Policies communicate entities’ expectations and values and are important tools for mitigating legal liability. They provide personnel with directions and guidance on how to perform their responsibilities in accordance with applicable laws. Nevertheless, although policies play a critical role in helping employees compliantly achieve business goals, the policy review and implementation process can sometimes feel like a “check-the-box” exercise.
If you’re seeking strategies to enhance your client’s or organization’s policies, look no further than the tips below. While the questions “who, what, when, where, why, and how” are typically thought of as the guiding inquiries for journalists, they also provide a useful framework for effectively incorporating policies into an organization’s compliance program. Next time that you find yourself drafting a policy or advising a client on how to implement policies effectively, consider the following questions to get you started:
A Checklist for Helping Your Client Draft and Implement Effective Policies
Who Is the Policy’s Audience and Owner?
- Who is the audience for this policy? Do all employees need to abide by this policy, or is this policy only applicable to employees performing certain functions?
- Who is the owner of the policy? It’s critical for organizations to update their policies as business processes evolve. If policies lack owners, they are more likely to slip through the cracks and not reflect current directives.
- Who should personnel contact with questions? Policies can’t encompass all possible scenarios that employees may face. It is important to provide employees with resources they can consult as questions arise to encourage continued engagement between front-line employees and compliance personnel.
What Is the Purpose, and What Are the Consequences of the Policy?
- What is the purpose of this policy? What behaviors does the organization encourage or discourage through this policy to prevent or mitigate legal liability?
- Although designed to help prosecutors assess the effectiveness of corporations’ compliance programs, the US Department of Justice’s (DOJ) Evaluation of Corporate Compliance Programs guidance document is a robust tool that can be used outside of the criminal justice space to enhance organizations’ compliance programs. Per the DOJ, organizations should ensure that their policies are “comprehensive” and accurately reflect the risks facing the organization.
- What are the consequences of violating this policy? Is termination of employment an appropriate/warranted response? To shape employees’ behaviors, organizations must enforce their policies, so it’s important to communicate the consequences of noncompliance proactively.
When Will the Policy Be Implemented?
- When will leadership communicate this policy to personnel?
- When will employees consult this policy when performing their roles?
Where Will the Policy and Employees Be Located?
- Where will this policy be located? Do all employees who are bound by this policy have access to it?
- The US DOJ emphasizes the importance of considering accessibility. Organizations should consider whether employees can easily search in policies, whether there are any obstacles to employees accessing relevant policies, and how to track employees’ access to policies to determine if there are policies that employees consult more frequently than others, which may indicate that additional training or attention on those topics could be beneficial.
- Where are the employees subject to this policy physically located, and has the organization translated the policy into different languages as applicable?
Why Is This Policy Necessary?
- Why is this policy needed? Sometimes, there can be a temptation to draft and implement new policies without first considering whether a policy is the most effective way to shape employees’ behavior. Should the organization consider communicating the information through a brief training session or managers having small group discussions with their teams?
- Why does this policy matter to me and my role? Employees must understand how a policy will impact them; otherwise, it’s unlikely that employees will remember to use the policy to ensure that they adhere to the organization’s expectations.
How Will the Policy Be Implemented?
- How will the entity implement this policy? Will the organization provide training on this policy? When introducing any new policy, there are change management considerations. Engaging employees subject to the policy early in the development process can help you organically develop champions and proactively identify pain points before introducing a new policy.
- How will we effectively communicate the organization’s expectations to employees in this policy? Written text is a common medium for documenting policies; however, consider if decision trees or flow charts may be more useful tools for your audience.
- How will the organization monitor compliance with the policy? Consider developing a self-audit process through which an employee not involved in administering the policy reviews a sample of items subject to the policy to determine if personnel processed them in compliance with the policy. This can be an effective way for the organization to identify and remedy any procedural gaps proactively.
Fostering a Culture of Compliance
Policies are an effective vehicle for establishing and communicating expectations to employees and third parties. The processes implemented through policies can positively impact the experiences of employees, customers, and vendors. While policies are important tools, they are most effective when leveraged in an organization committed to fostering a culture of compliance and achieving business goals in line with applicable laws.
