Policies written in hours, approved with evidence.
Draft policies and processes with AI and keep the controls inside them as governed register controls. Approvals route by what changed, every document is reviewed on schedule, and staff acknowledge each new version.
1. Purpose
2. Scope
3. Policy statements
Approval routes to 2 control owners, then the control design approver.
Illustration with sample data
What Policy & Process Library does
New Document offers a policy template with nine standard sections and a process template with six. Draft with AI fills in the sections and Reuse from Other Documents pulls matching content from your library. In a process document, every control must answer what, who, when, where, why and how. Each control in a document is a Control Register control, shown as a block written from its recorded definition, so a policy and its controls can never drift apart.
Approvals depend on what changed. A control change needs every affected Control Owner, the document owner and a CISO, and any other change needs the document owner and a CISO. The author never gives the CISO approval, and publishing is all-or-nothing. Periodic review shows everything that changed since the last review, and reviews are also requested automatically when controls fail or regulations change. Acknowledgement campaigns reach staff by organisation, department and persona, and record a fingerprint of the exact text each person acknowledged.
Key capabilities
AI drafting & reuse
Draft every section with AI or reuse content from other documents.
Policies and processes
A nine-section policy template; process controls answer 5W1H.
Governed controls
Each document control is a register control with versioned definitions.
Change-based approval
Control Owners, the document owner and a CISO, depending on what changed.
Periodic review
Review cycles, diffs since the last review and automatic review requests.
Acknowledgement campaigns
Audience by organisation, department and persona, re-acknowledged on every version.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Policy & Process Library changes for your programme.
Less drafting and review time
Reviewers edit an AI draft and see only what changed since the last review.
Approved, reviewed, acknowledged
Approval, review and acknowledgement evidence for policy requirements across frameworks.
Reusable governance
Document controls map to canonical controls and support every linked framework.
Policy text = control record
Control wording changes only through governed proposals.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Draft
Choose policy or process; draft with AI or reuse content.
Define controls
Each control becomes a governed register control.
Approve
Routing follows what changed; publishing is all-or-nothing.
Review and acknowledge
Periodic review and staff acknowledgement campaigns.
Supports your obligations.
Policy & Process Library contributes evidence and coverage to these frameworks and regulations.
Common questions.
Does AI publish policies automatically?
No. AI produces a draft; every change goes through approval before it becomes a new version.
Who approves a document?
For a control change, the affected Control Owners, the document owner and a CISO. For any other change, the document owner and a CISO. The author never gives the CISO approval.
Can we prove staff read the policy?
Yes. Acknowledgement campaigns record each person's acknowledgement with a timestamp and a fingerprint of the exact text.
Works better together.
AI Policy Review
Upload a policy, process, standard or procedure, choose the frameworks that matter, and get a control-level verdict with supporting text. Then create an improved draft…
Learn more →Compliance ManagementControl Register, Testing & RACI
One register for your own controls, with versioned definitions, scoped RACI, assurance tests that count only after independent review, evidence requirements with…
Learn more →Compliance ManagementControl Library & Document Controls
RiskVantis uses the Secure Controls Framework as its canonical control layer. Your own controls, including those written inside policies, live in one register mapped to…
Learn more →See Policy & Process Library in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.