GRC Careers: Governance, Risk and Compliance JobsGovernance · Risk · Compliance Careers

Home › AI Governance Insights › Which version should I trust?

Which version should I trust?

By Jonathan Malchow Vega (jonathanmalchowvega.com), Director of Digital Strategy, GRC Careers · November 1, 2026 · 4 min read

Cover titled "Which version should I trust?" An illustrated woman at a wooden desk comparing three versions of a document, tracing one back to an orderly source folder. Jonathan Malchow Vega, knowledgecleanup.com.

Here is a folder most of us have opened at some point. This one is made up, but you will probably recognize it. Three files: “Policy final,” “Policy final revised,” and “Policy final approved.” One has the newest date. One was attached to the email where someone signed off. One is linked from the staff handbook.

Which one would you send to a new colleague?

I presume most people would pick the newest. It seems like the safe bet. It isn’t.

The first two issues of DESCRIBED were about job titles: one job hiding behind five titles, and one title covering very different work. This is the same problem in a different drawer. A label is being asked to do a job that only a description can do.

A save is not an approval

A modification date tells you when someone last touched a file. It does not tell you whether anyone agreed to what changed. Someone could have fixed a typo, rewritten a whole section, or opened the file and saved it by accident. The date looks the same either way.

The usual fix is to tidy up: a new folder, better names, maybe a file called “Policy FINAL v3 USE THIS ONE.” That moves the problem; it doesn’t solve it. The file name is still doing a job it was never built for.

Archives settled this a long time ago

In Issue 02 I wrote about finding aids, and how a good one tells you what is in a collection, what is missing, and what hasn’t been looked at yet. The same habit applies here. Archivists and records managers don’t guess which copy counts. They mark it. Records management even has a name for it: the record copy, the one official version the organization stands behind. Everything else is a draft, a duplicate or a convenience copy.

The point isn’t the vocabulary. The point is that somebody wrote it down.

Three facts on the document itself

For most teams, three facts would settle the folder above.

Owner. One named person who answers for the document. Not a department; a person.

Review date. When it was last checked, and when it should be checked again.

Status. Official, draft or superseded.

With those three facts, the newest file can be a draft and everyone knows it. Without them, the newest file wins by default, and that is how an edit nobody approved quietly becomes policy.

None of this needs new software. It can be a line at the top of the document, or three fields in whatever system you already use.

What about the other copies?

The instinct is to delete them. I would be careful. An older version can be the only place that shows what changed and why, and that matters the day someone asks how a decision got made.

A gentler rule: keep the versions that explain a decision, label them superseded, and point them at the official copy. Retire the true duplicates. If your organization has retention rules, those come first.

A small way to start

Pick ten documents people ask for all the time. Hand the list to someone new and ask them to find the right version of each without asking the author. Wherever they hesitate, you have found a missing owner, date or status.

There is a free planner for exactly this on Knowledge Cleanup, with a blank worksheet and a worked example. No signup: knowledgecleanup.com/tools. The longer guide, Clean up one collection without losing its history, walks through it step by step.

Who owns the official copy?

Here is where it stops being a filing problem. Somebody has to decide which version is official, and somebody has to be on the hook for keeping it current. I do think this is where most cleanups stall. Everyone agrees the folder is a mess, and nobody is sure they are allowed to call one copy the real one.

So, one question to take back to your own shared drive: if you left tomorrow, could anyone tell which of your files is the real one?

I suspect for most of us the honest answer is no. That’s fixable.

Where this is going

DESCRIBED started with job titles, and this issue is about files, but it is the same idea each time: a label can’t do a description’s job. From here the issues will run in three series. Knowledge Cleanup is about getting what is already on the shared drive into a state people can trust. Data Exhaust is about the trail that work leaves behind, and what it can tell you about how a decision got made. Governance Simplified is about turning a policy into something a person can actually do. Each series has its own site: knowledgecleanup.com, dataexhaust.org and governancesimplified.com.

Jonathan

DESCRIBED is a newsletter about how information gets named, described and found. If someone forwarded this to you, you can subscribe at jonathanmalchowvega.substack.com.

Versión en español: ¿En qué versión confiar?

Who's Hiring AI Governance Professionals?

Explore current openings in:

AI Governance Jobs · Responsible AI · AI Risk · AI Compliance · AI Audit · AI Policy · Privacy · Cybersecurity · Public Policy

Search the latest opportunities at GRC Careers › · nonprofit GRC jobs ›