Policy and procedure: definition and distinction
A policy sets out what is binding and who is accountable for it; a procedure sets out how a workflow runs, step by step. The policy addresses the roles that have to comply with something, the procedure the roles that carry it out. Both are documented information in the sense of the ISO management system standards. In an ISMS both sit below the information security policy issued by top management.
As a rule of thumb, a policy should survive a change of tool, and a procedure should survive a change of staff. How the policy framework fits into building an ISMS is covered in the guide to implementing an ISMS.
Which document do you need?
The document you need follows from what you want to record:
| If you want to record … | it is a … |
|---|---|
| what the organisation aspires to as a whole | top-level policy |
| that something is binding and who is responsible for it | policy |
| the order in which several people act, with handovers and decision points | procedure |
| how one person performs a single activity in a particular tool | work instruction |
| that something was actually done this way | record, not a governing document |
Put tool names and click paths in a policy, and the policy has to be re-approved on every change of tool, possibly by top management. Put the requirement in the policy and the click path in the work instruction, and only the lower document changes.
Four levels from top-level policy to work instruction
A four-level document hierarchy separates the levels by audience, approval and trigger for change:
| Level | Audience | Approved by | Trigger for change |
|---|---|---|---|
| Top-level policy | the whole organisation | top management | strategic change |
| Policy | the roles affected | top management or a designated function | changed requirements |
| Procedure | the roles performing it | process owner | process changes |
| Work instruction and form | the performing unit | subject matter owner | change of tool |
German separates the top two levels as Leitlinie and Richtlinie, while English calls both "policy". In bilingual policy sets, decide which English word names which level, so the approval authority stays unambiguous.
What belongs in a policy?
A policy should contain eight elements:
- purpose
- scope
- audience
- binding requirements
- roles and responsibilities
- procedure for exceptions
- references to related documents
- document header with version, date, approval, responsible unit and date of the next review
Without an exception procedure, either a silent breach arises that nobody documents, or a blockage arises that holds the business up. An exception procedure names the deciding authority, the time limit and how the reasoning is documented. How the topics of a policy set can be structured is shown in the template IT security policies.
Approval alone does not make a policy effective
An approved policy takes effect only once the people concerned know it and apply it. Clause 7.5 of ISO/IEC 27001 governs the control of all documented information.
Four further steps make the policy effective:
- active announcement rather than quiet filing
- training on material changes
- a documented acknowledgement where direct obligations for employees arise
- a check of actual application in the internal audit
A policy set stays effective only if every procedure has a named owner and superseded versions are withdrawn. Where a rule touches the conduct or performance of employees in Germany, it may be subject to co-determination; clarify the works council's involvement early.