A collaborative approach to policy development and approval DESIGNED BY: SPONSORED BY:

Policy development is continual, whether creating new policies or revising existing ones in response to change. Organizations need a structured
approach to policy development supported by appropriate technology to ensure that policies are developed and approved in a collaborative and
consistent manner in accordance with the scope and design of the policy management system.

A SUITABLE AND SCALABLE SYSTEM KEY STEPS TO A COLLABORATIVE PROCESS

Each organization will establish and define key roles
REGULATION RISK
in the policy management program to suit their own POLICY
needs considering the number and scope of
policies, the nature of the business and the overall
management style. Some may combine author and
owner roles; others may use a team to draft key
policies; a few might have a team of assistant policy
program managers and one or more policy review
and approval committees. Most will have the key
Establish a 'policy on policies' Determine need for new or amended Draft policy with input Review new or edited policy to Obtain final approvals
roles described below. 1 that sets templates, style
2 policy based on analysis of changes
3 from relevant subject
4 ensure compliance with 'policy
5 and sign off.
guides and development in regulation, business operation and matter experts. on policies'.
process. risk profile.

SHOULD WE WRITE A NEW POLICY?

All policies adhere to
ORGANIZATIONAL ROLES TECH
corporate style guides and
STEERING COMMITTEE templates
• Govern the policy management v3.0
program DANGER
• Approve templates, guidance Don't let your
01010100110110
and procedures 10100100110001 policy house fall
• Review and revise the program 01011010010010 into disrepair.
01010101010001
as needed to reflect changes in 01000101011010
10101010101101
the environment 01110010101010
• Include representatives 10001010101010
10101001101101 PURPOSE & SCOPE
across departments 01001001100010
10110100100100
10101010100010
10001010110101 POLICY Is the policy required by law, regulation, contract,
PROGRAM MANAGER 01010101011010 THOU
11100101010101 or other obligation?
• Manage the policy development POLICY
POLICY
00010101010101 SHALT ALWAYS
process 01010011011010
• Guide policy owners and
10010011000101
01101001001001
Does the organization’s size, business, industry,
developers 01010101000101 or workforce justify having this policy?
00010101101010
• Oversee policy approval 10101010110101
11001010101010 POLICY STATEMENT
committees 00101010101010 Will the policy enhance business performance,
10100110110101 improve productivity, effectiveness, or efficiency?
• Chair and/or facilitate the 00100110001010 CONTENTS
steering committee 11010010010010
10101010001010
1. 1. 1.
2. 2.
00101011010101 2.
OBJECTIVES
Will the policy enhance employee or customer
01010101101011
10010101010100 experience?
POLICY OWNER 01010101010101 DEFINITIONS RELEVANT CONTROL STANDARDS
• Ensure that each policy remains 01001101101010
POLICY 01001100010101
Is the policy just creating another layer of
accurate and relevant 10100100100101 MAP & LINK
• Establish plan for policy
01010100010100 POLICY

OBLIGATIONS POLICIES PROCEDURES CONTROLS bureaucracy?

01010110101010
10101011010111
communication and training 00101010101000
• Evaluate changes in factors 10101010101010 Will the policy be consistent with the
10011011010100
affecting each policy 10011000101011 organizational culture?
01001001001010
RELATED POLICIES & CONTROLS
• Oversee revision or decision to 10101000101000
retire each policy 10101101010101 How did we handle this without a policy?
01010110101110 APPROVAL v1.0 v2.0 v3.0
01010101010001
01010101010101
00110110101001
00110001010110
POLICY AUTHOR 10010010010101 Can an existing policy be updated to address the
• Collaborate to ensure all 01010001010001 APPROVALS & OWNERS HISTORY & AUDIT TRAIL necessary items, eliminating the need to write a
necessary input new policy?
• Draft policies using approved Is the time and money required to administer the
templates and style guide policy reasonable in relation to the benefits
• Follow the established
CONTRIBUTORS TO THE PROCESS
obtained?
development process Input may come from key areas of the
business, including legal, compliance, HR, Do we have the mechanisms to communicate
• Confirm each policy addresses and enforce the policy?
identified obligations operations and in the three lines of defense.

©2019 OCEG, Contact support@oceg.org for comments, reprints or licensing OCEG POLICY MANAGEMENT ILLUSTRATED SERIES