What auditors expect as proof of acknowledgement
What ISO 27001, PCI DSS, HIPAA and California rules say about policy acknowledgement, and the record that answers an auditor's sample request.
Listor ·
An audit request for policy acknowledgement usually arrives as a sample: "for these five people, show me they acknowledged the information security policy". The quality of your answer depends on what you recorded at the time, not on what you can reconstruct afterwards.
This post sets out what the main frameworks actually say, then describes a record that satisfies all of them at once. It is a summary, not legal or audit advice; your auditor's sampling approach is the final word.
What the frameworks say
ISO/IEC 27001:2022
Annex A control 5.1 requires that the information security policy and topic-specific policies be "defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur".
ISO sells the standard, so the official text is not free to link. The control is reproduced in Cloudaware's framework reference and explained by ISMS.online.
Two things follow from that wording. Acknowledgement is named directly, so a policy that was published but never acknowledged falls short. And the policy is reviewed "if significant changes occur", which makes the version people acknowledged part of the question.
PCI DSS v4.0.1
Requirement 12.6.3 covers security awareness training and includes this line: "Personnel acknowledge at least once every 12 months that they have read and understood the information security policy and procedures" (requirement text as reproduced by Cloudaware; the official standard is in the PCI SSC document library).
That is the clearest scheduling rule of the four here: every person, at least every 12 months.
HIPAA Security Rule
The Security Rule does not use the word acknowledgement in its documentation standard, but it does require covered entities and business associates to keep written (which may be electronic) policies and procedures, and a record of any action the rule requires to be documented (45 CFR § 164.316(b)(1)). That documentation must be kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (§ 164.316(b)(2)(i)).
If acknowledgement forms part of how you show staff were given your security policies, plan to keep those records for at least that long.
California harassment prevention policy
California employers must develop and distribute a harassment, discrimination and retaliation prevention policy. The regulation lists the accepted ways to distribute it, including "printing and providing a copy to all employees with an acknowledgment form for the employee to sign and return", e-mail "with an acknowledgment return form", and an intranet "with a tracking system ensuring all employees have read and acknowledged receipt of the policies" (2 CCR § 11023(c)).
SOC 2
SOC 2 reports are issued against the AICPA's Trust Services Criteria. The criteria document is behind a free AICPA account, so it is not quoted here. If policy acknowledgement is one of the controls in your system description, ask your auditor early what evidence they will sample, and expect it to look like the record below.
The record that answers the sample request
Across those sources, the same questions come up. For each person in the sample, you should be able to show:
| Question | What the record holds |
|---|---|
| Who acknowledged? | A named person, acting through their own account |
| Which policy? | The document title and where it lives |
| Which version? | A revision label, so an old acknowledgement is not counted twice |
| When? | A timestamp set by the system, not typed by hand |
| How do you know it was them? | IP address and browser user-agent at the moment of confirming |
| Is it still current? | The date of the last acknowledgement against the renewal period |
Three habits make that record hold up:
- Re-ask on change. When a policy changes materially, ask everyone again and record the new version. ISO 27001's "if significant changes occur" is the reason.
- Re-ask on a schedule. Set a renewal period per policy that matches the strictest rule that applies. For anything in PCI DSS scope, that is 12 months.
- Export, do not edit. Hand over an export of the original records. A tidied-up copy invites the question of what was changed.
Answering it with Listor
Listor records each acknowledgement as described above. Each confirmation is dated server-side and stored with the person's IP address and user-agent, against the document and, where the admin has declared one, a revision label such as "v3.1". Opening the document link is recorded too.
When a policy changes, an admin declares the new revision and forces re-attestation, which emails everyone targeted. Earlier acknowledgements stay on the record. Each document can also carry a renewal interval in months, after which Listor emails anyone whose acknowledgement has lapsed.
For the sample request, the audit log exports as CSV or JSON with one row per event: when it happened, who, which document, which revision, the IP address and the user-agent. Exports cover up to the last 365 days.
Renewals and forced re-attestation are on the paid plan. Listor is free for up to 10 assigned people and five documents; see pricing.