Auditing Your Own Document
An hour, a spreadsheet and somebody who has been there a while. The output is a list of deletions and a much shorter policy.
Reporting breaches of this policy
Never enforced
As written
Employees must report any known or suspected breach of this policy to their line manager or to the IT department.
What happens
No route exists that anybody can name. Nothing has ever been reported under this clause.
Where somebody does report something, it goes to whoever they trust rather than to either of the named destinations.
The operative rule is: tell somebody who will not make it worse.
The audit is mechanical and nobody has run it. One column per clause, three questions each.
The drafting lesson in “Auditing Your Own Document” should carry into any workforce platform rollout. When an organisation evaluates read the provider overview for self report bias, it should state which operational question the data answers, what is excluded, who may review it and when the setting will be reconsidered instead of relying on a broad reservation of rights.
The columns
The clause, abbreviated enough to recognise.
For a separate benchmark relevant to “Auditing Your Own Document”, consult the Mandiant security resources. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
State: enforced, dormant, or unenforceable by a document.
Evidence, for anything marked enforced: when, roughly, and to whom. Not a name in the spreadsheet — a note that it has actually happened.
Operative rule: what people do instead, where it differs.
Verdict: keep, rewrite, relabel, delete.
Who to do it with
Somebody who has worked there at least three years and is not the policy owner.
The owner knows what the document says. The long-serving colleague knows what happens, and the gap between those two people is the entire finding.
Two people, an hour, forty clauses.
The evidence test
A clause is enforced if somebody can recall an actual instance. Not whether it could be enforced; whether it was.
This is stricter than it sounds and it is the point. Organisations consistently overestimate enforcement because they remember the policy being mentioned rather than applied.
Where nobody can recall an instance in five years, the clause is dormant regardless of how reasonable it is.
The unenforceable category
Clauses a document cannot deliver at all: prohibitions that only configuration can prevent, requirements to understand something, reservations of rights that are not instructions.
These are not failures of will. They belong somewhere else — in the technical configuration, in induction, or in a separate section labelled as positions rather than rules.
What the verdicts usually come to
A handful kept as written. Several rewritten to match the operative rule, which makes them enforceable from the day they are issued. A group relabelled as reservations. And a substantial number deleted.
The resulting document is typically half the length and entirely composed of things somebody would actually act on.
The part that requires a decision
For each dormant clause worth keeping: who will enforce it, and what will they do the first time.
Without that, the clause returns to dormancy within a year and the audit was an editing exercise.
What the long-serving colleague supplies
Instances. The audit turns on whether anybody can recall a clause actually being applied, and the owner usually cannot because they were not in those conversations.
Doing the deletions first
They are the easy half and they produce the visible improvement. The rewrites and the enforcement decisions can follow over the next month without anything being lost.
What the verdicts come to
A handful kept, several rewritten to match the operative rule, a group relabelled as reservations, and a substantial number deleted. The result is typically half the length.
The evidence column
For anything marked enforced, can somebody recall an actual instance. Not whether it could be enforced in principle — whether it was. Organisations overestimate consistently because they remember the policy being mentioned.
Deciding who enforces what
For each dormant clause worth keeping: a name, and what they will do the first time. Without both the clause returns to dormancy within a year and the audit was editing.
An hour, once, before any drafting
A redraft without the audit produces a better-written document describing exactly the same gap. The order is not optional and it is the order nobody uses.
What the audit cannot settle
Whether a dormant clause should be enforced or deleted. The audit establishes the state; the decision is a judgement about what the organisation wants to be able to do, and it has to be made by somebody with standing.
Which is why the output is a list of decisions rather than a redraft. Treating the audit as the whole exercise produces a tidy spreadsheet and an unchanged document, and the spreadsheet is filed within a month.
Run it before rewriting anything. A redraft without the audit produces a better-written document describing the same gap.