We notice many organizations depend on policy or policy creation to address issues. When we work with clients, we help create mutual understandings about the purpose, intention and consequences of policies. Policy is not always the most effective approach to problem solving. More importantly, policy alone is never the best approach to addressing challenges. To help our clients realize optimal results when implementing policy, we typically begin by creating a common language about:
— what policy is
— what standards are
— what process and procedures are
— what technical controls are
We clarify that generally accepted business practices and global standards have established differentiations that help guide us in policy creation. Policies are the highest level, long-term, guiding principles on how the organization is to be run. Policies are intended for broad audiences and are applicable to anyone — employee, contractor, temporary worker, etc. Policies drive standards, procedures and technical controls.
Standards define the process or rules to be used to support the policy, while procedures are specific instructions (ordered tasks) for performing some function or action. Technical controls are mechanisms used to regulate the operations to meet policy requirements (countermeasures).
The manifestation of policy is like the tip of an iceberg. Policy must be supported by practice in standards, process, procedure and technical controls. Creating, documenting, administrating and implementing policy is larger and more complex than what most managers anticipate. The complexity often comes by way of various levels of understanding of the reasons and intentions for the policy—which is the biggest, and often unseen part of the iceberg. To add further challenge, policy, like any regulation, is usually a fear-based response to a problem or an anticipated problem. We encourage our clients to consider the reasons and consequences (good and bad) for creating, adjusting, implementing or supporting sub-components of policy.
Here are some good reasons to create and maintain policies, standards, processes, procedures and technical controls:
— clarity and uniformity of beliefs, behaviors, products and services within an organization
— creates a vehicle for disseminating beliefs, behaviors, products and services
— establishes common understanding
— reduces the risk of lawsuits (when done properly)
There are also risks to creating and maintaining policies, standards, process, procedures and technical controls:
— management inflexibility and the inability to respond effectively to the infinite and ever-changing issues that arise between people and organizations
— failure to uniformly apply policies, standards, processes, procedures and technical controls leaves the organization vulnerable to lawsuits
— incomplete, vague or ambiguous policies, standards, processes, procedures and technical controls confuses both management and employees and leaves room for divergent expectations
— provisions that are unlawful or allow for an unlawful application
When we work with clients, we explore many complimentary approaches to address issues in regard to policies, standards, processes, procedures and technical controls. Our aim is to holistically serve the highest level of the problem. We co-create solutions that inspire and empower people to act in support of a belief or purpose rather than simply complying to policies, standards, processes, procedures and technical controls. Behaviors are put into practice, not just policy. If you need help addressing challenges at work and wonder about how effective your policies, standards, processes, procedures and technical controls are—give us a call. We specialize in helping leaders advance how they address change.