Policy management
Also called policy lifecycle management, compliance policy management
Policy management is the process a firm uses to write, approve, publish, track and review its internal policies and procedures. It links each policy to the rules it implements, records who approved it and confirms that staff have read it. Regulators expect firms to show that written policies exist and are followed in practice.
How it works
A bank or insurer keeps a central library of policies, each with a named owner, a version history and a review date. Compliance maps every policy to the regulatory obligations it covers. When a rule changes, the owner updates the text, a committee approves it and staff in scope receive it for attestation. Exceptions and breaches are logged against the relevant policy.
Supervisors and prosecutors judge a compliance programme partly on its policies. The FCA requires adequate policies and procedures under SYSC. The US Department of Justice asks whether policies are accessible, tested and updated. Out-of-date or unread policies weaken a firm's defence after a failure and are a common finding in internal audit and skilled person reviews.
The rules
Firms must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance with regulatory obligations and to counter the risk of being used to further financial crime.
FCA-authorised firmsInvestment firms must keep adequate policies and procedures to detect compliance risk, with a compliance function that monitors and assesses them regularly.
MiFID II investment firmsProsecutors assess whether policies are well designed, accessible to staff, integrated into operations and updated using lessons learned and data.
Companies under DOJ criminal investigationCommon questions
What is the difference between a policy and a procedure?
A policy states what the firm commits to and why, such as its approach to conflicts of interest. A procedure sets out the steps staff follow to meet that policy. Regulators usually look at both, and expect procedures to match the policy they support.
How often should policies be reviewed?
Most firms review each policy at least once a year and again whenever a relevant rule, product or business process changes. The review date, the reviewer and any changes are recorded so the firm can show supervisors an audit trail.
What is policy attestation?
Attestation is a staff member's recorded confirmation that they have read and understood a policy. Firms use attestation records to show regulators that policies reached the people they apply to, and to follow up with anyone who has not completed it.
