A compliance policy is one of the most cited and least understood documents in a governance program. People confuse it with procedures, with the compliance framework, and with the code of conduct. Yet it has a precise role: a policy states the organization's position and commitment on a compliance topic, what it will and will not do, and why. Get the policy right and the procedures, controls, and culture beneath it have something to align to. Get it wrong and everything below inherits the confusion.
What You'll Learn
You will learn what a compliance policy is and what it is for, the components a sound policy contains, how it differs from procedures and from the compliance framework, how to approve and communicate it, the right review cadence, and how it relates to the code of conduct.
What a Compliance Policy Is
A compliance policy is a formal, approved statement of an organization's commitment, principles, and rules in relation to a specific area of legal or regulatory obligation. It expresses what the organization requires of itself and its people at the level of principle, and delegates the detailed "how" to procedures.
A privacy policy commits the organization to lawful, transparent handling of personal information. An anti-bribery policy commits it to zero tolerance of corrupt payments. A health-and-safety policy commits it to providing a safe workplace. In each case the policy sets direction and boundaries; it does not describe every step.
Crucially, a policy is a control in its own right. It is frequently the evidence that satisfies an obligation in your compliance register. A regulator asking "do you have a documented commitment to X?" is asking for the policy.
The Purpose of a Compliance Policy
1. It sets the organizational position
A policy removes ambiguity about where the organization stands. Employees, regulators, and partners can read it and know the rules, rather than guessing or relying on custom.
2. It assigns authority and accountability
A well-drafted policy names who owns it, who must comply, and who enforces it, anchoring compliance ownership at the principle level.
3. It evidences commitment to regulators
Many regulations require a documented policy as proof of intent and governance. The policy is the artifact that demonstrates the organization has consciously decided how to comply.
4. It anchors procedures and controls
Procedures, controls, and training all flow from policy. When the policy is clear, everything beneath it has a reference point; when it is vague, the whole stack wobbles.
Want the full framework with worked examples?
What a Compliance Policy Contains
Policies vary by topic, but a sound compliance policy contains a consistent set of components:
| Component | What It Covers |
|---|---|
| Purpose | Why the policy exists and what it aims to achieve |
| Scope | Who and what it applies to: entities, roles, activities |
| Policy statements | The actual commitments and rules, in principle terms |
| Roles and responsibilities | Who owns, complies with, and enforces the policy |
| Regulatory references | The laws, standards, or obligations the policy addresses |
| Compliance and consequences | What happens when the policy is breached |
| Related documents | Links to procedures, the code of conduct, and other policies |
| Version control | Owner, approval date, review date, version history |
Pro Tip
Keep policy statements at the level of principle and push operational detail into the linked procedure. A policy that lists exact form numbers and software versions has to be re-approved every time a tool changes, which is an enormous and avoidable governance burden.
Policy vs Procedure vs Framework
These three are routinely confused. They sit at different altitudes and serve different purposes.
| Document | Answers | Example |
|---|---|---|
| Compliance framework | How is the whole compliance program structured and governed? | Roles, governance bodies, risk approach, the policy hierarchy itself |
| Policy | What does the organization commit to, and why? | "We obtain valid consent before processing personal data." |
| Procedure | How, step by step, is the policy carried out? | "To record consent: open the CRM, capture timestamp and source, attach to the contact record." |
The three working together
Framework: The compliance framework establishes that the organization maintains topic-specific policies, each owned by an accountable executive and reviewed annually.
Policy: The Data Protection Policy commits the organization to processing personal information lawfully and to honouring data subject rights.
Procedure: The DSAR Procedure sets out the exact steps, timelines, and templates staff use to fulfil an access request.
The framework holds the policy; the policy directs the procedure; the procedure produces the evidence.
Approval and Communication
A policy carries authority only if it is properly approved and genuinely communicated. A document sitting unread on a shared drive is not a functioning control.
Approval
Policies should be approved at a level appropriate to their significance: senior management for most, the board for high-stakes areas such as anti-bribery or financial crime. The approval, approver, and date must be recorded, because the approval is itself part of the audit trail.
Communication
Approval is not the finish line. Staff must be made aware of the policy, understand what it requires of them, and ideally acknowledge it. Effective communication combines accessible publication, targeted training, and, for material policies, a tracked attestation that becomes compliance evidence in its own right.
Important
If you cannot demonstrate that affected staff were made aware of a policy, a regulator may treat the policy as ineffective regardless of how well it is written. Always retain evidence of communication and acknowledgement, not just the policy document itself.
Review Cadence
Policies are living documents. An out-of-date policy is a liability. It can commit the organization to obligations the law no longer imposes, or fail to reflect ones it now does. Set a defined cadence:
- Scheduled review: Most compliance policies should be reviewed at least annually, with high-risk policies (financial crime, data protection) reviewed more frequently.
- Event-driven review: Trigger an out-of-cycle review when a relevant law changes, after a significant incident, or following a restructure that changes scope or ownership.
- Versioning: Every review should update the review date and version record, even one that confirms no change, so the document's currency is demonstrable.
Tie review dates into your compliance calendar so they surface automatically, and feed the outcome of each review into your compliance status reporting.
Link to the Code of Conduct
The code of conduct is the umbrella document that states the organization's overarching ethical standards and expected behaviours. Individual compliance policies sit beneath it, translating broad ethical commitments into specific, enforceable rules for particular domains.
The code says "we act with integrity and obey the law." The anti-bribery policy says, specifically, "no employee may offer, give, or accept a bribe, and facilitation payments are prohibited." The code sets the tone; the policies operationalize it. A coherent program keeps the two aligned, with each policy explicitly referencing the code it supports.
Common Mistakes to Avoid
1. Confusing policy with procedure
Stuffing step-by-step instructions into a policy makes it brittle and forces needless re-approvals. Keep principle in the policy and detail in the procedure.
2. Approving but never communicating
An unread policy is an ineffective control. Communication and acknowledgement are part of the policy lifecycle, not an optional extra.
3. No defined review cadence
Policies that are written once and never revisited drift out of step with the law and the business. Set and enforce a review schedule.
4. Orphaned policies with no owner
A policy without a named owner gets neither maintained nor enforced. Every policy needs an accountable executive.
5. Disconnection from the obligation register
When policies are not linked to the obligations they satisfy, you lose the line of sight from "the law requires X" to "this policy commits us to X." Link policies to obligations in the register.
Summary
- A compliance policy is an approved statement of the organization's commitment and rules on a compliance topic, at the level of principle
- It contains purpose, scope, policy statements, roles, regulatory references, consequences, related documents, and version control
- Policy, procedure, and framework sit at different altitudes: principle, step-by-step, and program structure respectively
- A policy is only effective if properly approved, genuinely communicated, and acknowledged, with the evidence retained
- Policies need a defined review cadence and should sit beneath, and align to, the code of conduct
Frequently Asked Questions
What is the difference between a compliance policy and a procedure?
A policy states what the organization commits to and why, at the level of principle. A procedure describes how, step by step, that commitment is carried out. The policy is stable and high-level; the procedure is operational and changes more often as tools and processes evolve.
How is a compliance policy different from the compliance framework?
The framework describes how the entire compliance program is structured and governed: roles, governance bodies, the policy hierarchy, and the risk approach. A policy addresses a single topic within that structure. The framework is the architecture; policies are the rooms inside it.
Who should approve a compliance policy?
Approval authority should match the policy's significance. Most policies are approved by senior management, while high-stakes areas such as anti-bribery, financial crime, or data protection are often approved at board level. Whoever approves, the approver and date must be recorded as part of the audit trail.
How often should a compliance policy be reviewed?
At least annually for most policies, and more frequently for high-risk areas. Beyond the calendar, trigger an out-of-cycle review whenever a relevant law changes, after a significant incident, or following a restructure. Record the review date each time, even when no change is made.
How does a compliance policy relate to the code of conduct?
The code of conduct is the umbrella document setting overarching ethical standards. Individual compliance policies sit beneath it and translate those broad commitments into specific, enforceable rules for particular domains. The code sets the tone; the policies operationalize it, and each should reference the code it supports.
Is a compliance policy itself a form of evidence?
Yes. A documented, approved, and communicated policy is frequently the evidence that satisfies an obligation requiring a "documented commitment." Pair the policy with records of its approval and of staff acknowledgement to make it robust compliance evidence.
Save this guide for later
Download the PDF version to read offline or share with your team.
