Policy Governance · 13 min read
What Is a Policy? Definition, Types and Examples
A policy is a rule an organization has decided on and written down, so that everyone it applies to knows what they must or must not do and why. In a business, a policy sets the standard once, from leadership, so it does not have to be decided again every time the situation comes up. Approved, communicated and reviewed, it is the basis for consistent decisions, and for proving those decisions later.
This post is part of our guide to policy governance, which covers who writes, approves, owns and reviews each policy as a company grows.
This guide is for the person in a business of 10 to 500 people who has been handed the policies on top of a real job. It covers what a policy is, how standards and laws define one, how it differs from a procedure or a law, the main types, what a good policy contains with a worked example, and how a policy works once it is written.
What is a policy?
The word has three common meanings, and search results mix them freely. This guide is about the first.
| Meaning | What it is | Example |
|---|---|---|
| Organizational policy | A rule a company or other organization has decided on and expects its people to follow | A remote work policy, a code of conduct |
| Public policy | A government’s chosen course of action on an issue, carried out through laws, regulations and spending | A national minimum wage, a clean air program |
| Insurance policy | A contract between an insurer and a policyholder | A general liability policy |
An organizational policy has five features. It is a decision, made once by people with the authority to make it. It is mandatory for the people it covers, which is what separates it from advice. It applies to a defined group, such as all employees, managers or anyone who handles customer data. It has an owner who keeps it current. And it is written and communicated, so that people can find it, read it and be held to it.
That last feature is where most small businesses fall short. A rule that lives in one person’s head, or in an email from two years ago, works until someone new joins, someone leaves, or someone asks you to prove it.
How standards, laws and other bodies define a policy
Dictionaries, standards bodies and regulators each describe a policy a little differently, but they agree on more than they disagree. Here is how eight of them put it.
| Source | How it defines or uses “policy” | What it tells a business |
|---|---|---|
| Merriam-Webster | A definite course or method of action, chosen from alternatives, to guide present and future decisions | A policy is a decision made once so it does not have to be made again each time |
| ISO 9000:2015, 3.5.8 | The intentions and direction of an organization, as formally expressed by its top management | A policy carries the authority of leadership, and someone senior has to stand behind it |
| NIST glossary | Basic principles and guidelines formulated and enforced by the governing body of an organization, and statements of objectives, rules or practices governing the activities of people | A policy is both a principle and a rule that applies to people’s conduct |
| COSO Internal Control framework, Principle 12 | Policies establish what is expected, and procedures put those policies into action | The policy says what; the procedure says how |
| HIPAA Security Rule, 45 CFR 164.316 | Covered entities must implement reasonable and appropriate policies and procedures, keep them in writing, and review them | Some laws require a written policy, not just a practice |
| SEC Rule 206(4)-7 | Investment advisers must adopt written policies and procedures reasonably designed to prevent violations, and review them every year | “Reasonably designed” means the policy has to fit the actual business |
| OSHA, 29 CFR 1910.1200(e) | Employers must develop, implement and maintain a written hazard communication program at each workplace | Regulators often ask for a written program, which is a policy by another name |
| US Sentencing Guidelines, §8B2.1(b)(1) | An effective compliance program starts with standards and procedures to prevent and detect misconduct | Written policies are the first thing a prosecutor or regulator looks for |
Sources: Merriam-Webster, policy, ISO 9000:2015, clause 3.5.8, NIST CSRC Glossary, policy, COSO Internal Control Integrated Framework (2013), 45 CFR 164.316(a), 17 CFR 275.206(4)-7, 29 CFR 1910.1200(e), USSG §8B2.1(b)(1)
Read together, they point to the same four things. A policy comes from leadership, it is written down, it is communicated to the people it covers, and it is reviewed and enforced. The laws add one more: when a rule requires a policy, it usually requires it in writing, and it expects you to be able to show that it was followed. In the ISO 9001 audits I have been through, the auditor rarely stopped at whether a policy existed; the next questions were who approved it and who had read it.
Policy vs procedure vs guideline vs law
These four words get used loosely, and mixing them up causes real problems. Steps written into a policy go out of date fast, and a rule labeled as a guideline is hard to enforce.
| Policy | Procedure | Guideline | Law or regulation | |
|---|---|---|---|---|
| Answers | What must happen, and why | How to do it, step by step | What is recommended | What the government requires |
| Set by | The organization’s leadership | The team that does the work | A team or function | A legislature or agency |
| Is it mandatory? | Yes, inside the organization | Yes, for the people doing the task | No, judgment is allowed | Yes, for everyone it covers |
| Changes | Rarely | Whenever the task or tool changes | As practice improves | Through a formal process |
The test is simple. If leadership would need to agree to change it, it is a policy. If it explains how to do a task, it is a procedure. If someone could ignore it without consequence, it is a guideline. Our guide to policy vs procedure vs SOP takes one subject through all the layers.
Why a small business needs policies
Consistency. A written rule means two managers give the same answer, and the company treats people the same way in the same situation. That matters most in decisions about discipline, pay and time off.
Legal requirements. Many rules ask for written policies by name. When we catalogued the federal requirements that apply to US businesses, 39 of the 70 obligations called for a written policy, and more switch on as a company passes 15, 20, 50 and 100 employees. Our small business compliance guide lists them.
Protection in a dispute. When an employee, customer or regulator challenges a decision, the policy is the evidence of what you required. A clear policy applied consistently is a strong position; a vague one, or one applied differently to different people, is a weak one.
Customers and audits. Larger customers send security questionnaires, and certifications such as ISO 9001 or SOC 2 expect policies with owners, approvals and review dates. Without them, deals and audits stall.
Growth. Policies let the founder stop answering every question personally. They write down decisions so the business can run the same way without them in the room.
Types of policies
Business policies fall into seven broad groups. A small company will not need every policy in every group, but most need something in each.
| Category | Common policies | Why a small business needs them |
|---|---|---|
| Employment and HR | Equal opportunity, anti-harassment, leave and time off, remote work, attendance, discipline | Several federal employment laws apply once you reach 15, 20 or 50 employees, and these are the policies most often tested in disputes |
| Conduct and ethics | Code of conduct, conflict of interest, gifts, whistleblowing | They set the standard everyone is held to and give you a basis for consistent decisions |
| Information security and IT | Acceptable use, access control, passwords, incident response, data retention | Customers ask for them in security questionnaires, and frameworks such as SOC 2 and ISO 27001 expect them |
| Privacy and data protection | Privacy policy, data handling, records retention | They govern how customer and employee data is collected, kept and deleted |
| Health and safety | Workplace safety, hazard communication, emergency plans | OSHA requires written programs for many workplaces, especially in manufacturing and field work |
| Finance and operations | Expenses, purchasing, approvals and signing authority, travel | They stop money leaving the business without the right approval |
| Customer-facing | Refunds and returns, complaints, accessibility, terms of service | They set what customers can expect, and some are published on your website |
Some policies are required by law, some are expected by customers or certifications, and some are simply good practice. When you decide what to write first, start with what is required for your size and industry, then what your customers ask for.
What a good policy contains
A policy does not need to be long. Most good ones fit on one to three pages, and they share the same ten parts.
The parts most often missing are the owner, the review date and the acknowledgment statement. They are also the parts that matter most when someone asks you to prove the policy worked.
A policy example
Here is a short remote work policy for ShiftTilt Inc, our made-up example company, laid out with those parts. It is an illustration, so set the limits and rules that fit your own business.
| Policy | Remote Work Policy, version 1.3, effective 1 March 2026, owner: Head of Operations, approved by: CEO, next review: March 2027 |
| Purpose | To set out when employees may work away from the office and what is expected of them when they do. |
| Scope | All full-time and part-time employees of ShiftTilt Inc. It does not cover contractors, who follow the terms of their contract. |
| Policy statement | Employees may work remotely up to three days a week with their manager’s agreement. Remote work must take place in the United States, on a company laptop, connected through the company VPN. Customer data may not be printed or stored on personal devices. |
| Responsibilities | Employees keep their equipment secure and stay reachable during working hours. Managers agree remote schedules and review them each quarter. The Head of Operations keeps this policy current. |
| Exceptions | Requests to work remotely more often, or from outside the United States, are approved in writing by the Head of Operations. |
| Consequences | Breaking this policy may lead to remote work being withdrawn and to disciplinary action under the Discipline Policy. |
| Related documents | Remote Access Procedure, Acceptable Use Policy, Information Security Policy. |
| Acknowledgment | “I have read the Remote Work Policy, version 1.3, and will follow it.” |
Notice what it leaves out. It does not explain how to set up the VPN, which belongs in a procedure, and it does not repeat the security rules, which it points to instead. That keeps the policy short and stable, so it only changes when the rule itself changes.
How a policy works once it is written
Writing the policy is the first of six stages. Each one leaves a record, and those records are what turn a document into something you can rely on.
The stage that most often breaks is communication. Sending the policy by email proves it was sent, not that it was read, which is why many companies ask each person to acknowledge the policy by name and version, and ask again when it changes. The other is review. A policy with no review date drifts, and the ones nobody has opened in three years are the ones that no longer match the law or the business. Every policy needs a named policy owner for exactly this reason.
How many policies does a small business need?
Fewer than most templates suggest. A company of 10 to 50 people can start with a core set and add policies as the law, customers and risks require. A sensible starting set looks like this.
- Code of conduct, including conflicts of interest.
- Equal opportunity and anti-harassment, with a way to report concerns that does not go through your manager.
- Leave, time off and attendance, so people know the rules before they need them.
- Acceptable use and information security, covering devices, passwords and customer data.
- Privacy and data handling, for customer and employee information.
- Expenses and approvals, including who can spend or sign what.
- Health and safety, scaled to the real risks of your workplace.
- Remote or hybrid work, if anyone works away from the office.
From there, add policies when a trigger arrives: crossing an employee threshold, a customer’s security review, a certification, or an incident that showed a gap. Our guide to the employee handbook for small businesses shows how the HR policies fit together in one document.
Common mistakes with policies
Copying a template without changing it. A policy that describes rules you do not follow is worse than none, because it is evidence that you did not follow your own policy.
Putting the steps in the policy. Every change to a step then reopens a document leadership approved and everyone acknowledged. Move the steps into a procedure and link to it.
No owner, no review date. Without both, a policy stops being maintained the day it is published.
Too many copies. The handbook PDF, the version on the drive and the one pasted into an email drift apart. At the last company I started we ended up with five different NDA versions, depending on when each person joined, and nobody had planned it.
No proof it was read. If you cannot show who received which version, you cannot hold anyone to it, and you cannot show an auditor that it reached them.
How AllyMatter helps you manage policies
We built AllyMatter so that a small team can run the whole life of a policy in one place. Every policy goes through an approval flow before anyone sees it, and each approved change becomes a new version with the history kept. When it is ready, you choose how it goes out: notify people, or ask them to acknowledge or e-sign it. Reminders follow on the cadence you set, review dates remind each owner when a policy is due, and the record of approvals, versions and acknowledgments exports as a PDF or CSV when someone asks.
Not ready for software yet? Start with our free Policy Acknowledgment and Signature Tracker for Google Sheets or Excel.
Questions about policies
What is a policy in simple terms?
A policy is a rule an organization has decided on, written down so everyone knows what is expected. It says what people must or must not do, who it applies to, and why. A good one is short enough to read in a few minutes.
What is the difference between a policy and a procedure?
A policy states the rule and the reason for it. A procedure explains how to carry it out, step by step. A policy might say that a leaver loses system access on their last day; the procedure explains how IT removes it. Our guide to policy vs procedure vs SOP has more examples.
What is the difference between a policy and a law?
A law is made by a legislature or agency and applies to everyone it covers, with penalties set by the state. A policy is made by an organization and applies to its own people. Many policies exist because a law requires them, and a policy can never permit what the law forbids.
Are company policies legally binding?
A policy is usually not a contract, and handbooks often say so. It is still enforceable inside the company, as a basis for discipline, and it is evidence in a dispute of what the company required and whether it applied its rules consistently. If you want a policy to be contractual, or to be clear that it is not, take legal advice on the wording.
What are the main types of policies?
In a business, the main groups are employment and HR, conduct and ethics, information security and IT, privacy and data protection, health and safety, finance and operations, and customer-facing policies such as refunds and complaints.
Who should approve a policy?
Someone with the authority to enforce it, usually a senior leader or, for a few policies, the board. Many companies add a review by HR, legal or the affected department before final approval. Our guide to a policy on policies sets out who approves what.
How often should policies be reviewed?
Most organizations review each policy at least once a year, and straight away when a law, a risk or the business changes. Some rules set their own cycle, such as the annual review the SEC requires of investment advisers. Our guide to how often policies should be reviewed covers cycles, triggers and what to record.
Do policies have to be in writing?
Not always, but an unwritten policy is hard to enforce and impossible to prove. Several laws, including the HIPAA Security Rule and OSHA’s hazard communication standard, require written policies or programs, and customers and auditors almost always ask to see them.
What is a policy statement?
It is the core of a policy: the sentence or short section that states the rule itself. Everything else in the document, such as the purpose, scope and responsibilities, exists to explain and support that statement.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.