Benchmarking Your Policy Management Program: Deficient, Common & Leading Practices

The GRC PunditWritten by
Published onDiscussionLeave a Comment on Benchmarking Your Policy Management Program: Deficient, Common & Leading Practices

Corporate policies define boundaries for the behavior of individuals, business processes, relationships, and systems. At the highest level, policy starts with a code of conduct, establishes ethics and values to extend across the enterprise, and authorize other policies to govern the entire organization. Unfortunately, most organizations do not connect the idea of policy to the establishment of corporate culture. Without policy, there is no written standard for acceptable and unacceptable conduct — an organization can quickly become something it never intended. Policy attaches a legal duty of care to the organization and cannot be approached haphazardly. Mismanagement of policy can introduce liability and exposure, and noncompliant policies can and will be used against the organization in legal (both criminal and civil) and regulatory proceedings. Regulators, prosecuting and plaintiff attorneys, and others use policy violation and noncompliance to place culpability.

An organization must establish policy it is willing to enforce — but it also must closely manage and monitor policy in place. Policy is a necessary means to clearly define, articulate, and communicate boundaries, practices, and expectations. An organization can have a corrupt and convoluted culture with good policy in place, though it cannot achieve strong and established culture without good policy.

Organizations often lack an auditable means of policy maintenance, communication, attestation, and training. To defend itself, the organization must be able to show a detailed history of what policy was in effect, how it was communicated, who read it, who was trained on it, who attested to it, what exceptions were granted, and how policy violation and resolution was monitored and managed. An ad hoc approach to policy management exposes the organization to significant liability. This liability is intensified by the fact that today’s compliance programs affect every person involved supporting the business, including internal employees and third parties.

If policy documentation doesn’t conform to an orderly style and structure, uses more than one set of vocabulary, is located in different places, and don’t offer a mechanism to gain clarity and support (e.g., a policy helpline), organizations are not positioned to drive desired behaviors in corporate culture or enforce accountability.

With today’s complex business operations, global expansion, and the ever changing legal, regulatory and compliance environments, a well-defined policy management program is vital to enable an organization to effectively develop and maintain the wide gamut of policies it needs to govern with integrity.

GRC 20/20’s Effective Policy Management Benchmark provides a framework for an organization’s approach to policy management to be measured against its peers within industry as well as organizations of similar size and structure across industries. The purpose is to identify whether an organization is Below Parity, at Parity, or Above Parity relative to its peers in the context of policy management.  Where an organization is significantly lacking ability it is ranked Inferior, while an organization that demonstrates outstanding ability is referenced as Best in Class.

The Effective Policy Management Benchmark can be used at a department or enterprise level. The Benchmark comparison is based on GRC 20/20 research and interactions. These interactions include projects, surveys, inquiries, and advisory engagements. The rankings are a guideline and represent GRC 20/20’s opinion and professional experience working with a variety of organizations across industries.

There is not a one-size fits all approach to policy management.  One organization’s approach to policy management will vary from another depending on size, nature of the business, scope of policies, resources, and executive sponsorship of a policy management program.  Care must be given when measuring an organization as many facets need to be taken into consideration.

GRC 20/20’s Effective Policy Management Benchmark synthesizes GRC 20/20 research and analysis of the following six key Policy Management Program components:

  1. Governance of Policy Management Program. Policy management program governance comprises the program management architecture, policy review cycles, executive “tone from the top” on policy governance, extending policy governance to mergers and acquisitions, compliance monitoring and assurance activities, and management reporting and dashboards.
  2. MetaPolicy.  The MetaPolicy, often referred to as the “policy on policies,” is the foundation on which to build an effective policy management program. It defines the critical elements of the organization’s policy management program. 
  3. Supporting Policy Management Resources.  Supporting the MetaPolicy, is an array of other resources to build out the policy governance process within an organization.  
  4. Policy Management Lifecycle.  The policy management lifecycle is the actual operation and process of the MetaPolicy in action to develop, manage, and maintain policies throughout their effective use. Failure to manage policy lifecycles results in policies that are out-of-date, ineffective, and not aligned to business needs. It also opens the door to liability when an organization is held accountable for a policy that is not appropriate or properly enforced. 
  5. Operational Effectiveness of Policy Management Program.  The Operational Effectiveness component of the Effective Policy Management Benchmark addresses how effectively the GPM and policy management lifecycle are implemented and managed across the organization. 
  6. Technology Enablement of Policy Management Program. A well-conceived technology strategy for policy management can enable a common policy framework across multiple entities, or just one entity or department as appropriate. Business requires a policy management platform that is context-driven and adaptable to a dynamic and changing environment. Compared to the ad hoc method in use in most organizations today, a governance, risk management, and compliance (GRC) technology approach to policy management enables better performance, less expense and more flexibility. 

GRC 20/20 does a number of benchmark projects for organizations.  The Effective Policy Management Benchmark is one among several, others include Effective GRC Management, Effective Risk Management, and Effective Compliance Management Benchmarks.

The latest GRC 20/20 research paper that provides more detail on the Effective Policy Management Benchmark has recently been published and can be accessed at the link below. It is free to access but requires registration on the GRC 20/20 Research website.

ACCESS BENCHMARK RESEARCH

There are also a variety of upcoming webinars GRC 20/20 is presenting on on the topic of Policy Management in August. These include:

Leave a Reply

Your email address will not be published. Required fields are marked *