Policy attestation: what a read-and-acknowledge record must prove

A policy attestation is a person's recorded statement that they have read a policy or procedure and will follow it; in banks and credit unions it is usually an electronic read-and-acknowledge record. On its own it proves only that a person clicked. The record an examiner can rely on ties a named person to a specific version, shows the acknowledgment came before that version took effect, covers every role that uses it, and sits beside some check that the person knows the one thing that changed. The FDIC expects a compliance officer, once staff are trained, to "periodically assess employees on their knowledge and comprehension of the subject matter". Botminds' Policy & Procedure Management is an agentic solution that asks the staff who use each new version to acknowledge it before its effective date, tracks who has and has not, and never records anyone as having read what they did not acknowledge.

The examples come from the solution on a fictional sample credit union whose 2,300 staff acknowledge new versions of its procedures; the research is linked where it is cited.

What is a policy attestation?

It is evidence that a policy reached a person: a name, a document and a time, sometimes with a statement such as "I have read and will comply". Institutions use the words differently. Acknowledgment usually means confirming receipt and reading of one document, often a new version; attestation often means a periodic affirmation of compliance with a body of policy, such as an annual code of conduct sign-off. For procedures that change with the rules, the useful unit is the acknowledgment of a version, because that is what connects a person to the text they were told to follow on a given date.

What neither word means is knowledge. A record that 612 people acknowledged a hold procedure says they were asked and agreed; it does not say that a teller knows the large deposit threshold is now $6,725. That gap is what the rest of this guide is about.

What should a policy attestation include?

Enough to answer, for any person and any date, which version of which document they were asked to follow, whether they acknowledged it before it took effect, and what the institution did when they had not. The fields below are the ones that answer it; most are routine, and the ones that are usually missing are the version, the effective date and the knowledge check.

Two fields deserve emphasis. The version matters because a procedure can change twice in a year; an acknowledgment of "the hold procedure" in January says nothing about the text that took effect in July. The due date matters because an acknowledgment after the effective date documents a period in which staff were working from a text they had not been told about. In the sample the due date is the day before the rule takes effect, and the versions in force stay in force until midnight, so nobody is asked to follow a text before they could have read it.

Why a click is not knowledge

Because people agree to documents they have not read, and research has measured how far. In a study of 543 people joining a fictitious social network, 74% skipped the privacy policy by choosing a "quick join" option. Those who opened it spent an average of 73 seconds on a policy that would take about 29 to 32 minutes to read at normal speed, and 51 seconds on terms of service that would take 15 to 17 minutes. Most agreed anyway, 97% to the privacy policy and 93% to the terms, and 98% missed clauses that shared their data with the National Security Agency and their employer and asked for a first-born child as payment (Obar and Oeldorf-Hirsch, Information, Communication & Society).

Bank staff are not consumers signing up for a service, and they are paid to follow procedures. But the mechanism is the same: a screen, a document, a button. A teller with a queue and seventeen new versions to acknowledge before the end of June will make the same trade the study measured unless something in the process asks about the change itself.

Do examiners check policy attestations?

They check the compliance program that attestations are part of, and the FDIC's manual is explicit that training and assessment are the compliance officer's job. It expects line management and staff to "receive timely, specific, comprehensive training in laws and regulations, and internal policies and procedures that directly affect their jobs", and it asks for more than delivery:

"Once personnel have been trained on a particular subject, a compliance officer should periodically assess employees on their knowledge and comprehension of the subject matter."

FDIC Consumer Compliance Examination Manual, II-3.1, Compliance Management System

An attestation is evidence that the training or the document was delivered; an assessment is evidence that it worked. Some programs make training a rule: the BSA compliance program a bank or credit union's board approves must "provide training for appropriate personnel" (12 CFR 21.21(d)(4); 12 CFR 748.2(c)(4)). For procedure changes, an examiner asking how the institution knows staff applied the new Regulation CC amounts on July 1 is asking for both: the acknowledgment of the version, and something that shows the number was understood.

How do you prove staff read a new procedure?

Ask them about the change, not just for a click. Memory research is unusually clear here. In a study of how students retained prose passages, those who studied a passage for one period and then took three recall tests remembered 61% of it a week later; those who spent all four periods reading it remembered 40%, and were more confident they would remember it (Roediger and Karpicke, Psychological Science, 2006). Being asked to retrieve the content is what made it stick.

For a procedure change this suggests a short question about what changed, attached to the acknowledgment or to the course that carries the job aid: "A member deposits a $9,000 check on July 2. Above what amount may a large deposit hold apply?" A person who answers $6,725 has done more than click. The sample credit union's learning management system course for holds is refreshed with the three new teller job aids at the same minute the procedures change, which is where such a question belongs.

The other proof is at the counter. In the sample, staff can ask the procedure library a question in plain words and get the answer from the version in force, with the passage it came from and a note when an approved version will change it on a set date. A teller who asks in June gets the June answer and is told it changes on July 1.

Acknowledgments due, beside the answer staff get at the counter

How often should employees attest to policies?

Every time a version that changes what they do is published, before it takes effect, and on a periodic cycle for standing policies such as a code of conduct or acceptable use. We know of no federal rule that sets one frequency for procedure acknowledgments; the useful rule is that a person should never be expected to follow a version they have not been asked to read. Tying acknowledgment to versions rather than to the calendar also keeps the load sensible: a teller is asked about the documents their role uses when those documents change, not about the whole library every January.

In the sample, acknowledgment of each new version is due the day before it takes effect, with reminders 10 and 3 days ahead and then a note to the person's manager. Standing policies run on their own cycle: an updated acceptable use policy took effect on May 1, 2025 with acknowledgment due May 30.

How do you track policy acknowledgements?

By version and by role, with the outstanding names visible to the people who can do something about them. A single percentage hides the branch where nobody has acknowledged; a list of 2,300 names hides the trend. The useful view is the count for each version, broken down by the groups that use it, with the names behind each gap available to their managers.

The sample shows why the gaps matter. On the acceptable use policy, 2,041 of 2,300 staff had acknowledged ten days before the due date, which left 259 outstanding, 211 of them already reminded once. On the hold procedure in force before the change, 598 of the 612 people who use it had acknowledged version 7. Neither number is a failure on its own; both are the numbers an examiner may ask for, and both exist only because each acknowledgment names a version.

Every acknowledgment on the audit trail, and in the examiner's pack

What happens if an employee does not attest?

The version still takes effect on its date; the rule does not wait for the last acknowledgment. What changes is the institution's duty to close the gap: the manager briefs the person before the effective date, the record shows that it happened, and the person acknowledges as soon as they can. What the record must never do is fill the gap itself. In the solution the Acknowledgment agent publishes only versions the owner approved and Compliance checked, tracks who has acknowledged, reminds staff and their managers, and never marks anyone as having read.

Repeated gaps are a management question, not a software one: they usually mean too many documents arriving at once, documents sent to roles that do not use them, or a manager who does not see the list. Sending each person only the versions their role uses is the most effective fix, and it depends on knowing which roles use which document, a field a policy library should carry alongside the file. The acknowledgment is also only half the record of a change; the version history it attaches to is the other half. To see both on your own documents, start from Policy & Procedure Management.

Questions people ask

What is the difference between policy acknowledgement and attestation?

Acknowledgment usually confirms that a person received and read a specific document or version; attestation usually affirms ongoing compliance with a set of policies, often yearly. Usage varies by institution. For procedures that change with rules, the acknowledgment of each version is the record that matters, because it ties a person to the text in force on a date.

Should board members and contractors attest?

Board members are not usually asked to acknowledge operating procedures, but the FDIC expects a compliance officer to "establish a regular training schedule for Directors, management, and staff, as well as for third-party service providers, where appropriate". Contractors who follow a procedure, such as an outsourced call center using a hold script, should acknowledge its new versions like staff.

How long should attestation records be kept?

As long as the versions they relate to, since an acknowledgment without its version proves little. No single federal rule sets a period for acknowledgments; the sample credit union keeps every version and its record for seven years after the version is replaced, and its BSA procedures at least five; those are its settings, not periods a rule sets.

Can a manager acknowledge on behalf of staff?

Not if the record is to mean anything. An acknowledgment is evidence that a named person was asked and confirmed; one entered by someone else is evidence only of the manager's action. The manager's part is to brief the people who have not acknowledged and to record that briefing as what it is.

Is an electronic acknowledgment enough?

An electronic acknowledgment from the person's own account, recording their name, the version and the time, is the usual form and is easier to evidence than paper. What makes it enough is not the medium but the fields: the version, the date before it took effect, and the roles it covered.