Having a policy and doing the thing are different achievements
Organisations are assessed on whether a document exists and operate on whether people behave a certain way. Those two states can persist independently for years.
Every organisation of any age holds a body of policy: documents that state how something will be done, approved by somebody, held in a repository, and produced when requested. The body grows steadily, because each new obligation, each incident, and each audit finding produces another one, and almost nothing is ever withdrawn. A mature organisation can hold several hundred, of which the people doing the work have read perhaps six.
This is usually described as a compliance culture problem, which locates the fault with the people who have not read them. That framing is comfortable and it is mostly wrong. A person cannot hold three hundred documents in mind, and asking them to is not a reasonable instruction. What they hold instead is a working understanding of how things are done here, acquired from colleagues, from what was corrected last time, and from the handful of rules that are actually enforced. That understanding is the operating system, and the policy library is a parallel artefact that may or may not describe it.
Continue reading