Updating workplace policies: notice, consultation and documented consent

Policies that are not refreshed lose authority. Periodic review, with a clear owner and version control, keeps them current and credible.

Each policy should have a named owner, a defined review cadence, and a triggered-review process for when external changes — legislation, instrument variation, regulator guidance — require an out-of-cycle update.

Contracts, codes of conduct and policies sit in a hierarchy. Changes to one can affect the others, and that interaction should be considered before any update is made.

Where a policy change has the effect of altering employment terms, the consultation, notice and (where required) consent obligations are materially different from a procedural update. The drafting team should be clear which category any change falls into before proceeding.

Consultation expectations vary by instrument and by topic. Mapping the relevant expectations before sequencing communication avoids later challenge.

Consultation that is performative — announced after a decision is settled — is a common source of dispute. Genuine consultation at a point where feedback can influence outcomes is the more reliable approach and also produces better policy.

Notice should be proportionate to the significance of the change. Minor administrative updates may take effect quickly; substantive changes generally warrant longer notice and an effective-date plan.

An effective-date plan also gives time for training delivery, system updates and manager briefings so the new policy is operational at the point it takes effect rather than only theoretically in place.

Acknowledgement should be recorded — through a learning system, signed register or GRC platform — in a way that demonstrates informed understanding, not just receipt.

Acknowledgement records are most useful when they capture what was acknowledged, the version in force at the time, and the date. This protects the organisation if the policy is later updated and the previous version becomes relevant to a historical matter.

Version control, scheduled training and periodic assurance checks turn a policy update into an embedded change rather than a one-off communication.

Assurance activity should test whether the policy is operating as designed — through sample reviews, manager interviews and incident analysis — not only whether the document exists. Documents that are not operating are not controls.