An organisational policy is a set of rules and guidelines that tells everyone in an organisation how they are expected to work. It is written once for the whole organisation, not decided separately by each employee, so everyone follows the same agreed way of doing things.
A bakery with one shop in Leeds and another in Bristol still works to one set of rules. A policy makes sure staff in either place follow the same standards, so customers get the same service and nobody invents their own way of doing the job. Without one, each shop would drift into its own habits and quality would depend on who happened to be on shift that day.
Policies set out staff responsibilities: who is answerable for what, how employees are expected to behave and what is not acceptable, so nobody can say they did not know. For example, a social media policy at a chain of indoor climbing centres might state that staff must never post photographs of customers online.
Policies also state the procedures to follow. A procedure is the step-by-step way to carry out a task or deal with a situation. The policy says what must happen and who is responsible; the procedure breaks that down into the actions a member of staff actually takes.
| Policy | Procedure |
|---|---|
| What must be done, and who is responsible | The step-by-step way to do it |
| Customers' contact details must only be stored in the customer database | 1. Open the customer database. 2. Type the details into the correct fields. 3. Delete any copy saved in a spreadsheet |
A policy also covers what to do if something goes wrong or a disaster occurs, such as a fire, a flood or a hacker wiping the main server. It states who takes charge and which procedure to follow, so people act instead of panicking.
Policies are not optional advice. Every member of staff works in line with them, whatever their role, including supervisors and senior managers. That gives consistency, clear expectations and a planned response when things go wrong.
An IT manager is the person who usually writes an organisation's IT policies: the rules that tell staff how to use systems safely and consistently. They are well placed to do this because they understand how the organisation's systems work and what can go wrong. They turn legal requirements into clear rules staff can follow, for example keeping personal data secure, and they do the same for business needs, such as letting staff work from home.
Writing a policy is not a one-off job. IT managers review policies regularly to check they are still suitable, and they recommend how policies should be updated. A review may be triggered by a security incident, a change in the law, new software or a new way of working. For example, at a chain of pet supply shops, the IT manager reviews the remote access policy after branch managers begin checking stock levels from home. The manager recommends adding a rule that company laptops must connect through the organisation's secure service before stock records can be opened. This closes a gap before it causes a problem.
Ownership means the IT manager is accountable for making a policy change actually happen, not just suggesting it. They might plan the change, arrange training, explain to staff what is different and check that the new rules are being followed. They do not have to carry out every task themselves. IT and technical staff may update settings or reset accounts, while the IT manager sets the direction and makes sure the work is completed.
When an organisation defines responsibilities, responsibility for each policy is given to a designated employee rather than left to be shared vaguely by everyone. That person's name is attached to the policy, so anyone who needs guidance or a decision knows exactly who to approach.
The designated person does not have to carry out every task themselves. Their role is to be the point of accountability: the one who makes sure the policy is fit for purpose, kept up to date and genuinely followed. A single employee might be given a whole set of related policies to manage — for example, one member of staff could be named as responsible for every policy covering how customer information is stored and shared.
Most policies are carried out day to day by IT and technical staff. A technician might set up access rights so only the right people can open a folder, run the overnight backups, or check that colleagues are following the password rules. The designated person makes sure this is happening and steps in when it is not.
Naming someone makes them answerable. If a policy has gone out of date or is being ignored, there is a person who can be asked about it and who must put it right. It also stops responsibility being spread so thinly that nobody takes action. Some named roles carry a legal duty too: whoever is responsible for data protection must make sure the organisation keeps to the law on handling personal information.
If you have a concern about a policy, or about the way it is being carried out, you should contact the named person responsible for that policy. Your concern should be raised internally with a member of staff inside the organisation, rather than sent to the police, an outside regulator or management in general.
The named person is the employee given responsibility for that policy area. They know what the policy says, why it exists and what should happen when it is not followed, which makes them the right person to contact.
Raising the concern with the responsible employee means the issue can be looked into and dealt with by someone who has the authority to act. For example, at a bike repair company, a technician notices that customer repair forms containing phone numbers are left on a desk in an open area. The data protection policy says these forms should be locked away. The technician tells the named person responsible for the data protection policy. That person can investigate the issue, remind staff of the correct way to store forms or recommend a change to the policy.
When responsibilities are defined, staff know the correct route and the person to approach. They do not have to guess or report to a general manager who may not know the policy. If responsibilities were not defined, staff would not know who to report concerns to, and policies would be applied inconsistently in different teams.