How do policies and procedures fit together

A policy is a document that establishes rules and guidelines for an organisation. A policy is usually prepared by management and approved by the governing body of the organisation, and should be as clear and concise as possible. It is the “what” and the “why”, rather than the “how”. It should aim to achieve uniformity in the performance of activities, and compliance with legal and other requirements of an organisation. A good example of a company policy is a limits of authority policy. The purpose of this policy is to ensure that certain types of decisions and spending thresholds receive approval by persons occupying key positions.

The practical implementation of policies is set out in “procedures”. These are documents which describe the steps that are to be taken to implement policies. Procedures are the “who”, “when”, “where” and “how” of policies (an example would be a recruitment procedure underpinning a recruitment policy).

What does King IV say about policies and procedures

The King IV Report on Corporate Governance codifies voluntary principles and best international practices in respect of corporate governance. It contains specific recommendations around the need for and use of policies and procedures. As an overarching principle, the board of directors of a company should govern compliance with applicable laws, codes and standards in a way that supports the company being ethical and a good corporate citizen. King IV recognises that the primary leadership role of any governing body encompasses approving policies that give effect to the directions provided, as well as the overseeing and monitoring of implementation and execution by management.

In terms of King IV, management is responsible for formulating policies, which are to be approved by the governing body. Management then implements and executes strategies in accordance with the policies which are overseen by the governing body. As regards the application of policies, in line with the principle of proportionality and acknowledgement that there is no single “one size fits all approach”, King IV provides that where it is recommended that a formal policy be established, compliance could be accomplished by formalising in writing a few guiding criteria and processes, and by continually developing the document as learning evolves.

What policies does a small to medium enterprise need

King IV also provides guidance as to the specific policies that a small to medium enterprise should consider preparing. A small to medium enterprise should have a dividend policy, as well as policies for future equity ownership. Such policies should deal, for example, with the transfer, acquisition and disposal of shares in the company, including the method of valuing shares equitably. As the company grows, other policies that may be required are policies that articulate the governing body’s direction on (i) tax, risk, technology and information; (ii) compliance that identifies which non-binding rules, codes and standards the organisation has adopted; (iii) fair, responsible and transparent remuneration; (iv) stakeholder relationships; and (v) responsible investment.

When does a company need a policy

A policy regulates a clear issue. It must identify the issue to be addressed and stipulate the desired outcome. Generally, a company has one policy per issue (for example, leave) that it seeks to regulate. It must also be clear if a policy is intended to apply to an organisation as a whole (for example, social media) or only in a particular sector (for example, a specific department of an organisation).

Preparing policies

The lifecycle of a policy starts with research, followed by drafting and comment by the relevant stakeholders, submission to the governing body for approval, publication and implementation, and organisational training to the extent necessary. Finally, policies should be reviewed from time to time and updated as may be necessary.