Compliance Week Magazine: Best Practices in Policy Management

About this Article

A new study from NAVEX ranks companies’ management of their policies and procedures in terms of maturity. In this short Compliance Week article, learn best practices in how to manage your policies and procedures and what constitutes a mature compliance program.

1. For anyone responsible for:

   Creating policies and/or procedures, or managing and distributing policies

2. What You'll Learn:

   • How to determine where your organisation is in the maturity model for policy and procedure management
   • The importance of a central repository and automated software for policy management
   • How to make policy management a cross-functional responsibility
   • How to develop an escalation policy

3. Page length:

   3 pages

Read the Article

Best practices in policy management

REPRINTED FROM:

COMPLIANCE WEEK MAGAZINE
JUNE 2018 ISSUE

A new study from NAVEX ranks companies’ management of their policies and procedures in terms of maturity. Jaclyn Jaeger has more.

Ethics and compliance officers have a new resource against which to benchmark their own policy and procedure management programme.

That resource is NAVEX’s 2018 Ethics & Compliance Policy & Procedure Management Benchmark Report, representing over 1,200 respondents globally who influence or manage their company’s ethics and compliance program. In this year’s report, NAVEX ranked each programme’s maturity level as either advanced; maturing; basic; or reactive.

In a Webinar discussing the report, Carrie Penman, chief compliance officer of advisory services at NAVEX, explained that each company’s programme maturity level was rated based on several key criteria: “Do they proactively update and create policies, or do they more reactively update documents when a problem arises? Do they leverage software to automate the policies, track attestations, test for comprehension, and can they easily access audit trails? Do they have systems in place to manage version control and accessibility to key documents?”

According to the report’s findings, 65 percent of respondents have basic or reactive policy and procedure management programmes, while 21 percent have a maturing programme. Just 14 percent were classified as advanced. “Effective policy management can really impact every area of an ethics and compliance programme, starting with the code of conduct,” Penman said.

“Effective policies are required to be kept up to date with new regulations to clearly outline expectations and processes, with the ultimate objective of impacting behaviour and ultimately the organisational culture.”

Taking cues from companies with advanced policy and procedure management programmes, prudent ethics and compliance officers who are seeking to mature their own programmes are advised to consider the following steps:

Be proactive about reviewing policies. Advanced and maturing policy programmes are more proactive and sophisticated in their approach to policy management concerning the creation and review of policies. This includes maintaining records and updating policies before issues arise. Reactive programmes, in comparison, typically review policies only after an issue arises.

Leverage software tools to automate processes and keep a centralised repository of policies. Companies with advanced policy management programmes automate their policy management systems, which ensures that employees can access the latest versions of key policies. Given the rapid clip at which some regulations change, “making sure employees have the most current version of a policy at any time is important,” Penman said.

Reactive programmes, in comparison, typically rely on manual processes to perform basic tasks. “This leaves them without audit trails, version control, or consistent metrics to measure programme effectiveness,” the NAVEX report states. Best practice is to review policies every one to two years and whenever an associated regulation or requirement changes.

Additionally, advanced and maturing policy management programmes tend to manage a wider variety of policies, procedures, or other related documents, whereas reactive programmes tend to manage fewer. The NAVEX report found that 77 percent of respondents, overall, manage 10 or more unique policies, and 83 percent manage 10 or more unique procedures.

Moreover, 23 percent of respondents said they manage more than 100 policies, and 35 percent manage more than 100 procedures. This is particularly true of highly regulated industries—healthcare, finance and insurance, and manufacturing—all of which often manage over 100 procedures. Respondents to the NAVEX report cited a wide variety of policies and procedures being managed, but the top four cited were codes of conduct; HR, labour and employment policies; IT/data security; and conflicts of interest.

Finally, companies that use an automated policy management system indicated that they’re more likely to have a dedicated compliance officer (63 percent vs. 47 percent of respondents whose companies don’t use automated software). They are also more likely to conduct a periodic assessment of their risk profile and programme (67 percent vs. 57 percent); have anonymous hotline reporting with consistent investigations (75 percent vs. 63 percent); and employ a risk-based due diligence approach for third parties (51 percent vs. 39 percent).

Require some form of attestation or certification. Most respondents (86 percent) said they require all employees to formally attest to at least one policy and nearly half (48 percent) require annual recertification. Additionally, 53 percent of companies with over 5,000 employees said they require third-party attestations, while another 29 percent said they do not, but do require equivalent certifications in vendor contracts. “This is an opportunity to review these practices for organisations who have third parties acting on their behalf,” the NAVEX report stated.

Have a ‘policy on policies.’ A policy on policies—documented guidelines for how to create and distribute new policies—is a very important part of a best-in-class policy and procedure management programme, Penman said, which 64 percent of all respondents indicated that they have. Having a policy on policies helps to ensure that all policies remain in the same format, making it easier for employees to find essential information, she said.

Make policy management a cross-functional responsibility. Companies with advanced policy management practices tend to involve more departments (three on average) concerning decision-making responsibility for policy and procedure management than basic and mature programmes (two on average), and reactive programmes (one on average). “Effective policy and procedure management is truly a shared responsibility across the organisation,” Penman said. “That was clear in some of the data.” Among all respondents, 44 percent said that compliance and risk is the decision maker in policy and procedure management, followed by HR (39 percent), the board of directors (36 percent), and legal (34 percent).

Leave decision-making authority with management. Although 36 percent of respondents said that their boards act as decision makers on policy management, that is not a recommended best practice. “It’s good that the board is involved, but its role needs to be properly calibrated,” Penman said.

Best practice is for decision-making authority to rest with management, with the board playing an advisory role. “Board members should be influencers on policies and procedures, not the decision-makers or the individuals who run the actual programme,” Penman said. Exceptions should only be made for making decisions on the code of conduct and other policies addressing high-risk areas, she said.

Have in place an escalation policy. “In much of the work that I have done with our customers, one of the most important policies that a compliance programme needs to have is an escalation policy on what needs to be escalated—whether it be to the board or senior management—and in what timeframe,” Penman said.

Mature and effective policy and procedure management programmes ultimately translate into a more robust ethics and compliance programme. In fact, companies with advanced policy and procedure management programmes rate themselves more highly in every aspect of their overall ethics and compliance programme, including in the areas of keeping up-to-date with new regulations (81 percent), legal defensibility and governance (79 percent), and board reporting and engagement (77 percent).

Companies with best-in-class policy and procedure management programmes, NAVEX concludes, are more likely to take a proactive approach to creating, reviewing, and updating policies and procedures; more likely to involve multiple departments in the creation and review of policies; and more likely to track metrics on programme effectiveness, with the board in an oversight role. ■

About NAVEX

NAVEX’s GRC software and compliance management solutions support the integrated risk, ESG and compliance management programs at more than 13,000 organizations worldwide.