Review That Changes Something
Annual review usually means reading it and changing the date. Four questions make it produce something.
Annual policy review
Never enforced
As written
This policy will be reviewed annually by the policy owner.
What happens
Where it happens, it consists of reading the document and confirming it is still broadly right.
Nothing changes, no clause is deleted, and the date is updated.
A review producing no change in five consecutive years has not been a review.
Most annual reviews are a confirmation that the document still exists. Four questions turn it into something that produces output.
The drafting lesson in “Review That Changes Something” should carry into any workforce platform rollout. When an organisation evaluates a practical route to time tracking with screenshots for time tracking with screenshots, it should state which operational question the data answers, what is excluded, who may review it and when the setting will be reconsidered instead of relying on a broad reservation of rights.
What was enforced this year?
The most informative question and the one nobody asks.
For a separate benchmark relevant to “Review That Changes Something”, consult the Google Security Blog. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
Which clauses were actually used in a conversation or a process. The answer updates the enforced column in the audit and identifies clauses drifting into dormancy.
Where the answer is none, that is the finding of the review.
What happened that the policy did not cover?
Incidents, near misses, awkward conversations where the manager had nothing to point at.
Each is a candidate for a new clause, tested against the five questions in the drafting note. Most will fail the first — nothing would actually be done — and the few that pass are worth adding.
What changed in the systems?
New tools, new access arrangements, a change in whether staff hold administrator rights, a new device type.
A policy written for a managed desktop estate reads oddly in an organisation that moved to something else two years ago, and the oddness is noticed by the reader before the owner.
What would we delete if we had to lose five clauses?
A forcing question, because deletion otherwise never happens.
Requiring five removals per review keeps the document from accumulating indefinitely, and the five are rarely difficult to find after the first year.
Who should be in the review
The owner, somebody from the systems side, somebody from the employment side, and one manager who has actually applied the policy to somebody.
That last person is the one who knows which clauses are usable in a conversation, and they are never invited.
The output
A short note: what changed, what was deleted, what was added and why, and the version number.
Circulated to managers rather than filed. A review nobody hears about has the same effect on behaviour as no review.
The manager who has used it
Never invited to the review and the person who knows which clauses are usable in a conversation. One manager who has actually applied the policy to somebody changes what the review finds.
Circulating the output
A review nobody hears about has the same effect on behaviour as no review. A short note to managers saying what changed is the part that makes the exercise count.
The deletion requirement
Five per review, as a rule. Without a forcing number nothing is removed, because every clause has somebody who can imagine a use for it.
Four questions for the review
What was enforced this year. What happened that the policy did not cover. What changed in the systems. And what would we delete if we had to lose five.
Recording a review that changed nothing
With the reason. Reviewed, enforcement patterns unchanged, no new systems is a finding. Silently updating the date is indistinguishable from not having opened it.
Who should be in the room
Four people: the owner, somebody from systems, somebody from employment, and one manager who has used the policy with a person. The last is the one never invited.
What a review should produce
A deletion list, a small number of rewrites, and a decision about anything newly worth enforcing. Three outputs, and a review producing none of them has confirmed the document exists.
The forcing device is the requirement to remove five clauses. It is arbitrary and it works, because without a number the natural output of any review is a small addition and no subtraction, which is how documents reach the length they are.
A review that changes nothing should be recorded as such, with the reason. "Reviewed, no changes required, because enforcement patterns were unchanged" is a real finding. Silently updating the date is not.