Are you Making the Right Choice When it Comes to Policies vs Procedures?

Policies and procedures are both part of policy management but are entirely different concepts.  A policy is a high-level framework for making decisions and establishing a specific culture, according to this article on ComplianceBridge. A procedure is a detailed list of step-by-step instructions complete a task.

The purpose of a policy is to maintain a culture or value set for the company to follow.  A procedure is created to achieve a specific outcome in a particular way.

It is important to understand these differences in order to decide whether to introduce a new policy or procedure.  These five questions can help:

1. What is the level of detail do you need? If it is a broader principle that might depend on the circumstances, a policy is the way to go. If the situation needs specific instructions, a procedure would be best.
2. Who is the intended audience? New employees may need the more detailed instruction of a procedure whereas a policy would suffice for more tenured employees.
3. What is the degree of flexibility? A higher level of standardization would call for a procedure but a more flexible guideline would allow for a policy.
4. What atmosphere do you want to create?  If you are looking for a relaxed and casual atmosphere, your organization might have more polices than procedures.  A more formal corporate culture might require more formal procedures.
5. Are there laws to be enforced? If your company operates in a highly regulated industry such as food services or healthcare, you need specific procedures to ensure everything is done correctly and legally.

Once you choose between policy or procedure you can get started on writing and enforcing it to give your employees clear guidelines.  Another Today’s General Counsel article, More Things Your Cyber Policy Might Not Cover, gives helpful hints on how to make a policy for cyber insurance.