Is acknowledgement the same as understanding?

No. Acknowledgement records that the recipient saw and accepted the update. Understanding requires testing or assessment. Both standards (ISO 9001, ISO/IEC 27001) and most regulators treat these as separate controls. Acknowledgement is the minimum; assessment is added where the risk justifies it.

Do small organisations need this?

It depends on regulatory and contractual exposure. A small organisation that is not regulated and has no certification requirements may run on a lighter process, but should still be able to answer 'which version is current?' and 'who has seen the latest update?' for its most important policies.

What is the cheapest first step?

Pick one policy set that matters operationally, give every version a clear effective date and a named owner, and require a recorded acknowledgement from the named distribution list. That alone closes most of the gap before any specialised tooling.

Why Policy Updates Fail When the Process is Just Publish and Hope

An insight on why policy updates fail when the process is just publish and hope from CodeCraft Enterprise.