GP practices should manage policy review dates through one central register, with a named owner, a clear deadline and reminders that allow time for review and approval. The system should also identify overdue work and bring reviews forward when guidance, risks or practice arrangements change. A spreadsheet can support this; larger or more complex libraries may benefit from dedicated software.
The next review date should represent a planned check of the policy’s content, not simply a date to change on its cover. A document can be within its review period and still describe an obsolete process.
For a Practice Manager balancing workforce pressures, patient access and daily operational problems, the aim is a manageable flow of work. That means knowing what needs attention next, who will do it and whether the review has actually been completed.
-
CQC’s Regulation 17 guidance does not prescribe a particular spreadsheet, software package or universal annual review date. The legal requirement is for effective governance systems that monitor quality, manage risks and maintain appropriate records. A functioning policy review system can help demonstrate those arrangements. See CQC’s Regulation 17 guidance.
Under CQC’s published assessment framework, often called the Single Assessment Framework, this work may support the Governance, management and sustainability quality statement. That statement addresses clear responsibilities, accountability and proportionate risk management. A list of future dates provides only part of that evidence; the practice also needs to know that reviews lead to appropriate action.
These CQC references apply to England. Practices elsewhere in the UK should check their own regulatory and contractual arrangements.
Keep the status of each deadline clear. A date specified by an applicable contract or external requirement has a different basis from an interval chosen locally. Neither should be confused with a supplier’s suggested review date.
-
A useful register should identify the current policy, who maintains it, when it was last substantively reviewed and when the next review is due. It should also show where work has stalled. Avoid collecting information that nobody uses to make a decision.
The following is a practical suggested structure:
Policy title, identifier and link - Which document is being managed and where the approved version sits.
Current version - Whether the register and published document match.
Owner and cover arrangement - Who will arrange the review, including during absence or staff changes.
Last completed review date - When the content was last checked, rather than merely edited or uploaded.
Approval and effective dates - When the policy was authorised and when its instructions took effect.
Next review due date - When the next planned review must be completed.
Basis for the interval - Whether it follows an external requirement or a local decision informed by risk.
Status and outstanding action - Whether review, approval or implementation remains unfinished.
Use unambiguous dates, such as “15 October 2026”. Where work is delayed, record the original due date alongside any revised completion target.
For data protection policies, the ICO’s audit framework specifically describes documented review dates and document control information, including ownership, version numbers and change history. This is regulatory guidance for that subject area; the register above is a practical recommendation for the wider library. See the ICO’s guidance on policies and procedures.
Keep the register and policy header consistent. Conflicting dates leave staff unsure which record to trust.
-
Work backwards from the completion deadline, allowing time for the owner to check the content, consult colleagues and obtain approval. Spread reviews across the year where applicable requirements allow. Assign someone to monitor the whole schedule so that individual reminders do not become the only control.
A workable local approach is to look ahead three months and check progress monthly. More complex reviews might need an initial reminder six to eight weeks before they are due, followed by a progress check. These are suggested planning intervals, not regulatory deadlines.
Schedule clinical input explicitly. Sending a medicines policy to a GP lead two days before its review date leaves little opportunity for a meaningful check.
Avoid giving the whole library the same anniversary date simply because it was purchased or uploaded together. Grouping related documents can make review more efficient, but the workload still needs to fit the people available. Bring some reviews forward to spread demand; do not quietly extend deadlines for convenience.
Reminders should reach the owner and someone who can monitor progress. A shared task list or mailbox provides continuity when staff leave or are absent.
A spreadsheet may be sufficient if it is maintained, backed up and accessible to the relevant people. Software can automate prompts and preserve history, but somebody still needs to act on the alerts. Check how the system handles overdue tasks, reassigned owners and reviews awaiting approval.
-
Bring a review forward whenever a change could affect the policy’s accuracy, safety or usefulness. The scheduled date is a backstop. It should not delay action on a known problem.
Triggers include new guidance, relevant contractual changes, incidents, complaints, audit findings and changes to staff responsibilities or clinical systems. An owner should assess what needs to change and how quickly, involving the appropriate clinical or specialist lead.
Build a simple question into service changes and significant event discussions: which policies or procedures does this affect? Record any resulting action in the same register used for scheduled reviews.
The ICO’s guidance, for example, calls for information governance policies to be updated without undue delay when operational or regulatory changes require it. That illustrates why calendar reminders alone are insufficient. See the ICO’s policy review guidance.
A supplier update should trigger consideration of the local policy. Its publication date is not evidence that the practice has checked its own arrangements. For a shared PCN document, agree who reviews the common content and who checks local contacts, responsibilities and implementation.
A limited amendment should not automatically restart the full review interval. Record its scope and retain the existing review deadline unless a substantive review justifies changing it.
-
An overdue review should prompt an assessment of the document and the risk of continuing to rely on it. The missed date does not, by itself, prove that every instruction is wrong. It does mean the practice has missed a planned check and needs to resolve the gap.
Prioritise according to potential consequences and known concerns, alongside how long the review has been outstanding. Policies affecting safeguarding, medicines, urgent results or sensitive information warrant particular attention.
If instructions are unsafe or inaccurate, arrange immediate action through an appropriate lead. Where a full review needs more time, record:
The initial assessment and any interim arrangements.
Who authorised those arrangements.
The person completing the review.
A firm completion target and escalation route.
A locally revised target cannot override an applicable external deadline. Preserve the original due date so the delay remains visible.
Also distinguish a review date from an expiry date. Documents such as Patient Group Directions have specific validity arrangements. An expired PGD cannot simply be treated as an overdue practice policy and given an administrative extension. NHS England’s immunisation guidance explains that an alternative authorisation, such as an appropriate Patient Specific Direction, is needed where a PGD has expired and has not been updated.
-
Record a review as complete when the agreed content checks and approval have taken place. Track publication, staff communication and any training separately if they remain outstanding. This prevents an approved document being mistaken for a fully implemented change.
Keep a short review record identifying who checked the policy, the sources considered, the decision and any amendments. A review may reasonably conclude that no change is needed. Record that outcome rather than manufacturing revisions.
The next review date should follow the agreed interval and relevant requirements. A change of filename, formatting or contact detail should not be recorded as a full review unless the wider content was checked.
Publish the approved version, remove superseded copies from routine use and retain the history under the practice’s records arrangements. Tell affected staff what has changed and what they need to do.
An overdue report is useful management information, but a headline completion percentage can conceal important gaps. Partners or governance leads should also be able to see higher-risk delays, policies without owners and changes still awaiting implementation.
-
Check whether the dates in the register describe real activity and whether the process survives absence, competing priorities and staff turnover. A small sample of policies can reveal weaknesses that a complete-looking dashboard misses. Start with higher-risk documents and recent reviews.
Match the records: do the register, policy header and approved version agree?
Check the meaning: are last review, approval, effective and next review dates clearly distinguished?
Confirm ownership: does each owner know what is due, with cover available?
Look ahead: is time allocated for reviews due in the next three months?
Inspect overdue work: is there a recorded assessment and a credible completion plan?
Check recent changes: have incidents, service changes and supplier updates prompted appropriate action?
Follow through: have approved changes reached the staff who need them?
Watch for dates rolled forward in bulk, reminders sent to former employees, duplicate policies with different deadlines and documents marked complete while approval is still pending. These problems do not necessarily require a new platform. They require the practice to establish which record is authoritative and who acts on it.
-
Begin by making the next three months’ work visible. Resolve uncertainty about ownership and risk before attempting to tidy every historic document.
Bring active policies into one review register and flag missing information.
Identify overdue and higher-risk reviews for prompt assessment.
Allocate owners, approval time and realistic completion targets.
Set a recurring check of progress, including unfinished implementation actions.
A useful review calendar tells the practice what needs attention—and helps ensure someone follows it through.