How to Draft an Effective Organisational Policy: Policy vs Procedure vs Framework, and When to Review

Organisations rely on policies to establish expectations, allocate responsibility and create consistency in how important matters are managed. Yet many organisations accumulate policies without giving sufficient attention to whether a policy was the right governance instrument in the first place, whether it was drafted in a way that can actually be implemented, or whether it remains appropriate as the organisation changes.

A document can be professionally written, properly approved and stored in the organisation’s policy repository and still be ineffective.

Effective policy governance therefore requires more than drafting. It begins with identifying the problem or governance requirement that needs to be addressed, determining the appropriate instrument, developing requirements that can be understood and applied, establishing clear ownership and approval, and ensuring that the document is reviewed when circumstances change.

This approach is consistent with a broader principle of sound governance: policy should give effect to organisational direction, while implementation should be subject to oversight and monitoring. King V reflects this division of responsibility by providing that the governing body considers and approves policy and planning before delegating implementation to management, while retaining responsibility for overseeing and monitoring implementation (Institute of Directors in Southern Africa, 2025).

Understanding the policy lifecycle is particularly important because the terms policy, procedure and framework are often used interchangeably, despite serving different purposes.

A common mistake in policy development is beginning with the assumption that a policy is required.

A governance concern arises, an audit finding is raised, legislation changes or management identifies inconsistent practices, and the immediate response is: “We need a policy.”

Sometimes that is correct. Sometimes it is not.

Before drafting begins, the organisation should establish what problem it is trying to solve. Is there an absence of organisational direction? Are responsibilities unclear? Is the organisation trying to standardise how a particular activity is performed? Does it need to establish a broader governance structure within which several policies, processes and responsibilities will operate?

The answer determines the type of document required.

This distinction matters because an organisation can have too many governance documents as easily as it can have too few. Creating a policy for every operational issue can result in duplication, contradictory requirements and a policy environment that employees struggle to navigate. Conversely, placing important organisational principles inside a detailed procedure can obscure matters that should carry formal authority and be subject to appropriate oversight.

The first drafting decision should therefore not be what the policy will say. It should be whether a policy is actually the appropriate instrument.

Although organisations may use these terms differently, the distinction between them is generally one of purpose.

A policy establishes the organisation’s position, principles, rules or requirements in relation to a particular matter. It answers questions such as: What is required? What does the organisation expect? Who is accountable? What principles govern the matter? Policy can therefore be understood as establishing the parameters that guide organisational decisions and conduct.

A conflict-of-interest policy, for example, may establish the organisation’s position on identifying, declaring and managing conflicts, specify the responsibilities of directors and employees, and set out the consequences of failing to disclose relevant interests.

A procedure, by contrast, explains how something must be done. It translates requirements into operational steps. Where the policy establishes that conflicts must be declared, the procedure might explain how a declaration is submitted, where it is recorded, who reviews it, how conflicts are escalated and what records must be retained.

A framework usually operates at a broader level. It establishes the structure, components, responsibilities and relationships through which an area of governance or management will operate. A risk management framework, for example, may describe the organisation’s overall approach to risk governance, risk ownership, assessment, monitoring, escalation and reporting, while individual policies and procedures address particular aspects of that system.

These documents should work together rather than compete with one another. A framework can establish the overall architecture, a policy can establish the organisation’s requirements within that architecture, and procedures can explain how those requirements are implemented.

The problem arises when these functions are confused. A policy containing pages of operational instructions can become unnecessarily difficult to maintain because every process change requires formal policy amendment. A procedure that attempts to establish high-level governance principles may lack the authority or oversight appropriate to those principles. A framework that simply repeats policy statements without explaining how the governance system fits together adds another document without adding clarity.

Good governance documentation is therefore not about producing more documents. It is about ensuring that each document has a clear purpose within the organisation’s governance architecture.

Once it has been established that a policy is required, drafting should begin with its intended outcome.

What behaviour, decision-making or organisational practice should be different because this policy exists?

That question sounds simple, but it changes the drafting exercise. Instead of starting with standard headings or borrowing language from another organisation, the drafter begins by understanding the policy’s purpose, regulatory context, organisational environment and intended users.

An effective policy should ordinarily establish a clear purpose and scope, identify who and what it applies to, articulate the relevant principles or requirements, allocate responsibilities, identify appropriate authority and accountability, and explain how the policy will be implemented, monitored and reviewed.

The precise structure will depend on the subject matter and the organisation. A policy governing information security will not require exactly the same architecture as a board diversity policy or an employee travel policy. Standardisation can improve consistency across an organisation’s policy suite, but templates should support thinking rather than replace it.

This is particularly important when organisations borrow policies from external sources. Another organisation’s policy may provide useful reference material, but it was developed for that organisation’s legal obligations, governance arrangements, risk profile, systems, delegations and operating environment. Changing the organisation’s name at the top of the document does not make the policy appropriate.

Effective policy drafting requires contextualisation. Sound policy development should be informed by relevant evidence, organisational context, available resources and the environment in which the policy will ultimately operate (OECD, 2020).

Policies often become unnecessarily complex because they are written to sound authoritative rather than to communicate requirements clearly.

Legal and technical terminology may be necessary in certain circumstances, particularly where precision is important. Complexity for its own sake, however, does not improve governance.

The people subject to a policy should be able to determine what is expected of them. Those responsible for implementing it should understand their responsibilities. Those responsible for oversight should be able to determine whether the requirements are being followed.

Ambiguous language creates room for inconsistent interpretation. Excessive detail can obscure the important requirements. Undefined responsibilities can leave everybody involved but nobody accountable.

The drafting process should therefore test practical questions throughout: Who must do this? What exactly must they do? When must they do it? Who has authority to approve or decide? What happens if the requirement is not followed? What supporting procedure, form, register or system is required for implementation?

If those questions cannot be answered, the policy may not yet be ready for approval.

A policy does not become effective merely because a board, committee or executive has approved it.

Approval establishes authority. Implementation gives the policy practical effect.

Depending on the nature of the policy, implementation may require communication, training, revised processes, new systems, updated forms, changes to delegations, assigned responsibilities or integration into existing control and reporting arrangements.

This distinction is recognised in governance and compliance management standards. King V contemplates that the governing body approves policy and planning, delegates implementation and execution to management, and thereafter oversees and monitors whether those arrangements are operating as intended (Institute of Directors in Southern Africa, 2025). ISO 37301 similarly approaches compliance as a management system that must be established, developed, implemented, evaluated, maintained and improved rather than simply documented (ISO, 2021).

This matters because policy governance can easily become document governance. Considerable effort is spent drafting, reviewing and approving the document, after which the approved version is uploaded to a repository and attention moves to the next governance requirement.

The better question is what happens after approval.

If employees do not know that the policy exists, managers do not understand their responsibilities, supporting procedures have not been developed, or organisational practices remain unchanged, formal approval has achieved very little.

The organisation should therefore consider implementation while the policy is being drafted rather than after it has been approved. A requirement that cannot realistically be implemented should be identified during development, not discovered months later when compliance is assessed.

Every policy should have identifiable ownership.

Policy ownership does not necessarily mean that the owner personally drafts every amendment or performs every activity required by the policy. Rather, the owner should have sufficient responsibility for the subject matter to ensure that the policy remains appropriate, is implemented within the organisation and is brought forward for review when necessary.

The policy should also identify the appropriate approval authority. Importantly, not every organisational policy necessarily requires board approval.

King V positions the governing body as the focal point and custodian of corporate governance in the organisation. It expects the governing body to provide strategic direction, consider and approve policy and planning, delegate implementation and execution to management, and oversee and monitor implementation (Institute of Directors in Southern Africa, 2025). That should not be interpreted as requiring the governing body to approve every document carrying the word “policy”. The appropriate approval level should be considered in the context of the organisation’s governance arrangements, delegations and the significance of the subject matter.

Boards should avoid becoming the approval point for operational documents simply because those documents have been labelled policies. Equally, matters that establish significant governance requirements, risk parameters or organisational responsibilities should not be placed below the appropriate level of authority merely for administrative convenience.

Document classification, ownership and approval authority are therefore connected. Deciding what kind of document is required helps determine who should own it, who should approve it and how changes should subsequently be controlled.

There is no universally appropriate review period for every policy.

Organisations commonly establish review cycles such as annual, biennial or three-yearly reviews. A scheduled cycle is useful because it prevents policies from remaining untouched indefinitely. However, the existence of a review date should not create the assumption that nothing needs to happen until that date arrives.

A policy should also be reviewed when there is a material reason to question whether it remains appropriate.

Changes in legislation or regulation may require immediate amendment. An organisational restructure may change responsibilities or approval authorities. A new system may make an existing process obsolete. Audit findings, control failures, compliance breaches or incidents may expose weaknesses in the policy. Changes in the organisation’s strategy, operations or risk profile may mean that requirements written several years earlier no longer address the environment in which the organisation operates.

Management-system thinking reinforces this principle. ISO 37301 treats an effective compliance management system as something that must be established, developed, implemented, evaluated, maintained and continually improved as organisational and compliance circumstances develop (ISO, 2021). Monitoring and evaluation similarly allow decision-makers to determine whether policies are achieving their intended objectives and to make adjustments where necessary (OECD, 2020).

This is why effective policy governance should incorporate both periodic review and event-driven review.

The review date establishes the longest period the organisation intends to allow before deliberately reconsidering the document. It should not prevent an earlier review when circumstances require one.

Policy reviews can become mechanical exercises.

The document reaches its scheduled review date, it is circulated to the relevant stakeholders, minor wording changes are made, the review date is extended and the policy is submitted for reapproval.

Technically, the policy has been reviewed.

A meaningful review should ask a more demanding set of questions. Is the policy still necessary? Does it still address the risk or governance requirement for which it was created? Have legal, regulatory or organisational requirements changed? Are the responsibilities and approval authorities still correct? Is the policy being followed in practice? Have implementation difficulties emerged? Have incidents, audit findings or compliance monitoring identified weaknesses? Does the policy duplicate or contradict another document?

The review should also consider whether the document remains the correct instrument.

An operational policy may have become so detailed that parts of it should now sit in a procedure. Several separate policies may have developed into an interconnected governance area that would benefit from an overarching framework. A policy may even have become redundant because its requirements have been incorporated elsewhere.

Review is therefore not simply an opportunity to update dates and terminology. It is an opportunity to test whether the organisation’s governance documentation still reflects how the organisation should operate.

Individual policies do not exist in isolation.

Collectively, an organisation’s policies, procedures, frameworks, charters, delegations, terms of reference and other governance instruments form part of its governance architecture. Changes to one document can have consequences for others.

A change in delegations may require amendments to several policies. A new regulatory requirement may affect policies across different functions. A revised governance framework may change committee responsibilities. An organisational restructure may make references to particular positions, functions or approval routes obsolete across the entire policy suite.

This is why mature policy governance requires some form of central visibility over the organisation’s governance documents. At minimum, the organisation should be able to identify what documents exist, their owners, approval authorities, current versions, effective dates and scheduled review dates.

Without that visibility, policy management becomes reactive. Documents are often discovered to be outdated only when somebody needs to rely on them.

The quality of a policy should ultimately not be judged by its length, the sophistication of its language or even the fact that it has passed through the correct approval process.

The better test is whether it provides clear and appropriate direction, can be implemented in the organisation that adopted it, assigns responsibility and authority coherently, supports the management of the relevant governance or operational risk, and remains current as circumstances change.

That requires organisations to think beyond drafting.

Before creating a new policy, determine whether the organisation actually needs a policy, a procedure, a framework or some combination of these. During drafting, focus on the outcome the document is intended to achieve and the people who will have to implement it. Before approval, test whether its requirements can operate in practice. After approval, ensure that implementation occurs. And throughout the life of the document, remain alert to changes that may require review before the next scheduled review date.

A policy is not effective because it exists.

It is effective when the organisation can use it.

Understanding what makes a policy effective is one thing. Drafting one that works in practice requires translating that understanding into structure, clear requirements, appropriate authority, ownership and implementation.

The GRD Policy Drafting Guide is a practical companion for governance professionals and others responsible for developing or reviewing organisational policies. It takes you through the drafting process from defining the governance problem and designing the policy architecture to consultation, approval, implementation, monitoring and review.

It also includes practical drafting guidance and a final policy quality checklist to help you test whether a policy is ready for approval.

Download the GRD Policy Drafting Guide from the Governance Resource Desk.

Institute of Directors in Southern Africa (IoDSA) (2025) King V Report on Corporate Governance for South Africa 2025. Johannesburg: Institute of Directors in Southern Africa.

International Organization for Standardization (ISO) (2021) ISO 37301:2021 Compliance management systems - Requirements with guidance for use. Geneva: International Organization for Standardization. Available at: https://www.iso.org/standard/75080.html

Organisation for Economic Co-operation and Development (OECD) (2020) Policy Framework on Sound Public Governance: Baseline Features of Governments that Work Well. Paris: OECD Publishing. Available at: https://doi.org/10.1787/c03e01b3-en

This article provides general governance information and does not constitute legal advice. The appropriate process should be determined with reference to the particular circumstances, the Companies Act, the company's MOI and CIPC's current requirements.