Policy Management Maturity Model

The interconnectedness of governance, risk management, compliance, and the integrity of the organization requires 360° visibility into the organization’s policies. Organizations need to see the intricate relationships of policies across the organization’s operations. It requires holistic visibility and intelligence into policies and policy management and how it impacts organizational integrity and culture. The complexity of business necessitates that the organization implement a strategic approach to policy management.

Successful policy management requires the organization to provide an integrated strategy, process, information, and technology architecture to consistently govern policies across the organization. The goal is to give comprehensive, straightforward insight into policy management to identify, analyze, manage, and monitor policies in context of operations, processes, transactions, and roles. It requires the ability to continuously monitor change and capture changes in the organization’s policies. As a result, organizations are measuring their current state and planning toward a future state of increased policy management maturity in the organization.

Mature policy management is a seamless part of governance and operations. It requires a top-down view of policies starting with the code of conduct and filtering down into division, department, process, and asset related policies as well as the risks, regulations, standards, procedures, and controls mapped to those policies. Mature policy management will be consistently led by the executives and the board and become an integrated part of the fabric of business operations and processes – not an unattached obscure layer of scattered documents on file shares and internal websites. It also means bottom-up participation, where business functions understand policies in context of their roles and responsibilities. GRC 20/20 has developed the Policy Management Maturity Model to articulate maturity in the policy management processes and provide organizations with a roadmap to support acceleration through their maturity journey.