de.iterate is an Australian GRC platform with policy management built in. A policy only works if people know what's in it. de.iterate handles the whole policy lifecycle, from first draft to attestation, and our Smart Policies are written so your staff make it to the end.
Instead of managing policies in one place, risks in another, evidence in folders, and audits through a last-minute scramble, de.iterate connects the whole system. That means better visibility, clearer ownership, stronger assurance and less time lost to manual admin. The current platform spans policies, assurance tasks, registers, evidence, reporting, Trust Centre capabilities, auditor access and support for multiple frameworks.
We help you get your ducks in a row.
“Which version is current?”
“The one in the shared drive. No, the other shared drive.” Your acceptable use policy runs to 38 pages, and the only proof anyone read it is a tick box on an onboarding form from 2022.
Larger organisations have an intranet for this, and the problem has moved rather than gone. The policy library holds 140 documents across four business units and three countries, each with its own owner, its own review cycle and its own idea of what the acceptable use policy should say. Staff attested to a version in the annual campaign; the version was superseded two months later; the attestation records still say “complete.” Legal owns the register, HR owns the attestations and security owns the content, and the only person who can say which policies apply to a given employee is on leave.
When the auditor asks who approved the last change, the answer involves a lot of scrolling through old emails.
A policy only counts when there’s one current version, a record of who approved it, and proof that the people it applies to have read it since it last changed. de.iterate keeps all three in one place. Policies are written in plain English from expert templates, every change and approver is recorded, distribution matches the policy to the people who need it, and attestation includes evidence that it was read rather than clicked.
Tailor templates written by our GRC experts instead of starting from a blank page. Smart Policies explain your rules in plain English, ready for onboarding and ongoing training.
Route each policy for review and approval. The audit trail records every change and every approver, and the version-controlled repository keeps the full history.
Distribute policies to staff, contractors and third parties from the Admin Panel, or assign them to individuals. When a policy changes, reset its read status and everyone re-attests.
Reading reports from the Policy Reader include policy ‘dwell time’ so you can see who’s reading and who’s not. Results from policy quizzes become attestation evidence you can hand to your auditor. Use our template quizzes or write your own.
Set a review cycle for every policy and name its owner. de.iterate tracks the next review date, reminds the owner before it falls due, and flags anything overdue on the dashboard, so the auditor’s “when was this last reviewed?” has an answer with a date on it.
Link each policy to the controls it supports and the frameworks that require it. When an obligation changes, you can see which policies need updating, and when an auditor asks how you meet a clause, you can trace it from the standard to the policy to the people who attested to it.
A risk register with a pulse, with inherent and residual scoring, heatmaps and risk appetite.
Every obligation traced to the evidence that meets it, across 25+ frameworks.
Scheduled controls testing, with the evidence ready before your auditor asks.
ISO 42001, AI impact assessments and an inventory of the AI in your business.
Find your personal information, see where it goes and keep your privacy policy current.
ISO 9001, ISO 14001 and ISO 45001, running alongside everything else you manage.
