Policies and procedures might become obsolete because of operational changes, threats, and reduced compliance.
Over time, policies and procedures may become inadequate because of changes in threats, changes in operations, or deterioration in the degree of compliance.