TL;DR
- The real lever: Out-of-cycle triggers are the control. Annual cadence is the calendar, not the protection.
- When to skip: If no trigger has fired and no policy has been misapplied in the last quarter, doing nothing is a defensible answer for now.
- What must be true: A named set of triggers, a person who owns intake, and a written log of what was reviewed and why. Without all three, you've a calendar, not a system.
- How options split: Calendar-only, calendar-plus-named-triggers, or fully event-driven. Each fits a different operating reality and each breaks in a different place.
- Decision rule: If a manager answered a question about a policy in the last 30 days and the answer was not in the handbook, you've a trigger, even if nobody raised it formally.
- Expected outcome: Fewer surprise findings at the annual pass, faster correction when something is wrong, and a document that tracks reality instead of the year it was last touched.
A people operations lead at a 380-person SaaS company opens her laptop on the first Monday of January. The handbook is in her shared drive. Last year it was reviewed in October. The ticket from legal says "annual handbook review due." She opens the document. She reads the social media policy. She thinks about whether it still says what it said. She marks two sentences. She sends the file back. Six months later, a manager fires an engineer for a Slack post that the policy, read carefully, doesn't actually cover. The manager thought it did. The handbook said something narrower. The post was protected concerted activity under the framework the Board has been applying since Stericycle. The annual review didn't catch it. It could not have. The trigger that mattered was never a date. It was a question a manager asked in March and answered from memory.
Annual review is a calendar event with a stamp on it. Out-of-cycle triggers are the actual control. The handbook is wrong in the months between reviews more often than it's wrong on the day of the review, because the events that make a policy wrong don't arrive on an annual cycle. A court decision shifts how rules are read. An acquisition brings 240 people under a different policy. A manager starts interpreting "excessive absence" in a way that contradicts the written definition. A new jurisdiction opens a sales office. None of these wait for October.
The question isn't how often the handbook should be reviewed. The question is what should pull a review forward, who can name that something has happened, and what gets recorded when the review runs.
Best tools for HR Operations
When You Genuinely Do Not Need to Act Yet
Doing nothing is sometimes the right answer. Saying that out loud is part of why the rest of this article is worth reading. If none of the triggers later in this piece has fired, and if no manager has answered a policy question differently from how the handbook reads, your current setup may be genuinely fine for the next quarter. The trap is to treat fine as proven by the calendar. It isn't. It's proven by what has not happened since the last time anyone looked.
Your Setup Is Genuinely Fine
Picture a 90-person professional services firm. The handbook was revised eight months ago after a pay transparency question from a recruiter. Since then, three new hires have signed acknowledgements, no grievance has been filed, no manager has asked a question that the document didn't answer, and no new jurisdiction has opened. The handbook sits in the same place it always has. Nobody is complaining that it doesn't cover something they needed it to cover. The annual review is still three months away. In that company, doing nothing for another ninety days is a reasonable posture. It's reasonable because there's a specific reason for it, not because the calendar says so. The reason is that no event has occurred that the document was not built to handle. If you can name that reason, you're in this stage.
Friction, Not Failure
Now picture a 220-person retailer. A store manager in Cleveland calls the HRBP to ask whether an employee can be sent home for wearing a hat with a slogan the manager dislikes. The handbook covers dress code but says nothing about slogans on clothing. The HRBP says no, and explains why. The manager accepts the answer. The handbook was not wrong on the dress code rule. It was silent on a related case the rule didn't anticipate. No policy failed. A gap showed up. The right move is to log the question, decide whether the gap needs a clause, and put it in the next scheduled pass. Acting now would be fine. Waiting is also defensible. What isn't defensible is forgetting the question was asked.
Real Risk, Not Theory
Then there's the retailer that did forget. Six months on, the same scenario plays out in Phoenix, but this time the manager's answer is different from the policy's. The termination happens. The employee files. The handbook is produced. The dress code clause is read carefully. It doesn't say what the manager thought it said. Now the document is evidence in a dispute, and the gap is no longer a gap. It's the reason a case has a fact pattern. The lesson isn't that the company should have updated faster. The lesson is that the question asked in Cleveland was the trigger, and the company didn't have a way to catch it. Calendar reviews don't catch questions. Triggers do.
The Edge Case
The fourth stage is the one most handbooks sit in without knowing it. A company has not had an incident, has not opened a jurisdiction, has not made an acquisition. But its handbook was last touched in a year when the Board was applying Boeing, not Stericycle. The conduct rules were drafted against a standard that has since shifted. Under Stericycle, which remains in place and has not been overruled as of April 2026, the test for whether a workplace rule is lawful is stricter than what Boeing allowed. Administrative law judges continue to apply it. On 27 February 2026 the NLRB issued Memorandum GC-03, which signals a shift toward more employer-friendly and less aggressive enforcement, but the underlying standard in Stericycle has not been displaced. If your conduct rules were drafted without that framework in mind, you're sitting on a document that may not match the test a judge is currently applying. The trigger here's not an event inside your company. It's a shift in how the law reads the document you already have.
The Five Questions You Ask Yourself at 11pm
These are the questions that arrive after the laptop is closed, when the calendar reminder for the annual review has just fired and you're not sure the document earned the time you're about to put into it.
Did Anyone Answer a Policy Question Differently From How the Handbook Reads?
If yes, that's a trigger. The reason is that a written policy is only the policy if it's the policy people follow. The moment a manager answers a question from memory and the answer contradicts the document, you've two policies. The one in the file and the one in operation. The longer those two diverge, the harder the correction. If the answer is no, ask the next question.
Has Anything Changed About How the Board or a Court Reads These Clauses?
Stericycle replaced Boeing on the standard for workplace rules, and it has not been overruled as of April 2026. Memorandum GC-03 in February 2026 shifted the Board's enforcement posture, but the underlying test from Stericycle is what judges continue to apply. If your conduct rules were drafted before that shift, you've an exposure you didn't have when the document was written. This is true even if your own company has not changed.
Has the Company Changed Shape?
An acquisition, a divestiture, a new business unit, a new jurisdiction. Each of these is a trigger because the handbook was written for the company that existed when the document was last touched. A 240-person addition under a different set of policies is a different company, and the handbook needs to know about it.
Has Anyone Asked the Same Question Twice?
A repeated question is a signal that the document is unclear, not that the asker is slow. If two managers have asked the same question about the same policy in the same quarter, the policy is the problem. The fix isn't to answer them again. The fix is to rewrite the clause so the third person doesn't have to ask.
Did the Last Review Produce a Log of What Was Checked and Why?
If the answer is no, the annual review didn't actually happen. It produced a redline. The difference matters because a redline is a mark-up of the document. A log is a record of what was considered and what was left alone, and it's the artefact that turns a defensible decision into a defensible one when someone asks later why a clause was not changed. If the log doesn't exist, the decision can't be defended.
Three Honest Categories the Approaches Split Into
There's no single way to keep a handbook current. There are three honest shapes the approach takes, and each one has a place where it works and a place where it fails.
Calendar-Only
This is the annual review on a fixed date, every year, with no event-driven component. It's the most common setup, and for a narrow slice of companies it's fine. The slice is small. It's the company with no acquisitions, no new jurisdictions, no incidents, no questions from managers that the document doesn't answer, and no shift in how the relevant clauses are read. For a 60-person firm in one state with no plans to grow and a stable workforce, calendar-only is defensible, and it remains defensible until one of those things changes.
Where it fails is in the assumption baked into the cadence. The assumption is that the document is correct for the year between reviews. It isn't. It's correct on the day it was reviewed and progressively less correct each month after, because the things that make a policy wrong accumulate. A calendar-only setup doesn't see the accumulation. It sees the result, usually when an incident forces the document open.
Calendar-Plus-Named Triggers
This is the setup most handbooks should be running and most aren't. The annual review stays, but it's no longer the only mechanism. A specific list of triggers can pull a review forward, and the list has names attached to who can raise one. A manager who answers a question from memory can flag it. A regional director who opens a new state can flag it. An HRBP who sees the same question twice in a quarter can flag it. The intake is owned, the triggers are written down, and the annual pass reviews whatever the triggers didn't already cover.
Where it fails is in execution. A trigger list that nobody knows about is a list that fires on nobody's radar. The mechanism works only if the people who can raise a trigger know they can, know how, and trust that raising it won't be treated as a failure. If triggers get raised and ignored, the list stops being a list and becomes a complaint channel with a different name.
Fully Event-Driven
This is the setup where there's no annual review at all, and the handbook is updated only when a trigger fires. It's rarer, and it works in companies where the policy surface is small, the workforce is stable, and the events that require changes are visible without a calendar forcing the issue. A 40-person consultancy with no internal HR function might run this way. The owner reads the handbook when something forces it, and the document is touched when something forces it.
Where it fails is in slow drift. A clause that has become quietly wrong because of a court decision, because of a market shift, because of how managers have started answering questions, won't generate a trigger if nobody is watching for it. Event-driven setups need eyes on the document that aren't the triggers themselves, and most small organisations don't have someone whose job that's.
Five Diagnostic Questions You Can Self-Assess Against
These are questions you can answer about your own organisation, without help from outside it, and the answers tell you which of the three categories above you actually belong in.
Can You Name the Last Trigger That Pulled a Review Forward?
If the answer is yes, your setup is calendar-plus or event-driven, and the rest of the questions tell you which. If the answer is no, and the only review you can name is the annual one, you're running calendar-only. That's not a failure on its own. It's a position, and the question is whether the position matches the company.
Can You Point to a Person Who Owns Intake?
A trigger list without an owner is a list that nobody acts on. The owner isn't the person who decides what the policy says. The owner is the person who decides that a trigger has fired and that a review needs to run. If you can't name that person, the trigger list is decorative. To answer this for your own organisation, look at who would receive the email if a manager flagged a gap. If that mailbox doesn't exist, the owner doesn't exist either.
Is There a Written Log of What Was Reviewed and Why?
A redline is a mark-up. A log is a record. The log names what was considered, what was changed, what was left alone and why. If the artefact from the last review is a tracked-changes document, you've a redline. If it's a one-page summary that names each section, the decision made on it, and the reason, you've a log. The difference is what you can show someone later when the question is asked.
Have You Looked at the Clauses That Were Written Before the Most Recent Shift in How They Are Read?
Stericycle is the obvious case, and it's current as of April 2026. If your conduct rules were drafted before August 2023, they were drafted against a standard the Board no longer applies. The fact that GC-03 in February 2026 softened enforcement doesn't change the test. To answer this for your own organisation, find the date on the conduct rules section of your handbook. If that date is before the relevant shift, the section needs a closer look. Confirm the specifics locally.
Have You Asked Managers What Questions They Have Answered From Memory in the Last 90 Days?
This is the question that produces the most triggers. A manager who answers a question without opening the document is telling you that the document isn't where the answers live. To answer this for your own organisation, send a short note to your direct managers and ask. Don't ask whether the handbook is good. Ask what questions they have answered in the last quarter that the document didn't answer for them. The answers will tell you where the gaps are.
Six Triggers That Should Force a Review
These are the events that should pull a review forward, the reasons each one earns a place on the list, and the specific weakness each one carries. None of them is a compliment in disguise.
A Change in Law or Regulatory Guidance
A court decision or an agency memorandum that shifts how a clause is read. Stericycle, decided in August 2023, is the clearest current example. It replaced Boeing and adopted a stricter test for workplace rules. It remains in place and has not been overruled as of April 2026. Memorandum GC-03 of 27 February 2026 shifted enforcement posture but didn't displace the underlying standard. For a handbook with conduct rules drafted before that shift, the trigger fires regardless of whether anything inside the company has changed.
Where this trigger falls short is in timeliness. The shift may already have happened by the time you hear about it. The window between a decision and your document being read against it's the window in which you're exposed. The trigger tells you to act. It doesn't tell you how long you've been wrong.
An Incident or Grievance That Exposed a Gap
A termination, a complaint, a regulatory inquiry, any event that surfaces a clause the document doesn't have or reads differently from how it was applied. The incident is the trigger because it's evidence that the document and the practice diverged. The review looks at the gap, decides whether the policy was wrong or the document was wrong, and corrects whichever it's.
Where this trigger falls short is in retrospect. By the time the incident has happened, the exposure has already occurred. The trigger doesn't prevent the incident. It prevents the second one.
A Restructure or Acquisition
The company has changed shape. A 240-person addition, a divestiture, a new business unit, a reorganisation that moves people between functions. The handbook was written for the company that existed when it was last touched, and the company is now not that company.
Where this trigger falls short is in scope. A restructure can be large enough that the right move isn't a clause edit but a full rewrite. The trigger fires, and the response turns out to be a six-month project rather than a one-week fix. Naming that up front matters because the trigger sets an expectation that the response will be proportional.
Entry Into a New Jurisdiction
A new state, a new country, a new city with its own ordinance. The handbook is a single document that applies to a workforce, and the workforce now includes people in a place the document was not drafted for. Implied-contract exposure varies by state, with thirteen states not recognizing the exception and roughly thirty-eight that do. A clause that reads as one thing in one state may read as another somewhere else. The review checks each clause against the new jurisdiction and decides what has to change.
Where this trigger falls short is in completeness. A new jurisdiction may surface issues that the review isn't equipped to catch without local advice. The trigger tells you to look. It doesn't replace the looking.
A Repeated Question From Employees
The same question, asked more than once, by people who have read the handbook. The signal is that the document is unclear, not that the readers are slow. The trigger fires because the cost of answering the same question repeatedly is higher than the cost of rewriting the clause.
Where this trigger falls short is in definition. "Repeated" isn't a number. It's a pattern. Without a written threshold the trigger is subjective, and subjective triggers get raised inconsistently. The weakness is in the operational definition, not the trigger itself.
A Manager Applying a Policy Differently From How It Reads
A manager answers a policy question and the answer isn't what the document says. The trigger fires because the document and the practice are now two different things, and the longer that continues the harder the correction.
Where this trigger falls short is in detection. A manager applying a policy differently in a one-to-one with an employee isn't visible to HR unless someone reports it. The trigger relies on the gap surfacing. If it doesn't, the trigger doesn't run.
The Decision Table
| Situation | Scale | Setup | Primary Pain | Recommended Starting Point |
|---|---|---|---|---|
| Single state, stable headcount, no incidents | Under 100 | Calendar-only works on paper | Drift nobody catches | Add a written trigger list and a named intake owner |
| Multi-state, no recent incident | 100 to 500 | Calendar-only with no log | Annual pass produces redlines, not records | Move to calendar-plus-named-triggers with a log |
| Multi-state, one recent grievance | 100 to 500 | Calendar-only just failed | The incident is the exposure | Pull a review forward, run the log, check the clauses against current standard |
| Acquired or restructured in the last 12 months | Any | Document does not match the company | Handbook covers people who are not here any more, and not people who are | Full review of scope, not just clause-level edits |
| New jurisdiction opened in the last quarter | Any | One clause, one new place | Local exposure the document was not drafted for | Targeted review of the affected clauses with local input |
| No triggers fired, no incidents, single jurisdiction | Under 50 | Event-driven is plausible | Slow drift nobody watches for | Keep the trigger list, run a quarterly pass with eyes on the document |
| Conduct rules drafted before Stericycle | Any | Document written against an older test | A clause may not read the way a judge currently reads it | Targeted review of conduct rules specifically |
| Multiple managers answering the same question differently | 100 to 1,000 | Practice has diverged from document | The handbook is not where answers live | Find the question, rewrite the clause, log the rewrite |
Building the Trigger List
A trigger list that nobody can act on is a wish list. The list has to be specific enough that the person who reads it knows what to do, and it has to be owned by someone whose job includes acting on it.
Start with the six categories above. Each one becomes a trigger that can be raised by anyone in the organisation, with a named intake owner who decides whether the trigger has actually fired and what the response should be. The intake owner isn't necessarily the person who rewrites the clause. They're the person who logs the trigger, assigns the response, and closes the loop with whoever raised it.
The triggers also need to be specific. "A change in the law" isn't a trigger. "A decision or memorandum that changes how the Board reads a conduct rule" is closer. The best triggers are the ones that name a category of event and a person who would notice it, because that pair is what makes the trigger fireable in practice.
| Trigger | Who Notices It | Who Owns the Response |
|---|---|---|
| Change in law or regulatory guidance that affects a clause | HRBP or legal contact monitoring the relevant agency | HR lead assigns the clause review |
| Incident or grievance that exposed a gap | HRBP, manager, or the employee raising the grievance | HR lead with input from whoever handled the incident |
| Restructure or acquisition | People operations lead or finance during deal work | HR lead with the business owner of the affected unit |
| Entry into a new jurisdiction | Regional director or the person setting up the new location | HR lead with input from someone familiar with local requirements |
| Repeated question from employees | Manager, HRBP, or the people answering the questions | HR lead decides whether to rewrite or clarify in a different medium |
| Manager applying a policy differently from how it reads | HRBP, the manager themselves, or the employee who noticed | HR lead addresses the manager and decides on the clause |
The Annual Review That Is Worth Running
Once the triggers are handling the urgent changes, the annual review has a different job. It's no longer the only mechanism. It's the pass that catches what the triggers didn't.
The pass should cover four things. First, every section of the document, with a written note on what was considered and what was left alone. Second, the trigger log, to make sure nothing raised in the last year is still open. Third, the acknowledgement forms, to confirm the current version is the one people have signed. Fourth, the document's own date and version, so the next pass knows what it's looking at.
The pass should produce two artefacts. A redline of the document, which is the mark-up. And a log, which is the record. The log is the artefact most teams skip, and the one that matters most when someone asks later why a clause was not changed. The log doesn't need to be long. It needs to name each section, the decision made on it, and the reason.
| Section | What Was Considered | What Was Decided | Why |
|---|---|---|---|
| Conduct rules | Current standard for workplace rules | Reviewed against Stericycle, which has not been overruled as of April 2026 | The clause may not read the way the test now reads |
| At-will disclaimer | Whether the disclaimer and signed acknowledgement together cover the relevant states | Confirmed, with a note that roughly thirteen states do not recognize the implied-contract exception | Local confirmation needed before relying on the disclaimer in any specific state |
| Dress code | Repeated question from managers about slogans on clothing | Left alone this pass, gap logged | The question was raised once, not repeated |
| Acknowledgement form | Whether the current form matches the current handbook | Updated | The form must point to the version the employee signed |
| Jurisdiction-specific addenda | Whether the addenda still cover the states we operate in | One addendum added | New office opened in a state not previously covered |
What to Put in Writing
A decision that's not written down is a decision that can't be defended. The artefacts below are what turn a good handbook decision into a defensible one, and they're the artefacts most teams don't produce.
| Artefact | Who Owns It | When It Is Written | What It Prevents |
|---|---|---|---|
| Trigger log | HR lead | Each time a trigger is raised | The argument that a known gap was ignored |
| Review log | HR lead | At the end of each scheduled or out-of-cycle pass | The argument that a section was not considered |
| Redline of the document | HR lead with input from whoever drafted the change | At the point of each change | The argument that the version in effect is not the version reviewed |
| Signed acknowledgements | HR operations | At hire and at each version change | The argument that the employee was not on notice of the current policy |
| Decision record for each clause change | HR lead | At the point of the change | The argument that the change was arbitrary |
| Intake ownership statement | HR lead | Once, then revisited when roles change | The argument that nobody owned the trigger response |
| Date and version on the document itself | HR operations | Each release | The argument that the wrong version was in effect |
| Notes from any legal input | HR lead with the legal contact | When legal is consulted | The argument that the position was taken without input |
Questions to Ask Before You Commit
These are questions to put to a provider, an adviser or your own team before the decision on cadence and triggers is locked. The questions are written to be sent.
On intake ownership: Who owns the decision that a trigger has fired? A bad answer sounds like "the team" or "we all do." A good answer sounds like a name and a role.
On the trigger list itself: Can you show me the list, and can you show me the last time it was used? A bad answer is a list that has never fired. A good answer is a list with at least one entry from the last 12 months.
On the log: What does the artefact from the last review look like? A bad answer is a redline only. A good answer is a redline and a one-page log that names what was considered and why.
On the version control: What is the version in effect today, and what is the date on it? A bad answer is "the latest one." A good answer is a specific date and version that matches what employees have signed.
On the legal posture: When was the conduct rules section last reviewed against the current standard? Stericycle has not been overruled as of April 2026, and the test for workplace rules under it's the one judges use. A bad answer is "we drafted it a while ago." A good answer is a specific date and a confirmation of the standard reviewed against.
On the at-will disclaimer: Do we've a clear disclaimer, and do we've signed acknowledgements for the current version, in every state we operate in? A bad answer treats the disclaimer as a paragraph. A good answer treats it as a combination that has to be confirmed locally because roughly thirteen states don't currently recognize the implied-contract exception, and in the states that do, the disclaimer alone may not be enough.
On manager practice: How do we find out when a manager has answered a policy question differently from how the handbook reads? A bad answer is "we would hear about it." A good answer is a mechanism, even an informal one, that surfaces the gap.
On the jurisdiction question: When we open a new location, who is responsible for checking the handbook against local requirements? A bad answer is "we get to that." A good answer is a named owner and a trigger raised by the move.
The Cost of Getting This Wrong
The cost of an outdated handbook rarely appears on an invoice. It appears in the second-order consequences that surface only after something has gone wrong, and they're the costs that compound.
The first cost is credibility inside the company. A manager who answers a question from memory and contradicts the handbook teaches the next manager that the handbook is decorative. The document loses authority in the place where it most needs it. The second cost is the discovery process. When a handbook is produced in a dispute, it's read the way a contract is read. A disclaimer that's contradicted by an arguably promissory clause isn't a disclaimer that holds. The exposure isn't the clause. It's the combination of the clause and the disclaimer, and whether the two together support the position the company took.
So the cost of running on the calendar alone isn't the cost of the annual review. It's the cost of the eleven months when the document is unchallenged and the practice is unrecorded. The cost of having no trigger list isn't the cost of writing the list. It's the cost of the gap that nobody raised because nobody knew they could.
The question to sit with isn't "when is the next annual review." It's "what would have to happen in the next 90 days for us to know the handbook needs to be opened before January." If you can answer that question, you've a trigger list. If you can't, you've a calendar.
When You Are Ready to Go Further
If the framework above has surfaced gaps you want to pressure-test, HROpsLab's independent comparison work is built for that. We are a review publication, not a vendor. We don't supply software, payroll services or advice. We compare what is in the market so that HR leads can make decisions on the back of someone else's primary research rather than their own.
Our annual comparisons on policy management platforms, handbook builders, and HR advisory firms are the work most teams use as a second opinion before they commit. The reviews are independent, the methodology is published, and the vendors don't pay to be included. If a comparison would help you decide between calendar-only, calendar-plus-named-triggers, or a fully event-driven setup, the work is already done. You can find it on the site.
Frequently Asked Questions
How often should a handbook be reviewed?
There's no single right answer that fits every organisation. The annual review is a calendar event, not a control. The right cadence is the one that catches the events that make a policy wrong, and those events don't arrive on a fixed schedule. A company with no incidents, no new jurisdictions and no acquisitions may genuinely run on an annual pass. A company with any of those should run on triggers, with the annual pass catching what the triggers didn't. What matters isn't the frequency. What matters is that the mechanism catches the gap.
What should trigger an out-of-cycle change?
Six categories cover most of the cases. A change in law or regulatory guidance that affects a clause. An incident or grievance that exposed a gap. A restructure or acquisition. Entry into a new jurisdiction. A repeated question from employees. A manager applying a policy differently from how it reads. Each one is a trigger because it's evidence that the document and the reality have diverged. The list isn't exhaustive, but it's the floor.
Who should be involved in a handbook review?
The HR lead owns the review. Whoever drafts the changes is the person closest to the clause. A legal contact should be involved for sections that carry litigation exposure, including anything related to conduct rules, at-will status, or jurisdiction-specific clauses. The manager who flagged a trigger should be consulted on the gap that triggered the review. The wider team doesn't need to be in the room. They need to know the review happened.
Does legal need to review every change?
No. Legal should review the sections that carry the exposure, including conduct rules, disclaimers, and anything tied to a specific jurisdiction. Sections that are operational and don't carry legal exposure can be reviewed by HR alone. The mistake is treating legal review as a stamp on the whole document when only parts of it carry the risk. The mistake in the other direction is skipping legal on the parts that do.
What should be done when a law changes mid-year?
Run a targeted review of the affected clauses. The trigger has fired. The response is to identify the clauses that are read against the new standard, decide what has to change, log the decision, and update the version. Don't wait for the annual pass. The exposure window is the time between the change and your update, and that window is what you're trying to shorten. Confirm the specifics of the change locally before relying on the new clause.
How do you keep track of what was reviewed?
A log. Not a redline. A redline is a mark-up of the document. A log is a record of what was considered, what was decided, what was changed, and what was left alone, with the reason. The log is the artefact you can show someone later when the question is why a clause was or was not changed. Without the log, the decision can't be defended.
Should the whole handbook be reviewed or just sections?
Both. The annual pass reviews every section. The out-of-cycle reviews are targeted at the clauses affected by the trigger. The combination is what works, because the targeted reviews handle the urgent changes and the annual pass catches the slow drift. A handbook that's only ever reviewed in pieces accumulates blind spots in the pieces that were never triggered.
Your handbook should be the document that tracks the company as it actually is, not the company as it was the last time the calendar fired. HROpsLab builds the independent research that helps you pressure-test the decisions behind that document.
