Policies & Procedures: Is it Important to Have Formally Documented Policies and Procedures?

During the planning phase for an audit, many organizations perform an extensive and formal review of their policies and procedures to determine if they meet the audit guideline requirements.

Having formal, concise, and comprehensive policies and procedures that describe the internal processes of a company is critical to having a successful audit.

Policies and procedures have such a significant impact on the internal happenings of a business because they provide the foundation of internal operations.

For example, a formal policy and procedure document regarding the data backup and replication process is meant to provide the affected personnel (i.e. systems administrators) with a clear and concise understanding of the desired business objective. Employees need to have a guiding force to provide them direction in executing their job to a sufficient level. To best support this, policies and procedures should have a policy owner. The role of the owner is to review and approve the policy on an at least annual basis to ensure the document is accurate and reflects current business processes.

Another important aspect is having the policies and procedures easily accessible to employees.

It is more and more common for companies to have a corporate intranet that acts as a central storage device for employees to easily access the policy and procedural documents. If a company does not have a corporate intranet, then on an annual basis the most up to date policy and procedural documents should be sent out to all employees.

In summary, policies and procedures provide the framework for a company's entire operations, thus it is important for companies to document and continuously revise their policies according to their current business operations.