Workflows, Hiring & HRPolicy Signing
On this page0
Unfamiliar word? See Glossary: words used in these docs. Looking for the tasks in order? Begin at Start Here.
Reference
Included in: Team and Advanced. Which Plan Includes What
Policy Signing
This page describes when a signature is due, signed copies and rosters, who can do what, and how signatures become compliance evidence. Policy signing is included from the Team plan. This page is part of the reference Training, Phishing & Policy Signing.
What It Does
- What a person is asked to sign. A policy that is approved and has signing by every employee switched on. The person confirms every section, types their name and signs.
- What is stored. Each signing writes one record, including the account, the policy and its version, a fingerprint of the exact text, the name typed, and the date and time. The application can add to this record but cannot change or delete it.
- The typed name. It is compared with the account name and the result is recorded. A name that does not match is not refused: people sign with a married name or a short name.
- When a signature is due. Each policy has a number of days to sign, 30 unless you change it, and a renewal period, 12 months unless you change it. A new joiner has the same number of days.
- When the text changes. Changing an approved policy returns it to draft, and whoever made the change cannot approve it. Once text that differs is approved, earlier signatures no longer count and everyone signs again. The text of every approval is kept.
- Reminders. With email set up, a weekly run tells each person what they still have to sign. When a signature is seven days late the person’s manager is told.
- Copies and rosters. Anyone can download their own signed copy as a PDF. HR can take the signature roster of one policy, for today or as of a past day, and the evidence record of one person.
- Compliance evidence. On the Advanced plan, the Compliance Hub fills certain controls from these records by itself. On Team, the signatures, rosters and certificates are still yours to show an auditor.
Policy Signing (Included From Team)
A policy that is approved and has “Require every employee to read and sign this policy” switched on is put in front of each person it applies to, on My WorkMy to-do. HR follows it on TRAININGPolicy Signatures. Policy signing answers when either Training or the Compliance Hub is on your licence, so it is included from the Team plan. The Compliance Hub’s own registers and audit evidence remain Advanced.
How A Signature Is Recorded
The server cuts the policy text into sections at its headings and gives each section, and the whole document, a SHA-256 fingerprint. The person confirms every section, types their name and signs. The server checks again that every current section was confirmed and that the fingerprint still matches the text in force; otherwise nothing is signed.
What Is Stored
Each signing writes one record: the account and email, the policy, its version and name, the document fingerprint, each section confirmed with its own fingerprint, the name typed and whether it matches the account name, the date and time, when the text was first opened if known, and the network address and browser. The application can add to this record but cannot change or delete it.
The Typed Name
The name must be at least two characters. It is compared with the account name, ignoring case, spacing, accents and word order, and the result is recorded. A name that does not match is not refused: people sign with a married name or a short name.
Policies Without Sections
A text with fewer than two headings, or more than 60, a policy that is only a link, or one with section signing switched off, is signed as one document with a single confirmation. The document fingerprint is recorded in the same way.
When A Signature Is Due
Two numbers on each policy decide this: “Sign again every (months)”, 12 unless you change it (0 to 36, where 0 means only when the text changes), and “Days to sign”, 30 unless you change it (1 to 180). The days must be fewer than the renewal period.
New Or Changed Policy
Everyone the policy applies to has the days to sign, counted from the approval that put that text in force. Until then they show as “Not yet due”; after it, “Overdue”. Approving the same text again does not restart the count.
New Joiners
A person who joins after the policy came into force has the same number of days, counted from the later of their start date and the day their account was created. With no start date on file, the account date is used.
Renewal
A signature counts for the renewal period. The person is asked again the days-to-sign before it lapses, and the old signature still counts until that day. A renewal is written as a new signing record; the earlier one is kept.
When The Text Changes
Changing the name, version, text, link or mapped controls of an approved policy returns it to draft, and whoever made the change cannot approve it. Nobody is asked while it is a draft; people who signed keep the text they signed under “Done”, marked “Being revised”. Once text that differs is approved, earlier signatures no longer count and everyone signs again. The text of every approval is kept.
Reminders
With email set up, a weekly run tells each person what they still have to sign, including a renewal coming up. When a signature is seven days late the person’s manager is told; with no active manager, or one who could not be reached, the people with the permission to manage compliance are told. “Remind all” on TRAININGOverview sends the person a reminder straight away and reports how many were reached.
Exemptions
A person with the permission to manage compliance can excuse one active person from one policy, with a reason from a fixed list and an end date at most a year away. Nobody can record their own, except an administrator. An exemption is never edited, only ended. An exempt person is not asked, is left out of the count, and appears as “Exempt” with the reason category. The private note is not printed and not written to the audit log.
Signed Copies, Rosters And Retention
A Person's Signed Copy
Anyone can read the text they signed and download it with “Download my signed copy (PDF)”. It is served from the stored approval that matches the fingerprint on their signature, not from the policy as it reads today. Only their own copy is ever returned.
The Signature Roster
From the “Policy register”: every person the policy applies to, their status, when and under which name they signed, how many times, and the fingerprints of the text and its sections. “Signature roster as of” gives it for a past day: the version in force, the people there and the signatures on record that day.
One Person's Evidence Record
“Evidence record (PDF)” in the “Policy register” puts everything on record for one person in one file: each signing, each training completion and any exemption.
Signed PDFs And The Audit Log
Each PDF is digitally signed when it is made, and the screen says so. If it could not be signed, the screen says that instead. Every roster view, roster export, evidence record and signed-copy download is written to the audit log.
Retention
“How long signatures are kept” in the “Policy register” starts as “Not set — kept indefinitely”. You can choose 12 to 120 months after the person leaves. Signatures of people who still work for you are always kept, and a leaver’s are removed only when the day they left is on record. Removal runs when the system is updated.
What People Are Told
“What is kept about me” on My WorkMy to-do shows each person what is recorded when they sign or complete training, for how long, and who sees it.
How Signatures And Completions Become Compliance Evidence (Advanced)
On the Advanced plan, the Compliance Hub fills certain controls from these records by itself, each time evidence is collected. Nobody attaches a file. On Team, the signatures, rosters and certificates are still yours to show an auditor; the automatic feed into controls is what Advanced adds.
Policy Signatures
Each policy carries the controls it covers, set from its template or under “Controls this policy covers (optional)”. A control is judged only on the approved, signing-required policies mapped to it. It fails when anyone is overdue. It is undecided while a new or changed policy is still inside its signing window, when nobody has signed, or when more than a fifth of the people are exempt. Otherwise it passes; joiners and renewals inside their own window do not fail it.
Training Completions
Nobody maps a course to a control. A control names the training topics that prove it and a course carries one topic; where they meet, the control is judged on that course’s completions once the course is in use. It fails when anyone is late. There is no partial credit: the percentage shown on the control never changes the verdict. A completion with nothing behind it (no confirmation by the person, no certificate, no recorded reason) is not counted, and one older than 12 months no longer counts.
Supporting Versus Pass
Some controls also ask for evidence that a signature or a course cannot give. For those, a result that would pass is recorded as supporting evidence instead, and the control stays undecided until the other evidence is there.
Seeing What A Course Proves
With the Compliance Hub on your licence, the course editor shows which controls a course’s topic feeds. Several topics, such as the code of conduct and acceptable use, feed no control: those courses are kept as your own record.
If something here is not working as you expect, start with When something goes wrong.
The plain explanation is above. This part is for IT and developers: the exact settings, permission names, API addresses and data fields behind it. Closed: select the heading above to open it. While it is closed, your browser’s find-on-page (Ctrl+F or Cmd+F) does not search this part.
Who Can Do What
The TRAININGPolicy Signatures page itself needs manage_employee_training. Its “Edit and approve policies” button, and adding a policy from the “Library”, also need manage_compliance.
| Action | What It Needs |
|---|---|
| Read and sign the policies that apply to you; read and download your own signed copy | Any signed-in person |
| See the open signatures of the people who report to you (status only) | Any signed-in person, own reporting line only |
| See who has and has not signed, across policies; send a reminder | manage_employee_training or manage_compliance |
| Add a policy (from the library or by hand), edit it, delete it | manage_compliance |
| Approve a policy | Its named owner, or manage_compliance; never the person who drafted that text (administrator excepted) |
| Record or end a policy exemption | manage_compliance |
| Be told when a signature is seven days late and the person has no active manager, or one who could not be reached | manage_compliance |
| Signature roster of one policy (PDF), today or as of a past day | manage_compliance |
| Evidence record of one person (PDF) | manage_compliance |
| Set how long signatures of leavers are kept | manage_compliance (anyone signed in can read the period) |