A policy is a document that establishes rules and guidelines for an organisation. A policy is usually prepared by management and approved by the governing body of the organisation, and should be as clear and concise as possible. It is the "what" and the "why", rather than the "how". It should aim to achieve uniformity in the performance of activities, and compliance with legal and other requirements of an organisation. A good example of a company policy is a limits/delegation of authority policy. The purpose of this policy is to ensure that certain types of decisions and/or spending thresholds receive approval by persons occupying certain key positions.
The practical implementation of policies is set out in "procedures". These are documents which describe the steps that are to be taken to implement policies. Procedures are the "who", "when", "where" and "how" of policies (an example would be a recruitment procedure underpinning a recruitment policy). Finally, a "record" is the evidence of action carried out in respect of a policy.
The King IV Report on Corporate Governance codifies voluntary principles and best international practices in respect of corporate governance. It contains specific recommendations as regards the need for and use of policies and procedures. As an overarching principle, the board of directors of a company should govern compliance with applicable laws, codes and standards in a way that supports the company being ethical and a good corporate citizen. King IV recognises that the primary leadership role of any governing body encompasses approving policy that gives effect to the direction provided, as well as the overseeing and monitoring of implementation and execution by management.
In terms of King IV, management is responsible for formulating policy, which is to be approved by the governing body. Management then implements and executes strategy in accordance with the policy which is overseen by the governing body. As regards the application of policies, in line with the principle of proportionality and acknowledgement that there is no single "one size fits all approach", King IV provides that where it is recommended that a formal policy be established, compliance could be accomplished by formalising in writing a few guiding criteria and processes, and by continually developing the document as learning evolves.
King IV also provides guidance as to the specific policies that a small to medium enterprise should consider preparing. A small to medium enterprise should have a dividend policy, as well as policies for future equity ownership. Such policies should deal, for example, with the transfer, acquisition and disposal of shares in the company, including the method of valuing shares equitably. As the company grows, other policies that may be required are policies that articulate the governing body's direction on (i) tax, risk, technology and information; (ii) compliance, and that identifies which non-binding rules, codes and standards the organisation has adopted; (iii) fair, responsible and transparent remuneration; (iv) stakeholder relationships; and (v) responsible investment.
A policy regulates a clear issue. It must identify the precise issue to be addressed and define the desired outcome. Generally, a company has one policy per type of technology (for example, email or mobile phones), issue (for example, leave) or behaviour (for example, sexual harassment) that it seeks to regulate. It must also be clear if a policy is intended to apply to an organisation as a whole (for example, social media) or in a particular sector (for example, a specific department of an organisation).
The lifecycle of a policy starts with research, followed by drafting and comment by the relevant stakeholders, submission to the board of directors for approval; publication and implementation, and organisational training on the policy to the extent necessary. Finally, policies should be reviewed from time to time and updated as may be necessary.
