Catalogue › Knowledge Management › knowledge-review-cycles

Knowledge review cycles

Sets how often each kind of knowledge is reviewed, what events trigger an early review, what a review must check and record, and how overdue reviews escalate, with reviews linked to the agents and Copilot scenarios that depend on the content. Use when content has no review dates, when reviews are agreed but never happen, or when a policy change is not reflected in AI answers.

Department

Knowledge Management

Lifecycle

Enable, Deliver, Improve

Maturity

adopter, builder, scaler, ai-enterprise

Risk tiers

0, 1, 2, 3, 4

Platforms

sharepoint, m365-agents, copilot-studio, power-platform

Editions

starter, scale, enterprise

Reviewers

none

Status

draft

Copilot Cowork

Knowledge Management plugin for Copilot Cowork, or this skill on its own: Download SKILL.md

Licence

CC BY 4.0, by Simon Foote

Purpose

Knowledge decays quietly. A policy changes, a product is withdrawn, a team is restructured, and the old content stays exactly where it was, now ready to be quoted by Copilot with full confidence. This skill sets review cycles that match how fast each kind of content changes and how much a wrong answer would cost, adds event triggers so reviews happen when the world changes rather than only on the calendar, and makes overdue reviews visible. It usually fails when every document gets the same annual date, or when reviews are scheduled but nobody is prompted, recognised or chased.

When to use

• Registered sources have no review dates, or the same date has been applied to everything.
• Reviews are agreed on paper but are not happening, and content is visibly stale.
• A policy, product or regulation changed and AI answers did not follow.
• New agents are about to ground on content and need a review cadence linked to their own review date.

When not to use

• Keeping a specific live agent's knowledge current in operation, including re-indexing and re-testing - use ai-operations:knowledge-refresh.
• Scheduled reviews of live AI solutions themselves - use ai-operations:ai-review-calendar.
• Designing the whole lifecycle from creation to disposal - use knowledge-management:knowledge-lifecycle.
• Deciding what to remove from a backlog of stale content - use knowledge-management:knowledge-cleanup.

Questions to ask first

1. What kinds of content are in scope (policy, procedure, product, reference, guidance), and how often does each genuinely change?
2. What is the consequence of an out-of-date answer for each kind - inconvenience, rework, or compliance and safety risk?
3. What events in the organisation should force an early review - regulatory change, policy approval, product launch, reorganisation?
4. Who carries out the review, how long does it take, and how are they prompted?
5. Which agents and Copilot scenarios depend on the content, and when are they reviewed?

Required inputs

• The register of sources with owners and dependent AI uses, from knowledge-management:knowledge-inventory.
• The ownership model, from knowledge-management:knowledge-owner-model, so reviews have someone to do them.
• A list of change events the organisation recognises, from policy, legal, product and HR owners.
• Any regulatory or contractual review requirements, from the content owner or legal adviser.

Where a source has no owner, do not set a cycle against it: route it to ownership first, because a review date nobody owns is decoration. Regulatory review periods are confirmed by the owner or legal adviser, never assumed.

Decision framework

Set the cycle from volatility and consequence, then add triggers.

A review must record four things: confirmed accurate or updated, still needed or archived, audience and classification still right, and the next review date. Overdue reviews escalate in steps: reminder to the owner at the due date, to the deputy after a set interval, to the domain owner after a further interval; content that remains overdue on a high consequence row is withdrawn from agent grounding until reviewed.

Practitioner approach

Group content by kind before setting any dates. Most estates have a handful of content kinds that behave similarly: policies, procedures, product and service information, reference material, guidance and templates. Agree a default cycle per kind with the domain owners using the matrix, and let content owners shorten it for specific sources. Avoid the single annual date for everything; it is too slow for product content and too frequent for stable reference, and it teaches owners that review is a box to tick.

Add event triggers, because calendar reviews alone miss the moments that matter. List the events that should force a review: a new policy approved, a regulation changed, a product launched or withdrawn, a reorganisation, an incident caused by wrong content. For each, name who announces the event and how affected owners are told. A simple routine where the policy approval step also notifies the owners of dependent sources prevents most "the agent still quotes the old rule" incidents.

Make the review itself small and specific. A review is not a rewrite; it is a check against four questions, recorded in metadata. Give owners a short checklist and a way to record the outcome in a minute or two, ideally in the library itself. Where content is regulated or technical, include the subject matter reviewer.

Link content reviews to AI. Each source in the register lists the agents and scenarios that depend on it. When a review changes content materially, the owners of dependent agents are told so they can re-test, through ai-operations:knowledge-refresh. Agent review dates should never be later than the review dates of their sources.

Prompt, do not police. Automated reminders from the library or a simple flow, a monthly overdue list to domain owners, and visible thanks for owners who keep content current work better than league tables. Report overdue reviews by domain, never by individual.

Finally, decide what happens when reviews do not happen. For low-consequence content, overdue items are flagged. For high-consequence content that informs AI answers, an overdue review removes the source from grounding until it is reviewed. That rule needs the domain owner's agreement in advance, so it is a known consequence rather than a surprise.

Outputs

• A review cycle standard: content kinds, default cycles, event triggers, the review checklist and the escalation steps.
• Review dates, triggers and dependent AI uses recorded against each source in the knowledge-asset-register.
• A reminder and escalation routine, with an overdue report by domain.

Microsoft platform considerations

SharePoint columns can hold review dates, and reminders can be automated with Power Automate or built-in library features where available; confirm current capabilities in the source records before designing around them. Changes to SharePoint content may reach agents at different speeds depending on the grounding route, and uploaded files do not update themselves, so dependent agents need an explicit refresh step.

Adoption considerations

Owners keep reviewing when the effort is small and they see the effect. Show them which agents depend on their content and share examples where a timely review prevented a wrong answer.

Knowledge considerations

Review cycles are the maintenance engine of knowledge-management:knowledge-lifecycle; review outcomes feed knowledge-management:knowledge-cleanup (archive decisions) and knowledge-management:content-quality (periodic checks).

Security and privacy considerations

Each review re-confirms audience and classification, catching access that has widened since the last review. Changes go to the site administrator and, from risk tier 2, to security-privacy:data-exposure-review.

Responsible AI considerations

High-consequence content that informs decisions about people needs the shortest cycles and event triggers, because an outdated rule applied by AI to people is a harm, not an inconvenience.

Evaluation requirements

Check the routine works: sample sources each quarter to confirm reviews happened when recorded and that dependent agents were notified of material changes. Track the time between a change event and the update of affected content.

Value measures

Track the share of AI-dependent sources with in-date reviews, the time from change event to updated content, and wrong-answer reports traced to stale content. The Knowledge Manager owns these, reported by domain; never rank owners.

Scale notes

Starter

Set review dates for the sources the first agents use, with a calendar reminder and a single event trigger for policy changes.

Scale

Apply default cycles by content kind across the register, automate reminders and escalation, and link source reviews to agent reviews.

Enterprise

Integrate event triggers with policy, product and regulatory change processes across business units, and report review health by domain to steering.

Hand-offs

• To content owners and stewards to carry out reviews, under knowledge-management:knowledge-owner-model.
• To ai-operations:knowledge-refresh when a review materially changes content used by live agents.
• To knowledge-management:knowledge-cleanup when reviews conclude content should be archived.

Reviewer gates

Not applicable as a release gate; review cycles maintain content rather than release solutions. The withdrawal rule for overdue high-consequence content is agreed with domain owners and recorded.

Failure modes

• One annual date for everything, so fast-changing content is stale for most of the year.
• Reviews rely on memory with no reminder, and quietly stop after the first cycle.
• Content changes after a review but dependent agents are never told, so answers stay wrong.
• Overdue reviews are reported by individual, owners feel monitored, and engagement drops.

Sources

references/sources.md in this skill lists the source records behind this skill, what each is authoritative for, how volatile it is and what you may do with it. Product availability, licensing, limits and preview status change often, so check the current source before stating them, and cite what you used.

Never

• Set a review cycle on a source that has no accepted owner.
• Assume a regulatory review period; confirm it with the owner or legal adviser.
• Report overdue reviews by individual or use them to judge performance.
• Let an agent's review date fall later than the review dates of the sources it grounds on.