How to Track Policy Acknowledgement in SharePoint With an Audit Trail

SharePoint has no built-in "read and understood" button, so you track policy acknowledgement with an added layer. That layer records who confirmed which policy version and when, in a log that cannot be edited afterwards. It also chases people who have not responded and reports completion rates. You can build it with a SharePoint list and Power Automate, or use a purpose-built acknowledgement tool.

Last updated: 10 October 2026

This guide explains what auditors expect, the options available in Microsoft 365, how to build a basic tracker yourself, and where that basic tracker falls short.

What is policy acknowledgement tracking?

Policy acknowledgement tracking is a record showing that each employee has read and accepted a specific version of a policy. A complete record names the person, the policy, the exact version, the date and time, and how the confirmation was given. Its purpose is evidence: proof for auditors, regulators or courts that staff were informed.

Acknowledgement is different from publishing. Publishing makes a policy available. Acknowledgement proves a named person engaged with it. Organisations commonly track acknowledgement for:

• Code of conduct and ethics policies
• Information security and acceptable use policies
• Health and safety procedures
• Standard operating procedures (SOPs) in regulated work
• Data protection and privacy policies

Why do auditors ask for policy acknowledgement records?

Auditors ask for acknowledgement records because several standards require organisations to show that people are aware of the policies relevant to their work. A published policy alone does not prove awareness. A dated record tied to a specific version does. Without it, the organisation must rely on interviews, which are slower and less convincing.

Our guide to document control in SharePoint for ISO, SOX and GDPR covers the wider document control requirements.

Can SharePoint track policy acknowledgement out of the box?

No. SharePoint can publish policies, keep version history and require approval before publishing. However, it has no native feature that asks each reader to confirm a policy version and stores that confirmation. Page views are not acknowledgement, because a view does not show the person read or accepted the content.

You therefore choose between four options:

How do you build a basic acknowledgement tracker with a SharePoint list and Power Automate?

You build a basic tracker in five steps: a policy library with versions, an acknowledgement list, a request flow, a confirmation flow and a report view. This works well for a few policies and a few hundred staff. It needs care at scale, because each policy release creates hundreds of flow runs and list rows.

1. Prepare the policy library. Add columns for version, effective date, owner and "requires acknowledgement".
2. Create the acknowledgement list. Add columns for employee, policy, policy version, status, requested date and acknowledged date.
3. Build the request flow. When a policy version is published, create one list row per employee in scope. Send each person an email or Teams message with a link.
4. Build the confirmation flow. When the employee selects "I have read and understood", set the status, date and time on their row.
5. Build the report view. Group the list by policy version and status, so owners see who is outstanding.

Our post on automated reminders and alerts in SharePoint shows how to schedule the follow-up messages.

Where does a do-it-yourself acknowledgement tracker fall short?

A do-it-yourself tracker usually falls short on tamper-resistance, version linkage and chasing. List rows can be edited by anyone with edit rights, so the record is not append-only. A new policy version must reset everyone's status without losing the old evidence. Reminders need their own schedule and escalation rules, which add more flows to maintain.

Common weaknesses auditors notice:

• Editable records. A member of the site can change a date or status. Version history helps, but it is not an append-only log.
• Lost history. Overwriting a row for a new version removes evidence of the earlier confirmation.
• No escalation. People who ignore the request are reminded once and then forgotten.
• Scope drift. New joiners are not added automatically, so they never receive older policies.
• Weak reporting. Completion rates by department need manual exports to Excel.

What should an audit-ready acknowledgement record contain?

An audit-ready acknowledgement record contains the person, the exact policy version, the date and time, the method of confirmation and an unchangeable history. Each new policy version creates new records rather than overwriting old ones. Together, these fields let an auditor answer "who agreed to what, and when" without interviews.

Store records for as long as your retention policy requires. Our guide to Microsoft Purview retention for SharePoint documents explains how to set that period.

How do you chase employees who have not acknowledged a policy?

You chase non-responders with a fixed reminder schedule, then escalate to their manager. A common pattern is a reminder after 3 days, a second after 7 days, and a manager notification after 14 days. Showing each manager a live list of outstanding staff in their team usually closes the gap faster than further emails.

1. Day 0. Request sent by email and Teams.
2. Day 3. First reminder to the employee.
3. Day 7. Second reminder, copying the policy owner.
4. Day 14. Escalation to the line manager with the outstanding list.
5. Day 30. Report to compliance on remaining gaps.

How should you report policy acknowledgement completion?

Report acknowledgement completion as a percentage per policy version, broken down by department and location. Show the number outstanding and the oldest outstanding request. Compliance teams need the overall rate. Managers need the names in their own team. Auditors need an export of the locked records for the period under review.

A simple monthly report includes:

• Completion rate per policy version
• Outstanding count by department
• Average days to acknowledge
• New joiners still outstanding after 30 days

DocVault, our SharePoint document management system, includes a version-specific acknowledgement ledger with reminders and reports. See also our SOP and policies manager for SharePoint.