Usable policies share four traits
Length is not a measure of quality. The policies people follow tend to have four things in common.
Every rule has an owner
A sentence such as "invoices must be approved" leaves open who approves, in which system and by when. We write "the budget holder approves the invoice in NetSuite within three business days of receipt", so that the rule can be followed and checked.
Thresholds are numbers
"Significant purchases need CFO approval" invites argument. "Commitments above $25,000 need CFO approval before the purchase order is issued" does not. Numbers also make a rule testable: anyone can query the ledger for commitments above $25,000 and see who approved them.
Exceptions have a route
Every policy will meet a case it did not foresee. A good one says who may grant an exception, how it is recorded and how often exceptions are reported to management. A policy with no exception route gets ignored rather than bent.
Each document carries a review date
A named owner, a last-reviewed date and a next-review date sit at the top of each document. When a system changes or a role moves, the owner knows the update is theirs to make.
Authority policies come first
We draft in order of consequence. Authority and approvals come first, because every other policy refers to them. Payments and vendor changes follow, then close and reporting, then everything else. A company that runs short of time or budget halfway through still has its most important rules in writing, and each later policy can point to an approval matrix that already exists. The manual table of contents shows where each policy sits.
Some documents must exist in writing
Several regimes ask for specific written documents, and reviewers test them against practice.
- Federal awards. The Uniform Guidance requires written procedures for payments and for determining whether costs are allowable (2 CFR 200.302), documented procurement procedures with written standards of conduct covering conflicts of interest (2 CFR 200.318), and salary charges supported by records of actual work (2 CFR 200.430). Our grant and Uniform Guidance work covers the full set.
- Tax-exempt organizations. Form 990, Part VI, asks whether the organization has a written conflict-of-interest policy, a written whistleblower policy and a written document retention and destruction policy. The answers are public.
- Listed companies. Audit committees must set procedures for complaints about accounting, internal controls and auditing matters, including confidential, anonymous submission of concerns by employees.
Conduct documents need a working channel
A code of conduct is often the most widely distributed document a company owns, and the least tested. The Department of Justice's guidance on evaluating compliance programs asks whether policies are accessible to employees, whether the reporting channel is used, and what happens to a report once it is made. That is why we write the code and the channel together and test the channel before launch. Our code of conduct and speak-up work covers the triage rules, investigation protocol and anti-retaliation steps behind it.