PR1.1 DEVELOP CONTROLS, POLICIES & PROCEDURES
Develop a mix of preventative detective and corrective controls, policies and procedures to address risks and other program objectives, indicating specific accountability and criteria for successful operation of the controls.
Management should develop policies and procedures to address risks and opportunities. Policies articulate what is expected by the organization and procedures define how to follow or adhere to the policy. When designing a policy/procedure, the drafters should consider the following elements to ensure that the policy/procedure is developed in a manner that increases participation, buy-in and compliance:
> the objective of the policy/procedure
> the target audience
> target audience level of knowledge/skill
> affected elements of the business model
> the stakeholders who should/must be involved in developing the policy/procedure
> consistency of design with, and relationship to, other policies/procedures
> need for legal overview and sign-off of policy/procedure to ensure compliance with law/regulation and avoid legal risks
Management should develop policies/procedures using a consistent methodology to ensure that they are accurate, clear, and understandable. When policies/procedures are developed in an ad hoc manner, there are often gaps in coverage, conflicts between policies, and inconsistencies in approach.