Policies enhance the functioning of a business. They help you set in motion a compliance management program and protect you against legal costs and reputational damage—something no serious company would put a small price on. The process — policy management — has 5 critical stages. Here is a rundown on these critical areas in the life cycle of any policy.

Step 1: Know the policy requirements

No policy exists in a vacuum. The proper habitat of a policy is the cross-section of the legal, regulatory, corporate, and risk environments it is meant to straddle. All policies are linked to these domains. For instance, from workplace health and safety, sexual harassment, and equal opportunity to data protection and other laws of the land, regulatory bodies may issue standing instructions or standard best practices. These are good starting points that can help you establish policy requirements.

Even more effective points of departure, however, may be the ongoing problems your business faces. Here the focus is on using a policy or a set of them to reduce risk and meet long-term business objectives. In fact, imbuing policies with a visionary tone can help bridge the gap between the need to adhere to compliance requirements and the desire to elicit positive employee support.

Experts suggest that policies that are too exhaustive may fail in practice. The goal then is to target enough areas so as to reduce risk and foster company growth but veer away from overburdening the workforce with myriad, dense stipulations. When setting the boundaries of the policy you can always have third-party professionals weigh in with expert advice.

Step 2: Develop the policy and get it approved

Some issues may be remedied by updating existing policies; others require a fresh policy to be written. In the case of the latter, there is a great deal of back-and-forth that can occur before a policy becomes company law. Brainstorming with key stakeholders is an essential step of the policy formulation phase as it often happens that there are many roads to the same destination. Through deliberation, once an approach or solution crystalizes, a draft policy can be written.

Your company may have a distinct tone of voice and it is appropriate that all your policies be written in the same tone. However, while there is room for variety when it comes to style, there shouldn’t be unnecessary discretion when it comes to clarity, brevity, and simplicity. Good policies are concise, clear, and easy to use. Technical jargon, where superfluous, should be avoided. Since the aim is to avoid undue rigidity, words like “generally” and “normally” should be used to give senior management some latitude when it comes to interpretation. Above all, the policy should state the norms and answer questions pertaining to who, why, when, what, whom, and where. Strive to adopt a layout that aids comprehension.

After writing and editing, the policy must be approved, often by the majority of the board members. If the policy is not adopted as is, it will have to undergo revising. This can be an iterative process. Upon approval, the policy is ready to be implemented across the organization.

Step 3: Deploy the policy

Distribution is one of the first steps of policy implementation and here, there is room for a mix of digital and physical means. For instance: emails, memos, and team meetings. For future reference, businesses can take to updating a company intranet with new links and adding a print version to an employee handbook. What is important is that the written policy reaches the right persons at the right time. With modern-day software solutions, the hurdles to effective dissemination of policies are drastically lower.

However, it is a good practice to preface policy distribution with communication, especially when a major decision is involved. For instance, if you are adopting a new dress code policy or BYOD (bring your own device) policy, it can be advantageous to explain the reasons and objectives that undergird the policy. Employee buy-in is at stake and for the best results, employees should be given a chance to ask questions. For policies of lesser importance, a more passive stance may be justified. Here, it could suffice to distribute the policy and have employees seek out clarifications as and when they require them.

Step 4: Test employee understanding and verify acceptance

There is a certain level of opaqueness involved when it comes to tracking policy penetration and recent court cases show that what is important here is both understanding and acceptance. A company must be able to demonstrate that its employees have grasped the meaning of the policy. Developing online quizzes on the policy is a tangible way to assess understanding, and third-party companies can help with more interactive assessment tools. Training may also be required, for instance for OSHA or HIPAA, and training may be imparted at the time of recruitment, before policy implementation, as annual-refresher courses, and so on.

Next, there must be a record of acceptance, be it physical or digital. Today, it is easy to distribute a policy digitally and have it accepted at the click of a button. However, it works well to remind employees that they are entering into a legally binding agreement when they sign off digitally.

Step 5: Evaluate the policy

Policy evaluation is key to knowing whether the policy’s implementation and impact align with the goals and requirements it set out to meet. The evaluation may be quantitative or qualitative and at times, a cost-benefit analysis is used to judge progress. Evaluation is an ongoing process and sometimes, this leads to the need for the policy to be updated. Third-party institutions can also help with policy evaluation. Often statistical tools, such as randomized experiments, regression analysis, and before-after methods, will be used to gauge effectiveness.

From start to finish, policy management and its 5 phases, though immensely rewarding, demand no small effort. Thankfully, with the VComply GRC suite, policy management becomes intuitive and streamlined. Benefit from hierarchical approvals, a cloud repository, questionnaires and checkpoints, inbuilt distribution, testing and attestation modules, and more. Policy owners can even understand policy compliance levels through policy analytics and access tools for auditing and reporting. 

Discover what makes VComply a top G2 high performer in policy management year after year. Book your demo now!