Task guide
Policies and attestations
Keep the firm's policies as versioned documents with an owner and a review date, send each version to the people it applies to, chase the overdue, and export who attested as inspection evidence.
Regulators and insurers ask a firm to show that its people know its policies: anti-money laundering, data protection, conflicts, IT and acceptable use, complaints, whistleblowing, and gifts and hospitality. Compliance, Policies keeps each policy and who has attested to it.
Add a policy
Add policy names the policy, its kind, its owner and how often it is reviewed, 12 months by default. The policy starts with a draft version. On the policy's Overview, the draft's menu holds:
- Attach the document: the policy as a PDF. It is scanned before anyone may open it.
- Edit: what changed, whether everyone attests or only chosen roles, and the days they have to attest. Left empty, the firm's Days to attest to a policy apply, 14 by default.
- Publish and send: the day it takes effect. Publishing replaces the version in force, freezes the new one, and sends it to everyone it applies to.
Start a new version in the policy's menu opens the next draft when the policy changes or falls due for review.
Attesting
Each person finds the policies sent to them under Me, Standing, Policies. Read the policy opens the document; only then does Attest record "I have read this policy and will follow it" (the firm's Attestation statement) with the day and time. A person who joins the firm, or is given a role a policy applies to, is sent every policy in force.
Reminders and escalation
A person is reminded on the firm's Attestation reminders (days before) and told once the day passes. Once an attestation has been overdue the firm's Escalate overdue to the supervisor after (days), 7 by default, their supervisor is told. A policy's owner is told when its review falls due and once it is past.
The register
Attestations lists who was sent which version, when it was due, and whether and when they opened and attested, filtered by standing. Export gives the register as a PDF or CSV for an inspection; the export is audited. A policy once published is never deleted: Retire stops it being sent while keeping who attested.
Was this helpful?
Read next
- The compliance dashboardSee at a glance whether CPD, the firm's AML risk assessment, its policies and staff training are red, amber or green, and open the people or items behind each figure.
- Staff trainingKeep the courses the firm requires, such as anti-money laundering, who must take each and how often, record completions with their certificates, and see who is due or overdue.
- Reminders and escalationHow reminders climb from the holder to the partner and the managing partner, why each must be acknowledged, and what leave does.