
My Favourite Standard: ISO 3103
My Favourite Standard: ISO 3103 The standard that governs the process of making a cup of tea When I write about ISO, more often than
Policy management is a huge part of not only audits and compliance, but of keeping your people aligned with your organisation.
Writing effective policies, procedures and guidelines allows you to provide guide rails for your organisation, and support your employees and teams in getting what they need to get done, done.
However, managing and maintaining your policies can be a huge challenge for organisations of any size, regardless of what standards you are adhering to.
Ensuring that your documentation is accurate and up to date, that policy owners and collaborators are aware of necessary changes, and that your end users know where to find the information they need all feed in to your compliance culture – and are difficult factors to address.
The following steps are what we found helped us in building a compliance culture, and ensuring that our policies are referenced and maintained as a part of our BAU (not just once a year).
One of the first changes we made in the run up to our audit was to re-organise our policies completely.
Previously, every policy was organised in a way which solely made it easier to get through audits. This was all well and good once a year, when we had to go through our internal and external audits, however, it made it far more difficult for our people to actually find the information they needed (a problem which was exacerbated for new starters).
In order to resolve this, we decided to group all our policies under topics or purposes, instead of by the specific annex control that they related to. This resulted in us having manuals called ‘Managing security’ instead of ‘Information Security Roles & Responsibilities’ – making finding documentation easier and removing friction in our onboarding processes.
Another thing which was critical in our compliance strategy, was that we wanted people to actually read and reference our policies.
A key way that we have achieved this was by embedding all key documentation and not just our policies. This included migrating Brand manuals & product documentation all the way to our to-do lists and meeting minutes.
The result of this is that it became far easier for us to bring our people back to the system every day because they rely on it for their day-to-day tasks. This reduces the cognitive load users experience when they have to update policies as they no longer have to open and log into a separate system.
Their daily activities keep them close to the compliance documentation, and features such as an activity channel mean they see key updates as soon as they happen – without compliance managers having to chase them.
User Experience is something which is commonly overlooked when sourcing a new policy management solution – by both customers and suppliers.
Often feature-driven solutions can seem better on paper, but in reality they can overload users with complicated screens which drive them away from the product – and lead to a situation where people rush to update their policies once a year when audit season comes round, but actively move towards other documentation tools as soon as they can.
By utilising a solution which prioritises the end user’s experience with the tool (not just the compliance managers) you are able to ensure that users are not being driven away from your documentation and are fully supported in the tasks they need to complete in their daily activities.
Policy management can be a highly time consuming stream of work, and can create a lot of strain on businesses throughout the year as they adapt to changes in the market.
One of the biggest obstacles in embedding compliance in an organisation is the time that it takes out of people’s day to day lives – implementing a tool which helps to reduce manual processes and shorten the amount of time required by your policy management makes it easier for your people to engage with your policies and compliance documentation.
If you can allow people to automate processes and streamline the work they have to complete, compliance and policy management will become much less of a chore – and therefore far easier for them to engage with.
Throughout the year, and especially in the run up to an audit, your policy owners and subject matter experts will have to work closely with each other in order to complete key documents and ensure that you remain compliant.
One of the best ways to engage these people, and make the process of maintaining and updating documents easier is by making sure that they are easily able to collaborate on these key documents and work with their peers in order to better understand important topics.
Allowing your users to @mention each other in comments, invite specific people to documents and quickly and easily control access and visibility are just some of the ways that you can create a collaborative culture
These points are just some of the ways which have enabled us to embed compliance and policy management in our organisation from the ground-up. However, it is obviously a complicated and highly-important business function so if you would like to learn more about building a compliance culture, or if you are interested in enhancing your existing strategy – please get it contact with us below.
My Favourite Standard: ISO 3103 The standard that governs the process of making a cup of tea When I write about ISO, more often than
ISO 27001 Controls: Handling Security Breaches How to deal with them when to do when they do happen The purpose of ISO 27001 is to
Introducing Answers Simplify Documentation Management with Inverifi At Inverifi, we understand that managing documentation for compliance can be time-consuming and laborious. That’s why we have
©Copyright Inverifi 2023, All rights reserved. Registered in England, No: 06959535, , +44 20 4574 9908