---
title: "Policy contradictions: find them before your auditor does"
canonical: "https://auditbadger.com/blog/policy-contradictions-find-them-before-your-auditor-does/"
last-updated: "2026-10-09"
---

# Policy contradictions: find them before your auditor does

By Maciej • Published 2026-10-09 • 9 min read • Categories: Product Updates, Policy Management, Compliance Governance, Soc2, ISO

Created with AI assistance. AuditBadger retains editorial control and responsibility.

**TL;DR:** AuditBadger has a new, experimental document consistency check. It reads every current document of a project together (drafts first, then published versions, AI-generated and uploaded alike, up to 40 per check) and compares them with each other and with the records you keep in AuditBadger: people and roles, duty owners, risk scoring, data classification, vendors, assets, the risk register and, for ISO 27001, the security objectives and the Statement of Applicability. It also checks each document's text against its own review cadence setting. On AuditBadger's own 20 policy documents it found 13 issues, 9 with a fix ready to apply, including inconsistent incident reporting deadlines, roles with two names and a former co-founder still named in the policies. Findings come in five kinds (contradiction, different terms, gap, duplication, missing reference), ranked by severity with quotes and a recommendation. Most come with an exact text fix you review as a diff, can edit, and apply yourself; a fix to a published document creates a new draft version that goes through normal approval, and every fix can be restored. The check is advisory, runs only when you start it, does not judge framework coverage and needs AI enabled on the project. After a short demo it can be switched on for one free check of up to 20 documents; subscribers get it at no extra cost.

Your policies were written at different times, by different people (and lately by AI, one document after another). Each one reads fine on its own. Put them side by side and they start to argue: one says access is reviewed every quarter, another says once a year. One names an Incident Manager nobody has ever met. AuditBadger now has a document consistency check that does that side-by-side reading for you. It compares all of a project's documents with each other and with what you have recorded in AuditBadger, then proposes the exact text change that fixes each problem. You review it, adjust it, and apply it. Or you don't.

![](https://auditbadger.com/assets/document-consistency-findings-5337d9b6.png)
_A finished check on six documents: two people who do not work at the company, and an access review that is quarterly in one document and yearly in another_

## Why do policies contradict each other?

Because nobody cross-reads twenty policies. An auditor does, though. They read your policies side by side, and that is exactly how they find the contradictions you did not know you had. Then, in a SOC 2® Type II audit, they test what the policy promises. If your Access Control Policy says system owners review production access every quarter, the auditor will ask for four quarterly reviews, whatever your employee handbook says.

Drift comes from a few predictable places:

- Documents generated one after another, each with only a summary of the ones before it. (Our own policy generator works this way, which is a big part of why we built the check.)
- Older documents written by hand before you moved into AuditBadger, then uploaded as they were.
- People who left, or were never there: a former manager, a placeholder name, a name an AI made up.
- Settings that moved while the text stayed: a document says it is reviewed every two years, its review setting says every year.
- Renamed things: the Security Committee in one document is the Security Steering Committee in another.
- References to plans and procedures that were never written.

We ran the check on our own policies first. We took AuditBadger through its own SOC 2® Type II audit using only AuditBadger, and now we are working towards ISO 27001, so we pointed the check at our own 20 documents and expected a quiet afternoon. It found 13 issues, and 9 came with a fix we could apply on the spot. Our incident reporting deadline was not one deadline: different documents gave different answers, in the one process where the clock actually matters. Our roles had aliases. And our former co-founder was still in our policies. Nobody had noticed, because nobody reads twenty policies side by side (except auditors).

None of these is dramatic. Each one is a question from the auditor that you would rather answer before the audit than during it. If you want the longer version of what auditors look at beyond the policy text, [policy review evidence: what auditors check beyond the text](/blog/policy-review-evidence-what-auditors-check-beyond-the-text/) covers it.

## What does the consistency check compare?

When you run a check, AuditBadger reads every current document of the project: the draft when there is one, otherwise the published version. AI-generated and uploaded documents are treated the same way. Then it compares three things:

- **The documents with each other.** Review cycles, deadlines, owners, names, classification levels.
- **The documents with your records.** The active people and their roles, who owns which duty, the risk scoring method, data classification levels, training courses, incident types, assets, vendors, integrations, business continuity, the risk register, and for ISO 27001 projects the security objectives and the Statement of Applicability.
- **Each document with its own review setting.** The cycle the text states against the review cadence configured on the document.

Every finding gets a severity, the documents involved, the exact quotes that show the problem and a recommendation. There are five kinds: a _contradiction_ (two documents, or a document and your records, give different values for the same thing), _different terms_ (one role or body under two names), a _gap_ (a document relies on a rule or procedure nothing defines), a _duplication_ (the same rule written twice in different words, so the next change updates one and forgets the other) and a _missing reference_ (a person, plan or policy that does not exist).

![](https://auditbadger.com/assets/document-consistency-more-findings-aaf387d6.png)
_The rest of the same check: a 30 versus 60 day rule, two names for one committee, a stated review cycle that differs from its setting, and a plan that does not exist_

A note on the screenshots: they use Larkspur Analytics, our fictional demo company. Its four policies sit next to two documents its team wrote by hand before moving to AuditBadger, an Incident Response Procedure and an Employee Security Handbook. Notice where most of the findings land. Old documents are where the invented names and the outdated cycles hide, and the check reads them against your current records, so you do not have to rewrite them just to be sure they still hold.

## How do you fix a finding?

Most findings come with the exact sentence to change, in the document's own language and tone. Click Review fix and you see each change as a before-and-after diff. If you would phrase it differently, edit the replacement text and update the preview. Then apply it, or dismiss the finding if you disagree (a dismissed finding can be reopened later).

![](https://auditbadger.com/assets/document-consistency-review-fix-ff5ae882.png)
_Reviewing the fix for the invented Incident Manager: editable replacement text, a diff, and a note that the fix creates a new draft version_

We were strict about what a fix is allowed to do, because a tool that quietly rewrites your policies would be worse than no tool:

- Every fix is an exact text change you can see, edit and approve. No rewritten sections, no silent edits.
- A fix to a published document creates a new draft version. That draft goes through your normal approval and publication, so nothing reaches your readers without the usual sign-off.
- If an approved draft would change, the review screen warns you that the approval will lapse. A document waiting for approval is left alone until the decision is made.
- Every applied fix lands in the document's activity with a before-and-after comparison, and can be restored in one click.

That is the same rule as everywhere else in AuditBadger: AI drafts and suggests, a person confirms, and the record shows which was which. If you are wondering how auditors feel about AI in the loop at all, [will your auditor accept AI-generated evidence?](/blog/will-your-auditor-accept-ai-generated-evidence/) goes into it.

## What if the document is right and the setting is wrong?

It happens. The procedure says it is reviewed every two years, the review setting in AuditBadger says every year. Maybe the setting was a default nobody thought about, and two years is what you actually decided. So for findings about a setting AuditBadger records (a document's review cadence, or how often a recurring meeting such as security oversight should happen), you get a choice: change the text to match the setting, or update the setting to match the text. Each option has its own button, and the finding closes with the first one you apply.

![](https://auditbadger.com/assets/document-consistency-two-fixes-b6a2bd54.png)
_One finding, two fixes: change the procedure text, or change its review cadence_

The meeting cadences come from the new [compliance calendar](/features/compliance-calendar/), which tracks every recurring review and meeting date in one list.

## What the check does not do

- It is advisory. It never edits a document by itself, and it never blocks publication, approval or audit readiness.
- It compares documents with each other and with your records. It does not tell you whether a policy meets a framework requirement. That is a different question, and a qualified auditor makes that call.
- It reads at most 40 documents per check.
- It runs when you start it, not on a schedule. After you change documents, the check page tells you which ones changed since it ran, and unchanged documents are not read again, so a re-check is quicker than the first run.
- Each finding is an AI suggestion, not an audit opinion, and every check says so.
- AI agents connected to AuditBadger can read the latest check and its proposed changes, but they cannot apply or dismiss anything. An agent that wants to fix a document proposes the change through a reviewed change set, and a person approves it.

## How to get it

The check is experimental and switched on per account. Start with a 20-minute demo with the founding team: we run a check on a demo company, so you see real findings and real fixes before anything changes. If you then want to try it on your own policies without buying the rest of AuditBadger, we will switch it on for one free check of up to 20 documents. Upload your documents, run the check, read what it finds.

Projects need AI enabled to run it, because the document text goes to the AI model that does the comparison (AuditBadger trains nothing on it). Once it is on, open the project's Documents page, choose Consistency checks and click Run consistency check. It runs in the background and shows its progress while it reads.

For subscribers it is part of the flat price, with no AI add-on and no per-check fee. The full capability list is on the [document consistency check feature page](/features/document-consistency-check/). If you are still deciding which policies you need in the first place, [the minimum policies you need for SOC 2](/blog/the-minimum-policies-you-need-for-soc-2-compliance-mapped-to-trust-services-criteria/) is a good place to start, and our [guide to user access reviews](/blog/user-access-reviews-auditors-accept-with-a-template/) covers the quarterly review from the screenshots (the one your handbook should agree with).


## Frequently asked questions

### How often should internal policies be reviewed?

At minimum, annually for stable policies. But fast-changing areas—data privacy, AI usage, security—should be reviewed quarterly. Additionally, trigger events should prompt immediate review: regulatory changes, security incidents, new tool adoption, significant team growth, or audit findings. Set calendar reminders or use automated compliance tools that flag policies approaching their review date.

### How can AI help detect contradictions between compliance policies?

AuditBadger's AI-powered document consistency check automatically compares all your policies side-by-side to find contradictions in review cycles, ownership assignments, named roles, and procedural requirements—exactly the way an auditor would. It then proposes specific text fixes for each inconsistency, helping you resolve policy conflicts before they become audit findings.

### What causes policy contradictions in SOC 2 and ISO 27001 documentation?

Policy contradictions typically arise from documents written at different times by different people or AI, outdated references to former employees, settings that changed while text stayed the same, and inconsistent terminology across documents. AuditBadger's consistency check identifies these issues by comparing your policies with each other and with your actual records in the system.

### Can policy management software prevent audit failures due to inconsistent documentation?

Yes—automated policy consistency checks like AuditBadger's can catch contradictions before auditors do by comparing review cycles, owner assignments, classification levels, and procedural references across all documents. This proactive approach helps small teams avoid common SOC 2 Type II audit questions about mismatched policy commitments, all for $250/month with unlimited users.

### What do auditors check when reviewing compliance policies beyond just the text?

Auditors read policies side-by-side to find contradictions in review frequencies, responsible parties, and procedural commitments, then test whether actual practices match policy promises. AuditBadger automates this cross-document review by comparing policies with each other and with your recorded people, roles, risks, vendors, and review settings to surface inconsistencies before the audit.