Policy management across a group of companies: sharing policies with subsidiaries
Originally published:
Last updated:
Group policy management means that the parent company decides the policies that apply across the group, and every subsidiary gets them to its own people and keeps its own record of who confirmed them. The wording is shared. The follow-up is local.
It sounds simple until a group has five, ten or thirty companies, each with its own HR system, its own managers and its own way of working. Then the same code of conduct exists in four versions, nobody is sure which one the newest subsidiary received, and the question an auditor asks at group level cannot be answered for each company.
This article covers what to share and what to keep local, the common ways groups organize it, and what a setup looks like that holds up when someone asks for proof.
Parent company
Writes the group policy once
Nordic subsidiary
- Its own 140 people
- Its own cycle and reminders
UK subsidiary
- Its own 85 people
- Its own cycle and reminders
US subsidiary
- Its own 210 people
- Its own cycle and reminders
Why policies get hard in a group
A single company has one policy owner, one list of employees and one place to keep the record. A group has several of each, and they rarely line up.
- The wording drifts. A group policy is emailed to each subsidiary, and each one saves its own copy. One translates it, one shortens it, one never updates it. A year later the group has several codes of conduct.
- New versions do not arrive everywhere. The parent updates the anti-bribery policy. Three companies send it out again. Two never heard about the change.
- People belong to the subsidiary, not the group. Each company knows its own staff, managers and new hires. The parent rarely has an up-to-date list of everyone, and often should not.
- Nobody sees the whole picture. Asking “has every company in the group sent out the new information security policy?” means emailing each one and waiting.
What to share, and what to keep local
Not every policy belongs at group level. A useful rule: share the policies where the group carries the risk or makes a promise to the outside world, and leave the rest to the company that lives with it.
Shared from the parent
Where the group carries the risk
- Code of conduct and business ethics
- Anti-bribery and corruption
- Information security and acceptable use
- Data protection and privacy
- Whistleblowing and speaking up
- Sanctions, competition law and other group-wide legal duties
Kept by each company
Where local law or the local way of working decides
- Working hours, leave and other HR rules that follow local law
- Health and safety for a specific site or type of work
- Routines that only make sense in one office, team or product
The line moves from group to group. What matters is that it is drawn on purpose, so a subsidiary knows which policies it may change and which it may only send.
Four common ways groups organize it
1. Email the policy to each company
The parent sends the document to a contact in each subsidiary and asks them to roll it out. It is quick to start and impossible to follow up: the parent cannot see who sent what, to whom, or which version.
2. One shared folder or intranet for the group
Policies live in one SharePoint site or intranet. That solves where the current version is, but not whether anyone read it, and subsidiaries on other systems or tenants often cannot reach it at all.
3. One big organization in one system
Every employee in the group is added to one account in a policy tool. The parent sees everything, but so do administrators who should only see their own company, and each subsidiary loses the freedom to run its own cycles, deadlines and reminders.
4. A separate system for each company
Each subsidiary runs its own tool. Every company is in control of its own people, but the group policy is copied by hand into each one, and there is no single view of where the group stands.
| Approach | One wording | Proof per person | Each company runs its own | View of the group |
|---|---|---|---|---|
| Email each company | ||||
| One shared folder | ||||
| One big organization | ||||
| A system per company | ||||
| Locked copies per company |
What a setup that holds up looks like
The groups that get this right combine the control of the first option with the independence of the last. Their setup has six traits:
One source
The parent writes each group policy once: one name, version, document and date.
A locked copy
A subsidiary can send it, but not change the wording.
Local delivery
Each company picks its people and runs its own cycle, deadline and reminders.
Its own people
No company sees another's employees. Admins manage only their own.
New versions flow down
An update reaches every copy and is confirmed again.
One view of the group
Status per company, without having to ask.
The structure should also follow the real organization chart. If a subsidiary has companies of its own, it should be able to pass a policy it received further down, without the parent having to know every company at every level.
What audits and frameworks ask for across a group
Frameworks do not use the word group, but they ask the same question in every company in scope. ISO 27001 requires the information security policy to be communicated within the organization (clause 5.2) and the people doing work under its control to be aware of it (clause 7.3). When several companies sit under one certificate, or each holds its own, the evidence has to exist for each of them.
In practice an auditor picks a company and a person and asks: which version did this person confirm, and when? The answer has to come from that company's record, and the version has to match the one the group approved. For what that record should contain, see how to prove policy acknowledgement during an ISO 27001 audit.
Version control matters twice as much in a group. If the parent updates a policy and one subsidiary keeps confirming the old one, the group has two truths and one of them is out of date. More on that in policy version control best practices.
How to get started
- Map the group as it is. List the companies, which ones sit under which, and who runs policies in each.
- Decide which policies are group policies. Start with the few where the group carries the risk: conduct, anti-bribery, information security, data protection.
- Name an owner for each group policy at the parent, and a contact in each company who sends it to their people.
- Agree how a new version travels. Who approves it, how every company gets it, and how soon it has to be confirmed again.
- Decide what the parent should be able to see, and what stays with each company. Usually that is status per company, not every person's name.
How Policy Confirm handles a group
With Policy Confirm Enterprise, the parent company and its subsidiaries are set up as a group, and each company stays its own organization with its own people, groups and administrators. The parent writes a group policy once and ticks the companies that should get it, at any level below. Each one gets a locked copy with the same name, version and document, and sends it to its own people in its own cycles. A subsidiary with companies under it can send the policy on. A new version reaches every copy, and the parent sees where every company stands.
The group runs on one Standard plan, with recipients counted across the whole group, and each extra organization is added from $15 a month.
Nighthawk Group
Settings · Group structure
Group structure
5 companies below- Nighthawk GroupYour organizationGroup parent
- SubsidiaryParent
- Subsidiary
- Subsidiary
- SubsidiaryParent
- Subsidiary
Each company keeps its own people, groups and policies. Click a company to see its view.
Frequently asked questions
What is group policy management?
It is how a group of companies decides which policies apply across the group, gets them to the people in every subsidiary, and keeps a record in each company of who confirmed which version. The parent owns the wording of group policies, and each company owns the delivery to its own people.
Should every subsidiary have its own version of a group policy?
No. For policies the group owns, such as the code of conduct or the information security policy, every company should send the same text and version. Local additions belong in a separate local policy, so the group version stays the same everywhere.
How do you roll out a policy update to every company in a group?
The parent publishes the new version once, every company receives it, and each sends it to its own people for a new confirmation. The parent then follows the status per company until every one has sent it and its people have confirmed.
Can the parent company see the employees of its subsidiaries?
It does not need to. A good setup lets the parent see where each company stands with a group policy, while the people, groups and individual records stay with the company they belong to.
What evidence does an auditor expect from a group?
The same as from a single company, but for each company in scope: which version of the policy a person confirmed, and when, and that this version is the one the group approved. The record has to be retrievable from the company the person belongs to.
Share policies across your group
Start freeAbout the author
The team behind Policy Confirm has hands-on experience across full-stack development, product growth, compliance leadership, and executive technology roles such as CTO and CPTO. They have led and supported ISO 27001 implementations, policy governance initiatives, and audit-driven compliance projects in regulated environments. This background informs a practical, audit-oriented approach to policy management and policy acknowledgements.
Related content
- Enterprise: group structures and shared policies
- How to prove policy acknowledgement during an ISO 27001 audit
- Policy version control best practices
- Vendor policy acknowledgement
Legal disclaimer
The information provided in this article does not, and is not intended to, constitute legal advice; instead, all information, content, and materials available on this site are for general informational purposes only. You should contact your attorney to obtain advice with respect to any particular legal matter.