Generally what we find is that a business has good practices in place but hasn’t documented them. That’s where the policies and procedures come into place. Most organisations don’t need to make lots of changes to the way they work, just tweaking their good practice.