When responsibility isn’t defined, documents are neglected. The result? Policies that no longer reflect how the business operates.

As Matt Carney, our Senior Information Governance Consultant, points out: “Business models evolve. Reviewing policies regularly isn’t just good governance—it’s essential for compliance, clarity, and continuity.”

Avoiding the 'Set and Forget' Trap

A common pitfall is assuming that once a policy is written, it’s complete. But policies that aren’t maintained can quickly become liabilities.

In regulated sectors: health, finance, education, government - certain policies are legally required. Others are essential to support certification frameworks and demonstrate robust internal control. For example:

ISO 27001 / ISO 9001
Cyber Essentials / Plus
GDPR / UK Data Protection Act 2018
PCI-DSS / NIS2 / DORA

Outdated documents can undermine your ability to meet these standards, increasing the risk of audit failure or non-compliance.

Why Policies Get Left Behind

Even mature organisations fall into familiar habits:

“We’ve just always done it this way.”
“It’s not a priority right now.”
“We reviewed them once, aren’t they fine?”

None of these are unusual. But all of them create blind spots.

When to Review

Regular policy reviews should be triggered by clear events, including:

Organisational changes - such as structural updates, hybrid or remote working models, or departmental growth.
Technology rollouts - like the adoption of cloud platforms, AI tools, MFA, or remote access solutions.
Regulatory developments - changes to frameworks like DORA or revisions to ISO standards.
Security incidents or audits - that reveal gaps in existing documentation.
Certification or tendering requirements - that call for evidence of current practice.

If your business has grown, moved to remote working, or onboarded new systems, your policies may already be out of date and quietly introducing risk.

Why It Matters

Policy reviews aren’t just a compliance exercise. Done properly, they support:

Alignment of teams around current expectations.
Improved readiness and response to incidents.
Faster, cleaner audits and tender submissions.
Clearer onboarding and training processes.
Increased confidence from clients, regulators, and partners.

Well-managed policies underpin operational clarity. Poorly maintained ones lead to ambiguity and risk.

If your policies are overdue for a health check, it’s worth acting before a regulator or an incident forces the issue.

If it’s been a while since your last policy review, now’s the time to act -before a regulator or incident makes it urgent.

To speak with our team or arrange a policy health check, contact us on 01748 905 002 or email info@evolvenorth.com.