Despite their critical importance on so many levels, organizational policies are not getting the attention they deserve, according to a recent research report.
A survey from NAVEX Global, an ethics and compliance software provider, finds that policy management is still evolving, with many organizations yet to scale or centralize their internal processes to meet growing policy control challenges head-on. Essentially, few companies have a streamlined way to handle their now hundreds of forms and procedures.
Randy Stephens, vice president of NAVEX Global's Advisory Services team and co-author of the study, explains that properly managing the policy lifecycle allows employers to cover all the bases in terms of company expectations, matching policies to risks and integrating policies into training and awareness.
At the same time, HR, by collaborating with legal and compliance, can improve their organizations, providing stronger defenses to risks they may not have anticipated.
"Yet most organizations—for a variety of reasons—have yet to fully embrace the ability to establish and communicate corporate culture through a robust policy management process." Stephens says.
Overall, the number and complexity of policy-related documents being managed is significant, with 51% of respondents indicating that they managed 100 or more policies, procedures and forms, and 20% managing more than 750 documents —a massive yet critical task.
In addition:
- 20% of respondents say they don’t have a centralized approach to policy management
- 48% have no automated processes for tasks such as authoring, reviewing and publishing policies
- 58% track no metrics related to the use or effectiveness of their policies
- Of the 24% of respondents who do use metrics, most commonly track only the ease of access to policies, indicating many organizations have little or no information about the impact, awareness or effectiveness of their policies.
“Clearly, policies are often an afterthought and are stuck haphazardly on an intranet site or other policy database and rarely referenced,” he explains. “They lack consistency, version control, awareness and accessibility.”
Stephens outlined some key takeaways for HR executives to consider as a result of the NAVEX Global survey:
Policy management must mature
From an efficiency and resource perspective, Stephens says the ideal scenario is to have an advanced approach to policy management, meaning "well-oiled" machines that:
- Keep policies up to date with new laws, regulations and other changes in business climate
- Ensure policies are tightly aligned with organizational risk and corporate culture
- Provide easy access to policies for employees and other stakeholders who need to reference them
- Empower legal and HR departments to conduct investigations and take disciplinary action more efficiently
- Protect organizations from legal and regulatory risk
Limited dedicated resources
Many employers say they have very limited funding and staff dedicated to policy management. This is true even for organizations managing hundreds—or even thousands—of policies. However, there is some evidence that policy management is becoming a higher priority, with almost a third of respondents saying they expect their policy management budget to increase over the next year.
Stephens says industry data on policy management budgets is difficult to come by and comparing the size of policy management budgets and fulltime employees (FTEs) is far from a science.
“As with all elements of an effective compliance program, one size does not fit all,” he says. “The right funding level or number of FTEs should be based on the needs of the individual employer as revealed by a reasonable risk-based assessment of the organization’s operations and compliance program.”
An obvious blind spot
As noted, 58% report they have no metrics in place to measure policy management effectiveness. The most commonly measured aspects are accessibility (24%) and the reduced burden on employees’ time (19%) – indicating that many employers have little or no information about the impact, accessibility or awareness of their policies.
Stephens cites the old adage of “you can only fix what you can measure.”
“The employers who do not measure the effectiveness of their policy management program in any way lack data to guide improvements—or even to alert them to problems,” he says.
To help mature the policy management function, policy management owners and stakeholders must be able to demonstrate results related to improved policy management practices. While anecdotal evidence is good, hard data is better. A lack of data will hamper efforts to gain necessary financial resources for improvement.
Policy automation = improved outcomes
Employers that use specialized policy management software (not limited to NAVEX Global’s software) consistently rate their organizations higher on the execution of policy management activities than those organizations not using software.
In fact, the 25% of respondents using software say it has had a profound impact on the quality and effectiveness of their overall program. Also, survey data demonstrates that those who have invested in policy management software have reaped substantial benefits.
Stephens does say that using software alone is not a predictor of an effective program, but “our report data indicates that organizations should consider policy management software as a way to significantly improve their overall policy management program effectiveness.”
In the end, Stephens believes HR, compliance and legal must collaborate to ensure that a credible risk assessment is completed.
“After the risk assessment, effective policies should be created which align with the risks and other HR processes,” he concludes.