Policy, Processes and Procedure

18 October 19

One of the questions I have been asked most often is the comparison and difference between Policy and Process! Over the years I have worked on a lot of business management documents entailing the creation of Policies, Processes and Procedures! This topic can be a real minefield and labyrinth. Let me simplify and demystify the recurring debate these 2 terminologies produce in strategy meetings!

When you ask someone ‘Hello, how are you doing’? The reaction is’ I’m good and how you are doing.’!The moment you get this answer you tend to question your own status. This is a momentary feeling everyone is guilty of! In the corporate world too, it is the same sentiment. Are we governing well? Are we ahead of the competitors? These are some of the questions we ask ourselves quite often!  So how do we measure performance? How to monitor and set it in good track? This is where Policies, Processes, and Governance come in! They are the key elements to ensure consistency in performance and customer satisfaction. Now let’s go right into it.

What is policy?

It is collective principles to guide decision making and ensure the desired outcome. It is a statement of intent incorporated as a procedure or way of operation. Policies are generally adopted by a governing body within an organization. The policy is a course or principle of action taken or proposed by an organization or individual.

What is a process?

A process is a series of actions or steps taken in order to achieve a particular end. Good governance needs stable processes with consistent result or outcome, aligned with the organizational Policies.

For example you set a policy that you want to grow roses only in your Garden.

You set the Processes for planting, watering, plucking etc to meet your goals.

One evening you find that the jasmine along with the roses. That means there is something wrong with your Policy implementation.

What needs to be done? Take an analytical look. Collect information and find out the cause.

There may be a lack of proper monitoring. On the other hand if growing Jasmine has a value addition then review your policy and reset to allow growing jasmine along with the roses. Therefore monitoring and control assist in operation.

Key resources and limitations:

In the above example, land is the key resource. This has defined boundaries.

So you have to optimize the resources and the yield. Identify other indirect constraints, apply appropriate weightage. There are also many common misconceptions about policy, process and procedures like it makes the organization less efficient, it’s employed by large organizations only and they reduce autonomy and are difficult to create. The benefits outweigh the limitations. In the business scenario there are many approaches that can be utilized to help set proper governance through policies, procedures and processes. This way risk is averted. The organization needs to determine its requirement for information security and continuity of information security management in adverse scenario like crisis or disasters like malicious damages. Information security continuity needs to be embedded as a part of the organization’s business continuity management policy and strategy. For operational safeguard, all stake holders say employees, suppliers, customers, contractors background verification needs to be conducted. This ensures compliance of legal, statutory, regulatory obligations and risk mitigation policy and planning. and regular monitoring, reviewing. Organization should invest part of their efforts in policy and Processes effectiveness along with revenue generation and volume. This will be a great value addition while you do a brand building exercise. Policies, processes, and procedures are distinctly different and understanding them is vital to getting on the road to the efficient operation of your organization. For better understanding consider the below real world example.

Online Shop


  • A company promises that a product can be delivered to a customer within 24 hours of when the customer places an order.
  • The policy is that the product must be delivered to the customer within 24 hours from the point he or she places the order.
  • The process is that staff will prepare the order for delivery, while managers monitor the process. The procedure gets more specific about how this process will be accomplished.

Example Procedure

  • Jim will fill orders in categories A, B, and C.
  • Jen will fill orders in categories X, Y, and Z.
  • John will supervise to ensure timely delivery.
  • If an employee is sick, the manager on duty should call Sarah to ask her to substitute for that person.

PS: Thank you tightship for the example


Risk &   business continuity management Advisory


Leave a Reply

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>