Let’s talk policies and procedures

I often get asked why organisations should bother with policies and procedures. My response is that it creates a uniform structure by which the organisation works, saving time and resources. For larger organisations it shows a fairness in the way it operates as everyone has the same procedure to follow.

What usually goes wrong is that the person writing the policy struggles to be able to put into words what needs to happen. Believe me, we have seen some policies which even the author doesn’t understand what they are trying to achieve. You also need to take into account that people learn and absorb information in different ways. Some people can easily follow a set of written instructions, whereas for others a flowchart or decision tree work better.

ISO27001 Flowchart

Flowchart image

When considering how best to set out the procedure you want to document, you can consider the circumstances in which it is going to be used. A flowchart or decision tree is good for looking for an answer quickly where the process follows a pattern. They are really easy to see quickly the whole process. Whereas a written policy provides more detail and information about the topic but may not be read in its entirety. Ideally you would create both a flowchart and a written document to cover all the uses of the procedure.

Once you have written your policy or procedure, ask someone else to read it. I know that’s obvious, but few people ask for feedback on their documentation and just assume that it makes sense to everyone else. Nobody then comments on the procedure but if they don’t understand it, they don’t use it and that’s when problems can be created for the organisation. Nobody is following the carefully crafted policy, and everyone is just doing what they think is best. It means that there are inconsistencies in operations and service level and the organisation has lost control of the quality of the service.

Think of McDonald’s. There is a structure that all their outlets follow. It’s a proven strategy and provides reasonably consistent quality standards. All of these are documented so that everyone knows how they should be working.

Thinking about your organisation, can you confidently say that everyone knows what they should be doing and the policies you have in place are good practice and always followed. If not, then contact us, we’d love to help you.