For years, keeping Box’s internal policies audit-ready meant endless spreadsheets, a deluge of PDFs, and a lot of scrolling.
Every quarter, the Box Policies and Standards team had to manually open each of our company’s nearly 100 policies, scroll to signature pages, and pull out details that mattered: who owned it, when it was last signed, and whether it was due for review. It’s the kind of work that’s invisible when it goes right — and costly when it doesn’t.
“Before, we relied on manually tracking our annual reviews using Excel and the actual policy PDFs themselves,” said Milena Haile, Senior Trust Enablement Analyst at Box. “To find the most accurate information, we had to scroll through each document and manually extract all the data needed, such as last update date, policy owner’s name, and approver names.”
To solve this challenge, the team created a metadata template that turns every policy PDF into structured, searchable data. Now, that data gets consolidated into a reliable inventory dashboard using Box Apps.
Key takeaways:
- The Box Policies and Standards team saved roughly $14,000 in year one, mostly by eliminating manual lookups that took two hours per request
- Team morale improved and customer trust increased by eliminating repetitive manual work, establishing a source of truth for data accuracy and meeting compliance expectations
- A self-service Box Hub lets employees find and read policies, and it has logged more than 6,200 views since its April 2025 launch
Cutting review prep time
Preparing a single quarter’s batch of roughly 25 policies used to take about 12 hours, with each policy requiring a minimum of 15 minutes of research to verify data points. Some could take up to 30 minutes.
Answering one-off questions from leadership about policies that required signatures, either as an owner or approver, could eat up another two hours. Multiply that across four quarters and dozens of ad hoc requests, and the team was spending roughly 100 hours a year chasing down information buried in PDFs.
With policies spanning security, engineering, legal, and other areas, the team needed to stay current to support compliance certifications, pass audits, and meet customer expectations. A missed review could jeopardize a certification renewal or shake a customer’s confidence that Box is meeting its compliance obligations. And because ownership data lived across PDFs, Box Notes, spreadsheets, and someone’s memory, there was no single source of truth.
With its in-house solution, the Box team replaced hours of manual PDF scrolling with an automated metadata template that cut annual review prep time by 96%. Here’s how they did it:
The template tells the system exactly what to pull from each document:
- Policy ID from the header
- Organization from the footer
- Policy name from the title page
- Change description
- Reason for change from revision history table
- Owner, approvers, and last signature date from document approvals on the final page
Once extracted, that metadata feeds directly into a custom Box Apps dashboard that organizes the roughly 100 policies by quarter and by org, no manual sorting required.
The metadata template extracts the most accurate data directly from the PDFs of our policies and saves it on our Box Apps dashboard.
“Now, with metadata extraction and Box Apps, the metadata template extracts the most accurate data directly from the PDFs of our policies and saves it on our Box Apps dashboard, which has now become our most reliable policy inventory containing all key data needed,” Haile said.
Time savings translate to $14K
Setting up the policy tracking sheet and kicking off the annual review process, previously 12 hours of work, has dropped to 2 hours total.
“A process that used to take us many hours now gets done much faster, and we have the most accurate content to ensure an efficient policy review,” Haile said.
A process that used to take us many hours now gets done much faster, and we have the most accurate content to ensure an efficient policy review.
By the numbers, the team estimates the shift saved roughly $14,000 in year one, with $12,000 of that tied to eliminating manual lookups alone. Just as important, because the data comes straight from the source document instead of a manually retyped spreadsheet, there’s less room for the transcription errors that used to creep into a 25-policy quarterly batch.
“Before, this was repetitive work in Excel, and by the time it was done, it was already out of date. Now we have a single source of truth that’s automatically updated in real time,” said Bryan Culp, Box Senior Director, Trust.
Boosting team morale and customer trust
The impact goes beyond monetary and time savings. It lifts team morale and frees up team members’ time to focus on work that requires human judgment and strategic thinking. When Haile was an intern learning about and supporting the team’s policy review process, she asked a question at the end of her internship that set a higher expectation for the team:
“So by the time I come back as a full-time employee, all of this will be automated, right?”
That lighthearted comment helped shape the team’s strategic direction for what all customers want.
Having a single source of truth for policy metadata also means policies will not accidentally fall through the cracks due to an inaccurate last review date, a missed annual review, or unclear policy ownership. This helps ensure compliance requirements are met and certifications are obtained, both of which are needed to build customer trust and support the business.
Self-service that scales
Before last year, policies lived on a Confluence page that most employees didn’t know existed. Finding a policy meant knowing whom to ask.
The team’s self-service Box Hub changed that. It links directly to the published policy documents folder, so any employee can search and read a policy without pinging the team first. An FAQ built into the Hub answers the most common questions policy owners have about responsibilities and review cycle requirements.
We used to get these questions directly, and we would either search the policy or direct them to the policy ourselves. Now, we let our Hub answer basic questions so we can spend more time focused on strategic policies and standards work.
The Hub has become the default stop for employees with policy questions, particularly on security as well as governance, risk, and compliance (GRC) topics, and it’s logged more than 6,200 views since launch. Team members can now ask Box’s AI agent a direct question, such as what the policy is on traveling with company equipment, and get an immediate, accurate answer pulled straight from the relevant policy.
“We used to get these questions directly, and we would either search the policy or direct them to the policy ourselves,” Haile noted. “Now, we let our Hub answer basic questions so we can spend more time focused on strategic policies and standards work.”
Workflow automation on deck
Creating the review ticket for each policy and assigning it to the right owner is still a manual step today, and that’s why they’ve made a Box Automate workflow, currently in pilot, their next target. That process will trigger reviews and assign ownership automatically based on the same metadata already powering the dashboard.
Policy review scheduling is a clear example of a larger shift happening across Box, where AI agents (with access to the right content) transform manual, error-prone busywork into workflows teams can trust. For the team, the lesson has been less about the specific tool and more about the mindset shift it enabled.
Instead of asking “How do we hire more people to keep up with this?” they asked, “How do we make our existing content answer these questions itself?”
That reframing, more than any single piece of technology, is what turned a recurring quarterly headache into a problem that solves itself. And it’s a template other teams can easily adopt.
Streamlining with one secure platform
For compliance teams, the opportunity extends beyond preparing policies for review. Policy management with Box gives you a secure, governed system for managing the full policy lifecycle: from structured intake and metadata extraction to remediation, approval, and publication.
You can maintain a real-time inventory of policy owners, versions, statuses, and review dates; automate workflows while keeping people in control of key decisions; and publish approved policies in a self-service portal where employees can find trusted guidance and ask AI-powered questions.
The result is stronger oversight, fewer manual handoffs, and more time for compliance teams to focus on risk, training, and readiness.
If your team is interested in building a similar workflow, check out our policy management solution in the video above, or get connected with an expert through our Solutions Marketplace.
