6 Best Practices to Proactively Manage Corporate Policies

The Challenge

While policies are integral to the organization, the process of creating policies, reviewing them on a regular basis, ensuring effective policy communication, and tracking policy adherence is not easy. Updating policies in line with evolving regulations, training employees on applicable policies, tracking compliance with policies, authoring, collaboration, and approval of policies and managing policy exceptions are some of the many challenges that compliance and ethics professionals face.

Best Practices

Be proactive about policy change

Compliance and ethics professionals need to shift gears and set a cadence to proactively manage, monitor, and mitigate compliance risks by frequently reviewing the corporate policies and procedures. There could be multiple reasons for a policy update -regulatory change, internal business change, market factors, business expansion, mergers and acquisitions - but regardless of the reason, policy owners should set aside some time to review their policies, make sure they are current and discard the policies that are no longer applicable.

Collaborate with key stakeholders

There is little doubt that policy creation and implementation is a collaborative process. Creating, updating and implementing policies requires inputs from multiple teams across the organization. With teams today spread across the globe, in different time zones, one might think that collaboration on policies is a challenge but that’s where technology comes to play. Policy management tools allow multiple teams to work together in real time. Each can provide their comments and make any changes on the fly, saving significant time in back and forth communication.

Map policies to regulations, risks, and controls

Another good practice in policy management is mapping policies to regulations, risks, controls and processes. This approach is useful for organizations of all sizes. Sifting through thousands of policies every time there is a change in regulation, or every time there is a new risk or new process can be a herculean task. However, when the regulations, processes, risks, and controls have already been linked to a policy or a section of a policy, you can quickly understand which policy has been impacted by a change, and make the necessary modifications accordingly.

Get policies to where the employees are

While there may be hundreds and thousand of policies in an organization depending on the size and the industry that it operates in, not every policy is applicable to every employee. So, instead of employees having to search through different databases to check the policies applicable to them, it makes sense to take the policies where the employees are -could be the intranet, email, CRM tool, chatbot, or any other system where employees spend most part of their day. Employees should be able to search for policies for quick reference or even attest to policies from wherever they are.

Keep a tab on policy exceptions

While every policy cannot be given an exception, there are situations that demand exceptions to be granted for specific policies for certain individuals. For eg: with the given COVID 19 pandemic, many organizations that initially had a work from home policy for only 2 days a month had to extend it for more than a month, and this exception was granted to all employees given the uncertain times. However, exceptions do carry an element of risk and these risks need to be assessed and exceptions need to be reviewed at regular intervals.

Track policy effectiveness

Organizations might have the best written policies but the actual test of their efficacy or what really matters is whether they are being adhered to. The effectiveness of a policy program hinges not only on its ability to facilitate policy creation, and communication, but also on its ability to track and assess policy awareness. With appropriate data and metrics, organizations can track the effectiveness of their policies and make amendments as required. Some valuable metrics could be audit preparedness, reduction in compliance failures, reduction in policy violations, and easy access to policies.

MetricStream Policy and Document Management

MetricStream Policy and Document Management streamlines and simplifies the creation and communication of policies. It enables a structured and integrated approach towards managing the full range of policies across the enterprise. The web-based product provides a centralized policy portal to store and access policies. It helps in mapping policies to regulations, risks, and controls, thereby strengthening compliance, while highlighting potential risks and gaps. The product brings policies to where you are - engaging the first line and increasing policy awareness. First-line users can quickly find policies using natural language interfaces with results based on a user’s intent and context of the search. It also helps in managing policy attestations.