Adoption decisions and policy control
| Organisation / system scope | [Organisation] / [System or programme] |
|---|---|
| Document ID / version / status | AD / [Version] / [Draft or approved] |
| Owner / approving authority | [Named owner] / [Named approving authority] |
| Effective date / next review | [Date] / [Date or linked schedule ID] |
| Adoption decision record | [AD-01 record location and version] |
AD-01 — Adoption decision register
The policy owner maintains one decision record for each document or separately tailored commitment. The register is the record of what [Organisation] has decided to undertake within the SSDLC scope. A decision may apply to a whole document or a named clause. Where a clause decision differs from the document decision, the clause and its scope are stated explicitly. An empty field means the decision has not been made.
The record separates four questions that are commonly collapsed into one: whether the activity is already happening, whether the organisation has decided to commit to it, how the commitment is met, and who has approved and reviewed that position. An activity already performed still requires a decision, because an undertaking that nobody has adopted is not a commitment and will not survive a change of staff.
Means of delivery is recorded as a set, not a choice. A single commitment can be met by more than one path at once — part performed by a system, part by a named manual process, part by a supplier under agreement — and each applicable path is recorded separately together with the system, process or party that performs it. A record showing a disposition of “will do” with no recorded means of delivery is an accepted promise with nothing behind it; AD-07 reports it as such rather than counting it as compliance.
| Record ID and subject | [AD record ID; document ID; clause IDs; version] |
|---|---|
| Applicable scope | [Organisation, system, service, supplier or project] |
| Disposition | [Will do / Won’t do / Deferred until / Unresolved] |
| Reason and consequences | [Decision rationale; stakeholder and risk implications] |
| Deferred until | [Date and time zone, or observable event and review date] |
| Already in place | [Yes / No / In part — whether the activity is performed today, before any decision is recorded] |
| Current arrangements | [Activities currently performed; relevant limitations] |
| Delivered by a system | [Named system, service or module that performs it, or “not by this path”] |
| Delivered by a manual process | [Named process, the role that performs it and where it is recorded, or “not by this path”] |
| Delivered by an external party | [Named supplier or service, and the agreement or flow-down requirement that binds it, or “not by this path”] |
| Owner and decision authority | [Named responsible person; named approving authority] |
| Dependencies and obligations | [Related promises; agreements; requirements; risk IDs] |
| Operation and assurance | [Procedure; schedule or trigger; evidence; assessment ID] |
| Sign-off | [Named signatory; decision date; approval reference] |
| Review | [Named reviewer; date last reviewed; date of next review, or the schedule or trigger ID that sets it] |
AD-02 — Establish the policy set
The owner places the selected policy, procedure and register documents in [repository]. The owner assigns a local version, records the source document and identifies the affected systems. Square-bracket fields are completed from organisational decisions. A field still awaiting a decision remains visibly unresolved and is linked to the responsible person and decision date. The owner checks references between documents so that role names, scope, time periods and record locations agree.
The owner records the disposition before presenting the policy set for approval. Selecting “will do” establishes the proposed commitment and its intended effective date; it does not assert that implementation is complete. Implementation work is recorded separately with an owner and target date. The approving authority receives the policy text, unresolved issues, relevant obligations and the implementation position together.
AD-03 — Record a decision not to undertake an activity
A “won’t do” record states the activity omitted, the scope of the decision and the reason. The owner identifies which needs, risks or obligations were expected to be addressed by that activity and how they will now be addressed, if at all. The authority records the resulting decision with the affected risk owners and stakeholders consulted. The record can state that no replacement activity is planned; it shall not describe an absent activity as implemented.
Where an obligation arises from an agreement, law or governing directive, the owner identifies the person able to interpret or change that obligation. An internal selection does not amend an external obligation. The decision record states any unresolved conflict and the action taken to resolve it. A change in circumstances can cause the decision to be reopened through its review schedule or trigger.
AD-04 — Manage a deferral
A deferral states the date or observable event at which the activity is to begin or the decision is to be reconsidered. Event-based deferrals identify who will detect the event and how it will be reported. The owner also sets a review date so that a deferral tied to an event that never occurs remains visible. The record identifies interim arrangements, affected risks, required resources and the work needed to become operational.
When the date arrives or event occurs, the responsible person updates the implementation record and obtains any necessary decision. A date passing does not prove that the activity has started. An extension is a new decision with reasons and consequences; the previous due date remains in the history. Reports identify overdue deferrals separately from activities deliberately not adopted.
AD-05 — Control policy changes
The policy owner receives change requests through [route]. Each request identifies the current wording, proposed wording, reason, affected scope and impact on roles, schedules, evidence and existing system decisions. The owner consults those expected to operate or rely on the policy. A proposed simplification is assessed for the commitments it changes, including any effect on an assurance conclusion already communicated.
The approving authority confirms the new version and effective date. The owner publishes the version, communicates the practical change and updates the adoption register. Superseded versions remain identifiable and linked to records created under them. Assessment of past work uses the commitment effective for that work; a later policy change is not treated as if it had always applied.
AD-06 — Exceptions to an adopted commitment
An exception concerns a departure from an adopted commitment for a defined instance, population or period. The requester records the commitment, reason, affected system, alternatives, consequences and proposed duration. The relevant risk owner considers the consequence and the designated authority decides whether to approve the departure. The record identifies any conditions, follow-up work and expiry or review trigger.
The exception is linked to the work performed and the evidence retained. An exception decision is reported separately from ordinary compliance with the original promise. Repeated exceptions cause a review of whether the policy is workable, adequately resourced or still appropriate. The owner does not silently rewrite an approved promise in order to make historical exceptions disappear.
AD-07 — Policy assurance
At [schedule], the reviewer compares the published policy set with the adoption register, approval records and operational assignments. The reviewer checks whether readers can identify the current version and whether selected commitments have procedures, owners and schedules. A sample of changes is followed through communication and implementation. Findings identify stale copies, missing decisions, inconsistent scope or promises with no operational arrangement. Two tests are applied directly to the register: records with a “will do” disposition and no recorded means of delivery, and records naming a system, process or external party whose operation cannot be evidenced when asked. The first is an unimplemented promise; the second is a delivery path that exists only on paper.
The owner records the assessment and corrective actions. Management reporting shows the number and significance of unresolved decisions, implementation gaps, active exceptions and overdue deferrals. It does not combine all of these into an unexplained compliance percentage. Changes to the register preserve who changed a decision, when and under what authority.