Policy register template UK 2026: what to track and why a document is not enough

A policy register is the index of every policy your organisation holds — the single list that says what exists, which version is current, when it was last reviewed and when it is due again. It is one of the first things an auditor or inspector asks for, and one of the things most organisations cannot produce cleanly. This guide gives you a template to start from, explains what each part is for, and — the point most guides miss — why the register is only half the job.

What a policy register should contain

For each policy, a good register tracks a consistent set of fields. These are your columns:

• Policy name and a short description of its scope, so anyone can see at a glance what it covers.
• Owner — the named person responsible for keeping it current. A policy with no owner is a policy nobody reviews.
• Current version and the date it took effect, so there is no ambiguity about which version is in force.
• Last reviewed date — when it was genuinely looked at, not just when the file was last touched.
• Next review due date, and the review frequency (annual, biennial, or triggered by change).
• Status — current, due for review, or overdue — the field you should be able to sort by to see what needs attention.
• Acknowledgement — whether staff have read and acknowledged the current version.

Those fields are your template. A spreadsheet with those headings is a perfectly good place to start, and far better than no register at all — it at least gives you one place that says what you have and when each policy is due.

Why the register is only half the job

A register records the position; it does not maintain it. It will not tell you a policy is overdue unless someone opens the sheet and reads the status column. It cannot stop a member of staff opening or working from last year's version, because it only lists the current version — it does not enforce it. And, most importantly, it cannot prove anyone has read a policy; the acknowledgement column can only record a claim that they have, entered by hand. The three things a register exists to protect — policies reviewed on time, one current version in force, and staff acknowledgement — are exactly the three things a static document cannot enforce on its own.

A worked example

Suppose your register shows a safeguarding policy due for review in March. March comes and goes; the owner is busy, nobody sorts the register by due date, and the review does not happen. In June an inspector asks to see your current safeguarding policy and evidence that staff follow it. The register still shows a March review date — now three months overdue — and an acknowledgement column that was last updated a year ago. The register did its job of recording the position; what it could not do was act on it, and that gap is precisely what the inspector finds. A live system would have surfaced the overdue review in March and prompted the re-acknowledgement, turning a finding into a non-event.

What good looks like

A working policy register is live, not static. Review dates surface automatically when they fall due, so nothing drifts unnoticed. Version control means there is one current version and staff always see it, with older versions archived rather than accidentally in circulation. And acknowledgement is captured as staff actually read each policy, so the register holds evidence rather than a claim. That is the difference between a register you keep for the auditor and a register that genuinely keeps your policies healthy.

From template to system

Start with the template above if you have nothing — a structured register beats a drawer of documents every time. But if your policies are inspected, and for care, education and construction they are, the review tracking, version control and staff acknowledgement need to happen on their own rather than depending on someone maintaining a spreadsheet. Policy management software does exactly that, and it sits alongside the rest of your records in compliance document management, so the register is part of one compliance picture rather than a separate file that quietly falls behind. The move is not a project: load your policies, set owners and review dates, mark the current versions, and let the system take over the watching.