# Policy approval

URL: /systems/trust-and-governance/controls/policy-approval · Id: `control:policy-approval`

> Every Policy is a versioned definition, and the entity’s officer approves the Versions in force by Decision each period.

Every [Policy](/business/nouns/policy) is a versioned definition, and the entity’s officer approves the [Versions](/business/nouns/version) in force by [Decision](/business/nouns/decision) each period.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC5.3](/systems/trust-and-governance/criteria/soc2/cc5-3) | The entity deploys control activities through policies that set expectations and procedures that put them into action. |
| [ISO27001 A.5.1](/systems/trust-and-governance/criteria/iso27001/a-5-1) | Information security policies are defined, approved by management, published, communicated and reviewed at set intervals. |
| [HIPAA 164.316](/systems/trust-and-governance/criteria/hipaa/164-316) | The entity documents its security policies and procedures and retains that documentation for six years. |

## Implemented by
- [Compliance](/workflows/processes/compliance)
- [Compliance](/systems/compliance)
- [Officer desk](/business/glossary)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Policy in force during the report period. |
| Assert | Each Version in force appears in an officer’s approval Decision dated within the period. |

## Owner
[Founder](/agents/founding/founder), [Founding Team](/agents/founding).

## Example
A Studio-held entity runs Version 4 of its refund Policy. At period end the officer's approval Decision lists Version 4 among the Policies in force.