Policy hierarchy
Policies, standards and procedures arranged in clear levels, each with an owner and an approver.
Service offering
Policy operating model
Policies people can find, follow and trust to be current, with exceptions that expire.
We set up how policies and standards are written, approved, published and reviewed: a policy hierarchy, owners, review cycles, version control and an exception workflow with risk acceptance. Staff can find the current version of any policy, and auditors can see its history.
Policies are published in Arabic and English where staff or regulators need both, with one controlling version so the two languages never drift apart.
What the engagement covers
Lifecycle and versions
Review cycles, approval steps and version history kept in one place.
Exception workflow
Requests to depart from a policy assessed, approved or refused, and tracked until they expire.
Proportionate controls
Controls sized to the risk, so effort goes where exposure is highest.
Owned by the business
Each control and policy has a named owner outside the GRC team.
When the policy model needs fixing
It needs fixing when staff cannot find the current policy and exceptions outlive their reasons.
- Several versions of the same policy circulate.
- Policies have not been reviewed for years.
- Exceptions have no expiry date or owner.
Talk to us about policy operating model
Tell us what you need to achieve and by when. We will propose a scope, a team and an itemised quotation.