Before editing anything, I export the configuration, record hit counts, and map every policy to an owner or purpose. Unknown is a valid temporary label; guessing is not.
Work in small batches
I start with expired objects, then disabled policies, then obvious duplicates. Every batch gets a change note and a rollback point.
Good naming does the final bit of work. A policy name should explain the source, destination, service, and reason well enough that the next engineer does not need archaeology.