You’re developing policy, and you’re doing it wrong.

Stack of papers, alluding to policy that is large and out of control.

Pretty bold statement, I know, hear me out.

Did you, alone, write, review, and sign the policy? Unless you’re in a one person company, you’re doing it wrong. At minimum, to be sure you actually understand the implications of the policy, have some of those DIRECTLY affected review it. 

Do you have actual, documented sign off from stakeholders? “I sent it via email and didn’t hear anything negative” is NOT documented sign off.

Did you consider what people , process , and technology changes your organization needs to support the policy? Have thoughtful conversations with the people who actually need to adopt and support the policy. What do they need to be successful?

Do you call out specific measures, timelines, technologies in your policy? You’re probably (maybe not always) doing it wrong. These things will change based on business, technology, or legal changes. You don’t want to have your policy constantly changing because of procedural or overly specific items. Instead, call out a governing group and framework in your policy. Allow governance to adapt the framework to changes in the environment. This is particularly true of policy around technology. Framworks can be the how of policy, so the folks affected can be living with these almost daily.

Are you communicating the policy to stakeholders? I’m not talking about posting it on your policy website, along with the hundreds and thousands of other policies. Did you discuss it with the organization? Did you make the rounds to the teams supporting the policy and answer questions, and get feedback? If you’re mostly managing policy changes through governance and frameworks, direct policy changes are not happening often. And the folks that need to know about policy or framework changes should be part of governance so the changes should be known!

Are you taking challenges to the policy seriously? You are not your policy, don’t get defensive. Know that the folks that need to implement the policy are most likely under pressure, and have many policies to consider. You all need to balance the spirit of the policy, with the reality of implementing and supporting the policy.

If you’re not doing those things above, you’re throwing it over the wall and walking away. If that’s you, you’re doing it wrong.