Communicating and sharing policies and procedures is a critical part of any compliance program. Regulators like the CFPB, FDIC and NCUA view policies and procedures as a key way in which the executive leadership and the Board of Directors lead the organization. In fact, most years, the FDIC identifies more “Matters Requiring Board Attention” relating to policies than to something more specific, such as anti-money laundering.
Given the importance of policies, it is surprising that many organizations still only do the minimum to communicate them, relying primarily on acknowledgments and/ or sign-offs. Other organizations struggle with a decentralized system of different departments sporadically publishing different policies to their intranet pages and separate SharePoint locations.
Creating a centralized policy repository can significantly improve your organization’s ability to communicate and share policies effectively. Below is a checklist of key benefits that an effective policy repository will bring to your institution’s policy and procedure communications.
1. Single Source of Truth
The main benefits of a centralized policy repository is the confidence that your staff knows where to find the current version of the specific policy or procedure they need for their day-to-day activities. No more wondering if the latest version is in an employee’s email or on a department’s intranet page that may have been updated recently, or if employees are looking at an old SharePoint location.
2. Flexible Version Control
Policies and procedures need to change with regulatory and market changes. A centralized repository system should help you manage those changes by providing a flexible method of version control. For example, employees should always know that they are accessing the current version, but administrators should also have the ability to share – or hide – previous or upcoming versions of policies.
3. Easy to Update
Regulations and the market change too frequently to assume policies and procedures will rarely be updated. Having a centralized policy repository allows your employees to have confidence that what they are viewing is the single source of truth. Updates, changes and adjustments are all addressed in real time.
4. Communicate Clearly and Consistently
A centralized policy repository should be intuitive to the user, ideally with both a logical taxonomy structure and a search function. Naming conventions are important. If users are looking for a cybersecurity policy, will they find the “Information Security Policy?” Good policy repositories have synonym functionality to address this.
5. Permissions
Not everyone in the organization should have access to every policy. A centralized policy repository will allow the administrator to manage permissions for individuals or groups. This functionality allows administrators to determine who can see which policies.
6. Easy Sharing
A good policy repository should allow administrators and managers to share policies and procedures with specific employees as needed. This should not require anyone to download the policy from the repository in order to view it, as this often leads to version control problems.
7. Integration with Other Content
In regulated industries, policies and procedures are integral to how employees do their jobs. An ideal policy repository will allow current policies to be viewed in context with other compliance training, job aids and professional development. This is the benefit most directly tied to creating a “culture of compliance.”
8. Track Views
To meet regulatory compliance needs, organizations in the financial services industry need to be able to report on policy and procedures access. It is also important for a policy repository to be used frequently to be effective, so being able to measure engagement can prove very helpful in driving adoption.
For more information on how a centralized policy repository can benefit your compliance management program, and how BAI can help, click here.
