Policies and procedures are a set of documents that describe an organization's policies for operation and the procedures necessary to fulfil the policies. They are often initiated because of some external requirement, such as environmental compliance or other governmental regulations, such as the American Sarbanes-Oxley Act requiring full openness in accounting practices.
Policies and procedures have many names including but not limited to business policies and procedures, standard operating procedures or SOP, or department operating procedures or DOP.
There are four very basic reasons that necessitate writing policies and procedures:
-
Operational needs - Policies and procedures ensure that fundamental organizational processes are performed in a consistent way that meets the organization's needs.
-
Risk management - Established policies and procedures are identified by Committee of Sponsoring Organizations of the Treadway Commission (COSO) as a control activity needed to manage risk.
-
Continuous improvement - Procedures can improve processes by implementing a Plan-Do-Check-Act (PDCA) approach by building important internal communication practices.
-
Compliance - Well-defined and documented processes (i.e. procedures, training materials) along with records that demonstrate process capability can demonstrate an effective internal control system compliant with regulations and standards.