--- sourceDocument: Brazil Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # An overview of policy life cycle in Policy and Compliance Management # An overview of policy life cycle in Policy and Compliance Management {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of An overview of policy life cycle in Policy and Compliance Management The policy life cycle in Policy and Compliance Management helps ensure organizational compliance and risk reduction by managing policies through defined stages. Policies can be various types such as procedures, standards, or templates, and go through a structured approval process before publication. Show full answer Show less This life cycle tracks the status of a policy record to monitor progress and manage related activities at each stage. Policies can also revert to previous states if further work is needed. ## Policy Life Cycle Stages * **Draft:** Created by compliance admins, managers, or users; policy details and attributes are captured. Reviewers and approvers are assigned. Control objectives can be linked or created. Actions available include updating, sending for review, or deleting the policy. * **Review:** Only assigned reviewers can update the policy to ensure regulatory requirements are met. They assess control objectives and mappings, making necessary adjustments. Reviewers can return the policy to Draft if it needs more work. Reviewers cannot request approval; this is done by the policy owner or compliance managers. * **Awaiting approval:** If approvers are assigned, the policy enters this state and an approval task is created. Approvers can approve, reject, cancel, or delete the policy. If no approver is assigned, the policy moves directly to Published. * **Published:** The policy is officially mandated and a Knowledge Base article is automatically generated. It can be sent back to Review, Retired, or Deleted from this state. * **Retired:** When a policy is no longer needed, it is retired and the associated Knowledge Base article is removed. The policy remains in this state for audit purposes but can be reactivated by moving it back to Draft. ## Practical Benefits for ServiceNow Customers * Provides a clear and controlled process for creating, reviewing, approving, and managing policies. * Ensures policies remain up-to-date and aligned with regulatory requirements via defined review and approval roles. * Automates the generation of Knowledge Base articles for published policies, facilitating user awareness and compliance enforcement. * Maintains audit trails by preserving retired policies and allowing reactivation if business needs change. Policies ensure compliance and reduce exposure to risks. A policy can be of any type -- it can be a policy, procedure, standard, plan, checklist, framework, or template. Publishing a policy is within its approval process. When you create a policy, it is in a Draft state, and all the required information about the policy are defined and captured in the record. The required information that you capture are the attributes that drive the process flow of the policy. The life cycle of a policy record passes through different states. This is designed to understand where the record currently resides and to display its progress. Each state has a specific set of related activities before it moves to the next state. A policy may also move to the previous state, if required, which is configured and identified according to the current state. Draft : A compliance admin, compliance manager, or a compliance user can create a policy, define and capture its related information. In this draft state, reviewers are identified, who have the ability to edit the policy in its review state, and approvers who can approve the policy. Control objectives that already exist can be added to the policy or new ones can be created. Each policy has a Valid to period, within which it is updated, reviewed, republished, or retired. In this state, the actions that are available for you to perform on the policy are Update, Ready for Review, and Delete. Review : Only the policy reviewers can Update the policy in this state to ensure that it satisfies all regulatory requirements. They review the control objectives, its associated entities, controls, and citations, and add additional information, remove unnecessary mappings, or create new control objectives. The reviewer can move the policy Back to Draft state if the policy does not fulfill the requirements or if more details are needed.Reviewers cannot request approval for a policy. However, the owner of the policy with sn_compliance.user, which is the minimum required role, and users with compliance manager role can request approval for a policy. Awaiting approval : If a policy approver is assigned to the policy, the policy moves to the Awaiting approval state. Otherwise, it moves to the Published state. In this state, the approver can Delete the policy as well. In the Awaiting approval state, a policy approval task is created and assigned to the approver. The task is in Requested state, and the approver can change it to any of the following states: * Requested * Approved * Rejected * Cancelled * No longer required {#pc-policy-life-cycle-ovrvw__ul_y2m_l4k_gxb} Published : When the policy moves to the Published state the system automatically generates a Knowledge Base article. The policy becomes a mandate for all users to follow its guidelines and requirements, which is through the controls that are mapped to the policy. In this state, the policy can also be sent Back to Review, Retired, or Deleted. Retired : A policy may be retired if no longer required, or when it no longer serves a business purpose. The Knowledge Base article that was created is removed, but the policy stays in retired state for audit purpose. If the policy is needed again, it can be sent back to the Draft stage, and the policy's life cycle begins again.