What Is a Metapolicy? The Policy on Policies, Explained

By Helen Jones · Updated November 2, 2026

A metapolicy is a policy about policies. It sets the rules every other policy in an organization must follow: who can propose one, which template to use, who approves it, how it is published and acknowledged, how often it is reviewed, and how conflicts between policies are resolved.

Most organizations write their policies one at a time, each in a different format, with a different approver and no fixed review date. A metapolicy fixes that by governing the whole set. It's sometimes called a policy on policies, a policy governance policy or a policy framework. If you want the general definition of a policy first, see our guide to policies.

Metapolicy definition

The US National Institute of Standards and Technology defines a metapolicy as "a policy about policies, or policy for managing policies." Its examples include setting priorities and resolving conflicts between policies (NIST CSRC glossary, from NIST SP 800-162). NIST's definition comes from access-control systems. The idea is the same in an HR, compliance or IT policy library: one document that sets the rules for all the others.

A metapolicy doesn't tell employees how to behave. That's the job of each individual policy, such as your code of conduct or acceptable use policy. The metapolicy tells policy owners how to create, approve, publish, review and retire those policies.

Metapolicy vs policy vs procedure

For a fuller comparison, see policy vs procedure vs process.

What a metapolicy covers

A metapolicy is usually short, often a few pages. Each section answers one governance question:

Metapolicy example: a sample outline

This sample "Policy on Policies" shows the level of detail a metapolicy needs. The roles and time periods are illustrative. Set your own to match your governance structure and any rules that apply to you.

1. Purpose. This policy sets how the organization creates, approves, publishes, reviews and retires its policies.
2. Scope. It applies to all organization-wide and department policies. Procedures and work instructions follow the procedure standard.
3. Ownership. Every policy has one owner, named by role. The Compliance Manager owns this policy.
4. Format. Every policy uses the approved policy template, including the title page, version number and review history table.
5. Approval. The executive team approves organization-wide policies. Department heads approve department policies. Legal reviews any policy that refers to a law or regulation.
6. Publication. Approved policies are published only in the policy library. Copies saved elsewhere are not controlled.
7. Acknowledgment. Staff covered by a policy must read and confirm it within 14 days of publication or of a major change.
8. Review. Every policy is reviewed at least every two years, and sooner when the law, a regulator or the process changes.
9. Exceptions. Exceptions are requested in writing, approved by the policy owner and recorded with an end date.
10. Records. Superseded versions are archived, not deleted, and kept in line with the records retention schedule.

Start each policy from our free policy template for Word, or use the policy template pack, which adds a review schedule and an acknowledgment log.

Why organizations need a metapolicy

• Consistency. Every policy has the same layout, the same approval route and the same review cycle, so staff know where to look and reviewers know what to check.
• Clear authority. Nobody has to ask who can approve a policy, or which of two conflicting policies applies.
• Evidence for auditors. Version history, approvals and acknowledgments are recorded the same way for every policy.

That evidence matters most in regulated sectors. For example, organizations covered by the HIPAA Security Rule must keep their written policies and procedures for 6 years from creation or last effective date, make them available to the people who implement them, and review them periodically (45 CFR 164.316). A metapolicy is where you write down how your organization meets rules like these for every policy at once. For a checklist of the policies a metapolicy usually governs, see essential company policies.

How to create a metapolicy in 7 steps

1. List what you have. Inventory every current policy, its owner, its last review date and where it lives.
2. Agree the definitions. Decide what counts as a policy, a standard, a procedure and a guideline.
3. Set the hierarchy and approvers. Map each level of policy to the role that can approve it.
4. Pick one template. Make it mandatory for every new or revised policy.
5. Set the review cycle and triggers. Choose a maximum review interval and the events that force an early review.
6. Decide how acknowledgment is recorded. Name which policies need a read-and-confirm and how long staff have to do it.
7. Approve and publish the metapolicy first. Then bring existing policies into line at their next review, starting with the highest-risk ones.

The metapolicy is the rulebook for every stage of the policy lifecycle, from first draft to retirement.

Running your metapolicy in SharePoint and Microsoft 365

If your policies live in SharePoint, most of the metapolicy can be built into the library itself:

• Versioning. Turn on version history so every change is kept and dated. See the importance of policy versioning.
• Approval. Use content approval, or build a policy approval workflow with Power Automate, so only approved versions reach readers.
• Metadata. Add columns for owner, policy level, approver and next review date, and use metadata to classify policies.
• Review reminders. Set up policy review reminders from the review date column.
• Acknowledgment. SharePoint shows who changed a file, but it doesn't assign a policy to the people who must read it or record that each person accepted the current version. DocRead adds that inside SharePoint. It assigns policies to Microsoft Entra ID or SharePoint groups, sets deadlines, sends reminders, escalates overdue readers to managers and keeps a time-stamped acknowledgment of the exact version read. See policy management software for SharePoint.

Book a demoRequest a quoteStart the 30-day SharePoint Server trial

Metapolicy FAQ

What is a metapolicy in simple terms?

A policy about policies. It sets how every other policy is written, approved, published, acknowledged, reviewed and retired.

Is a metapolicy the same as a policy framework?

Mostly. A policy framework is the whole structure of policies, standards and procedures. The metapolicy is the document that sets the rules for that framework.

Who owns the metapolicy?

Usually the compliance, governance or risk function, with approval from the executive team or board, because it sets authority for every other policy.

How often should a metapolicy be reviewed?

On the same cycle it sets for other policies, and whenever your governance structure, approvers or regulatory obligations change.

Does a small organization need a metapolicy?

Yes, but it can be one page: one template, one approver per policy level, one place to publish, a review interval and a way to record who has read each policy.