How to work with a draft
A template is a starting point, not a result. Read the draft in full before you change individual sentences. That way you can tell whether the structure and scope suit your company. A business with forty employees does not need a policy describing three committees and five approval levels.
Then work through it section by section. Delete what does not apply to you and add what is missing. Where you only have bullet points, for example from a conversation with IT, let the AI help you with the wording. Check every suggestion for accuracy. Wording that sounds good but is not practised is a risk in the audit.
Deal with the marked points last and deliberately. They come with guiding questions that help with the decision. Involve the people who actually decide, usually management. Record when and by whom the decision was made.
Finally, you approve the document and link it as evidence to the matching controls. From then on it applies as a requirement, and the validity date reminds you of the next review.
What makes a document audit-ready
Auditors do not read policies for style but for substance. They check whether the document suits your organisation, whether it is approved and whether it is practised. A few characteristics help here.
Every document needs a clear purpose and scope, a responsible function, an approval date and a version number. Terms should be used the same way as in the rest of your documentation. If the policy speaks of the information security officer and the role description of the IT security manager, the auditor will ask.
Requirements should be verifiable. “Passwords must be secure” cannot be checked. A requirement on minimum length, multi-factor authentication and handling of compromised passwords can. At the same time, a document must not promise anything you do not deliver. If you commit to a quarterly review in writing, you must be able to present four records a year.
Finally, the link to practice counts. In the audit, a policy is almost always looked at together with proof: a training record, minutes, a screenshot. So link the policy and the evidence to the same control.
Why certain points stay open
Management system standards require decisions that only the organisation itself can make. These include the objectives, the criteria for accepting risks, the assignment of responsibility and the scope. These decisions are the core of the system. If they are taken over from a template, the foundation for everything else is missing.
This shows quickly in the audit. The auditor asks management why an objective was chosen that way or above which threshold a risk is accepted. If the document contains wording that nobody in the organisation can explain, that is a finding. This is why the AI deliberately does not fill in these points.
Instead, they are marked and come with guiding questions. The questions help prepare the decision: which assets are critical to the business? What downtime is acceptable? Who may accept a residual risk? If the answer is difficult, that is not a flaw in the template but exactly the point where real consulting helps. Consultants can be booked as a package in Sightadel, and you invite your own external consultants into the account with their own role.
Common mistakes with templates
The most common mistake is approving a template unchanged. It may be well worded, but it may well describe processes that do not exist in your organisation. The auditor will find the gap at the latest in the second stage, when they ask about the process as practised.
A second mistake is over-regulation. Templates often contain more than a small company needs. Every additional requirement is another obligation you have to prove. A few rules that are actually followed are better than an extensive work that nobody reads.
Third, documents are written and forgotten. A policy should be reviewed at least once a year and whenever the organisation, systems or requirements change. Set a validity date on the evidence, and Sightadel will remind you in good time.
Fourth, the text of standards does not belong in your documents. ISO standards are protected by copyright. Describe what you do instead of copying the standard. That is exactly what the auditor wants to see anyway.
