Insights
A policy is only useful if you can show it is being followed
A client questionnaire asks how you control access. The policy is only part of the answer. You also need current records of the work.
A client sends a security questionnaire. You find the policy they are asking about, but it names a former employee, refers to software you no longer use and says access is reviewed regularly. Nobody can find the last review.
The document is a starting point. To answer the questionnaire accurately, you also need to understand the current practice and find evidence of it.
Start with the requirements that apply
Before buying a policy template or copying a checklist, identify why the organization needs it. The source might be legislation, a client agreement, an insurance condition or a standard management has chosen to follow. Keep those sources distinct so people understand what is required and what is an internal choice.
For example, Alberta's PIPA overview says organizations subject to that Act must develop and follow reasonable policies to meet their obligations. Which privacy requirements apply to your organization depends on its circumstances; an Alberta address alone does not settle every question.
Record the requirement's source and have its applicability confirmed by the appropriate adviser. This gives future reviewers something more useful than an unexplained “compliance required” label.
Connect the policy to a task
A policy describes the expectation. A procedure explains how staff meet it. Evidence helps demonstrate that the procedure was carried out.
Consider staff departures. The policy may require access to be removed promptly. The procedure should explain who tells IT, which systems are checked, who handles shared information and who confirms completion. Evidence could include the approved departure request and a completed record of the access changes.
Set the timing and checks to reflect your own obligations and risks.
Give each policy an owner and a review trigger
Name someone who understands the work and can arrange a review. Record the approver, current version and next review date. Also identify events that should bring the review forward, such as a new business system, an incident or a change to a relevant requirement.
Ask the people doing the work whether the procedure is realistic. If everyone has to work around it, find out why before asking them to acknowledge it again.
Keep evidence where you can retrieve it safely
An evidence register should identify the control, the person responsible, the period covered and where the records are kept. Note any gaps. Link to records in a controlled location instead of scattering copies across email inboxes.
Evidence may itself contain sensitive information. Restrict access and decide what a reviewer actually needs to see. A client questionnaire is not a reason to send unrestricted system exports or employee records.
If a review was missed, record the gap and the corrective action. Do not create a retrospective record that suggests the work happened when it did not.
The organization still needs to approve the policies, carry out the work and address gaps. A document or software system alone cannot establish compliance.
Start with one policy you are likely to be asked about. Confirm that its owner, procedure and supporting records are current. Use what you learn to plan the next review.
Get your policies and evidence in order
ZenCOMPLY supports our work on policy development, maintenance and audit preparation. We will review your existing material and the Canadian requirements that apply to your organization.