Policy management statistics from 2025 show that 73% of organizations use purpose-built technology for policy and procedure management, while 88% of US banking respondents still use manual processes and spreadsheets often or sometimes.
In the same year, 56% of organizations made or planned policy changes in response to shifting US government priorities, and compliance hours at large banks had grown 61% since 2016.
See our complimentary research paper on top trends in AI compliance usage for more data on this topic.
What These Statistics Cover
Each figure below comes from NAVEX’s 2025 State of Risk & Compliance Report, PwC’s Global Compliance Survey 2025, the Wolters Kluwer 2025 Regulatory & Risk Management Indicator, the Bank Policy Institute’s 2024 compliance burden survey, or research from the Conference of State Bank Supervisors (CSBS).
NAVEX and PwC survey organizations across industries and regions, with financial services as one segment. Wolters Kluwer, the Bank Policy Institute, and CSBS cover US banks only.
How Organizations Manage Policies Today
73% of risk and compliance professionals in NAVEX’s 2025 survey said their organization uses purpose-built technology for policy and procedure management. The survey covered 999 respondents in the US, UK, France, Germany, Japan, and other markets between April and May 2025. Policy management ranked just behind ethics and compliance training, where 78% used dedicated technology.
In the Wolters Kluwer 2025 Indicator survey of US banking respondents, 88% reported using manual processes and spreadsheets often or sometimes. The two figures are consistent with each other. An institution can own a policy system and still route drafts, approvals, and exception tracking through email and spreadsheets.
PwC’s 2025 survey of 1,802 executives points the same direction: 82% plan to invest more in technology for compliance automation, and 49% already use technology for 11 or more compliance activities. Interest in automated compliance management is broad, and adoption is uneven from one activity to the next.
How Organizations Measure Policy Program Effectiveness
NAVEX asked respondents how they measure the effectiveness of their policy management program. Training results lead the list, and attestation completion sits near the bottom.
| Effectiveness Measure | Share of Respondents |
|---|---|
| Employee training results | 50% |
| Survey feedback | 43% |
| Improved efficiency in completing policy management tasks | 38% |
| Employee ability to search and find policies quickly | 37% |
| Policy contribution to organizational and employee culture | 35% |
| Reduction in policy-driven compliance failures | 32% |
| Completion rates for attestations | 30% |
| Reduction in legal and regulatory fines | 24% |
Only 30% track attestation completion rates, and 32% track reductions in policy-driven compliance failures. For a bank, those two measures produce the most direct evidence that a policy program works: a record that employees acknowledged each policy, and a count of findings and policy exceptions that trace back to it.
Policy Change Volume and the Workload Behind It
56% of NAVEX respondents said their organization had made, or planned to make, changes to policies in light of shifts in US government priorities and enforcement. That was the highest share of any program element in the survey.
85% of executives in PwC’s survey say compliance requirements grew more complex over the past three years. Wolters Kluwer’s banking respondents expect some relief: 67% anticipate a reduction in regulatory burden, and 63% plan to invest in automating regulatory change management.
The Bank Policy Institute’s 2024 survey of 20 large banks found that employee hours dedicated to complying with financial regulations and examiner mandates rose 61% between 2016 and 2023, while total employee hours rose 20%. Board time devoted to regulatory or supervisory compliance reached 43% in 2023, up from 27% in 2016.
CSBS research covering 2015 through 2024 found that banks in the smallest asset-size quartile spent roughly 11% to 15.5% of payroll on compliance tasks, compared with 6% to 10% at the largest institutions.
In the 2025 CSBS survey of 268 community banks, personnel made up 60% of compliance expenditures. Policy upkeep draws on that same pool of staff hours.
What These Statistics Mean for a Policy Management Program
Owning policy software and running a controlled policy process are separate milestones. The distance between NAVEX’s 73% technology adoption figure and Wolters Kluwer’s 88% manual-process figure suggests many institutions sit between the two, with a system of record for approved documents and manual handling for the steps around them.
A program that tracks training results but not attestation completion or policy-driven failures has little to show an examiner who asks how policies are enforced. With policy change volume high and compliance hours already stretched, automation pays off.
Frequently Asked Questions
How often do organizations change policies in response to regulatory shifts?
56% of organizations made, or planned to make, changes to new or current policies in response to shifts in US government priorities and enforcement policies, per NAVEX’s 2025 research. Policies drew the highest share of any program element in that survey.
How do organizations measure policy management effectiveness?
Employee training results are the most common measure at 50%, followed by survey feedback at 43%, according to NAVEX’s 2025 report. Only 30% track attestation completion rates, and 24% track reductions in legal and regulatory fines.
How much of a bank’s resources go to compliance?
Compliance hours at large banks rose 61% between 2016 and 2023, per the Bank Policy Institute. CSBS research found the smallest community banks spend roughly 11% to 15.5% of payroll on compliance tasks, compared with 6% to 10% at the largest institutions.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring