Policy Attestation

Policy attestation is the record of an employee confirming they've read a policy and agree to follow it. Stronger versions ask for something substantive too, like an affirmation that the person has no undisclosed conflicts. Almost no law requires attestation, and it's still how you prove a policy reached the people it binds, which is the first thing a regulator or a plaintiff asks.

Attestation, acknowledgment, or certification: what's the difference?

Compliance teams generally draw the line like this, and it's worth drawing it the same way inside your own program so the words mean something.

The useful distinction is what you can prove later. An acknowledgment proves delivery. An attestation proves delivery plus a statement of facts you can test against what actually happened. Certification adds named personal accountability, which is why it sits with a handful of officers rather than the whole workforce. Under 18 U.S.C. 1350(a), each periodic report containing financial statements an issuer files with the SEC "shall be accompanied by a written statement by the chief executive officer and chief financial officer."

What should a policy attestation ask?

A signature on "I have read the policy" is the floor. Programs that get real value out of the exercise ask for three things.

• Receipt and understanding. Name the policy and its version. A generic "I've read all company policies" proves nothing about which document reached the person.
• A commitment to follow it, stated in the first person.
• A disclosure prompt tied to the policy's subject. Do you have a relationship, an outside role, a gift, or an investment that this policy would require you to disclose? Yes or no, with a free-text field on yes.

That third piece converts a compliance checkbox into an intake channel. Attestation cycles routinely surface conflicts nobody would have filed on their own, and the disclosures are date-stamped, which matters when someone later asks what the company knew and when.

Keep the language short and readable. If people can't understand what they're attesting to, the record you've built is weaker than it looks.

When is policy attestation legally required?

Rarely, and the exceptions are specific.

What the Sentencing Guidelines ask for is training. Section 8B2.1(b)(4) requires reasonable steps "to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program," by conducting effective training programs and otherwise disseminating information appropriate to people's roles and responsibilities.

The DOJ's guidance treats certification as evidence. The Justice Department's Evaluation of Corporate Compliance Programs, updated September 2024, states under Training and Communications that "prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners." That's what prosecutors look for when they assess a program, and it sits alongside the seven elements of an effective compliance program.

Two real requirements are worth naming.

• SEC-registered investment advisers. 17 CFR 275.204A-1(a)(5) requires an adviser's code of ethics to include "provisions requiring you to provide each of your supervised persons with a copy of your code of ethics and any amendments, and requiring your supervised persons to provide you with a written acknowledgment of their receipt of the code and any amendments." Note the scope precisely: it's acknowledgment of receipt, and it runs to amendments as well as the original.
• Federal information systems. NIST SP 800-53 Rev. 5 control PL-4, Rules of Behavior, requires an organization to "receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system." PL-4 also requires individuals who acknowledged a previous version to read and re-acknowledge when the rules are revised or updated. That makes it the anchor for an acceptable use policy attestation.

One correction, because this one circulates widely. HIPAA has no employee policy-attestation requirement. The only written acknowledgment in the HIPAA rules runs the other way: under 45 CFR 164.520(c)(2)(ii), a covered health care provider with a direct treatment relationship must, "except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgment of receipt of the notice" of privacy practices from the individual. If a vendor tells you HIPAA requires workforce policy attestation, ask them for the cite.

How often should people re-attest?

Annual is the working convention for a code of conduct and for conflicts, mostly because it lines up with disclosure cycles and with training calendars. Treat it as a control you chose rather than one you inherited.

Two triggers matter more than the calendar.

• Material change. When a policy changes in substance, re-attest to the new version rather than waiting for the annual cycle. Version the attestation record so you can show which text each person saw.
• Role change. Moving into a role with expense authority, procurement responsibility, or access to material nonpublic information should trigger the relevant attestations on the spot.

Where a rule sets its own cadence, follow it. The adviser code-of-ethics acknowledgment above attaches to amendments, so an amendment starts a cycle regardless of where the year sits. PL-4 works the same way for rules of behavior.

How do you evidence attestation at scale?

Assume you'll have to reconstruct it three years later for someone hostile. That standard sets the requirements.

Store the policy version the person saw, not a link to the current one. Keep the timestamp, the identity, and the exact wording of the statement. Track the denominator as carefully as the numerator, since 100 percent completion of an incomplete roster is the failure mode auditors look for first, and contractors, new hires mid-cycle, and people on leave are where rosters go wrong. Route disclosures to a reviewer with a documented outcome, because an unreviewed disclosure is worse than no disclosure. And retain the records at least as long as your broader compliance retention schedule requires.

FAQ

Is policy attestation legally required?

Rarely as a general matter. Specific regimes do require it, including 17 CFR 275.204A-1(a)(5) for SEC-registered advisers and NIST SP 800-53 PL-4 for federal systems. The Sentencing Guidelines at 8B2.1(b)(4) call for periodic training and communication, and the DOJ's ECCP treats certification as evidence that policies have been integrated into the organization.

Does HIPAA require employees to attest to policies?

No. The only written acknowledgment in the HIPAA rules runs from the individual to a covered health care provider with a direct treatment relationship, under 45 CFR 164.520(c)(2)(ii).

What's the difference between attestation and acknowledgment?

Acknowledgment says you received and read the document. Attestation adds a statement about your own situation, such as confirming you have no undisclosed conflicts, which gives you something testable later.