Recently I was asked what I considered to be the difference between rules and policy.  I gave my stock answer – rules cannot be changed, policy can. There was a group of people listening and they almost unanimously said – “what, of course you can change a “Business rule”.

I went on to defend my position by stating – you can repeal a rule and issue a new one. The original rule has not changed; rather it is no longer in force. A new rule has been issued and it is separate from the previous rule. Conceivably the original rule can still be reissued and both rules will be in force at the same time.

Policies by contrast can be changed and the ‘edges’ of policy are not as defined as a rule.

Policy and rules are similar in that they both set out to guide behaviour. They differ to the extent that they allow the individual to make the final decision as to how they will behave.

The key attribute of a rule is that is must be precise. You are either complying with it or not.  Consider the rule – you must stop at a red traffic light. There is nothing ambiguous about this rule. You either stopped or you didn’t. You are not allowed to interpret the rule. When the fire alarm sounds above your desk, you do not get to decide whether you leave or not; you get up and go. (I admit that when it comes to fire drills, I frequently break this rule).

Policy is often written up in an equally prescriptive manner. Most companies have a policy on bribes along the lines of; no employee will accept or offer a bribe. This statement is as prescriptive as a rule. In fact I would call it a rule that is frequently called policy.

Policy sets the parameters that define how you will behave in a given situation.  An example; staff are permitted to dress in business casual on Fridays. This policy does not explicitly define what business casual is leaving it up to the individual to decide what is appropriate.  A further example is – sales managers may spend $XX a month on business expenses. The policy does not define how the allowance should be spent, or on what.

In both examples, it is assumed that the individual will – do the right thing- and will behave in accordance with the values and objectives of the company. With rules, this freedom is removed and the individuals’ behaviour is prescribed.

This distinction is important when establishing organisational procedures. A procedure tells you how to do something. Typically a policy covers the entire procedure and provides the parameters of permissible decisions on what’s appropriate behaviour when executing the procedure.  Rules generally apply to specific tasks within the procedure and cannot be interpreted.

Despite the implication of the oft used phrase – policies and procedures – both policy and rules exist separately from procedures and have a one to many relationship with procedures. This means that individual policies and rules can be associated with multiple procedures and procedural steps respectively.

Establishing rules is reasonably straightforward as the language of rules is ‘native’ to managers. We are all comfortable expressing constraints on behaviour in terms of single statements. “You will….”, “You must…”, “You cannot….”. Even when we intend to establish policy statements we typically express them as a rule.

There is no easy methodology for establishing policy.  As a guideline, the role of policy is to:

• translate values into operations
• reinforce compliance with legal and statutory responsibilities
• set standards, and
• improve the management of risk.

A good place to start is with rules. Write down the rules that will apply to the area you wish to establish policy for. Then bundle similar rules into groups. These rules become the parameters of the policy statement. Read each rule in a group and write a business statement that covers all the rules in that group. This is your policy statement. Given that the statement is trying to cover all the rules in the group, it will by necessity, be appropriately vague.

Another method is to take a specific problem area in the business that you wish to manage with improved policy and establish a table that aligns policy with procedures and rules. Having these three items in one table quickly surfaces issues where policy is written as a rule and rules as policy.

By way of example.

The business issue is to reduce the risk of poor decision making on tender submissions.

The first policy statement uses the word ‘accurate’. This is a relative term. The rules define how accuracy should be interpreted.

The second policy statement uses the word ‘complete’. This is also a relative term. The rules define how completeness should be interpreted.

Completing the table should deliver relevant and useful policy statements.

In closing I will say; the real difficulty is managing the policies and rules once they are published. The last column in the table is ‘consequence’ … when it comes to rules and policy, if you are not prepared to manage them, do not bother establishing them.