After a major permitting system replacement, auditors find access and retention policies still describe the retired platform. What operating practice was missing?
Select an answer to reveal the explanation.
Short Explanation
Policies are living documents, not museum plaques. When you swap the whole permitting system, schedule a review so the rules still match reality—or auditors will find yesterday’s map taped to today’s building.
Full Explanation
After a major permitting system replacement, access and retention policies that still describe the retired platform reveal a missing operating practice: periodic and change-triggered policy review must be part of the governance model so documents stay aligned with live systems. Policies that never change once approved become historical fiction and fail audits that compare written controls to actual civic platforms. Updating only technical runbooks while leaving policies historical fails because auditors and staff look to policy for authorized practice, not only to engineering notes. Deleting policies after go-live so audits have fewer documents fails by removing evidence of control rather than refreshing it. Exam caveat: change-triggered review is as important as calendar review—system replacements are classic triggers. Operational check: add policy owners and review dates to the register, require a policy impact checklist in the permitting cutover plan, and verify post-go-live that access and retention language names the new platform. Keep the revised policies with the municipal change record so future replacements inherit the same discipline. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.