Writing policies and procedures that are accurate, brief, and user-friendly is perhaps one of the most daunting challenges in compliance. In this article, we set out simple guidelines to make the task approachable and attainable.

Some policies and procedures are created because a law or its implementing regulation mandates that institutions have written policies and procedures in place (the mortgage servicing rules under RESPA, for example). Others are created because regulators expect well-managed institutions to have them, even where there is no specific mandate. And others are crafted to fit specific institutions’ needs, usually in response to an examiner’s criticism.

Capco has experience with all these scenarios, and we want to share our knowledge with you to help make writing strong policies and procedures as easy as 1, 2, 3.

Writing Strong Policies

You’ve heard it said before: policies are what we do, and procedures are how we do it. The goal of a policy is to provide guidance regarding principles and behaviors without going into specifics. The procedures provide specifics. In cases where a program is compelled by law or regulation, the policy statement often has much greater detail.

Generally, each policy should contain:

1. That the institution follows the law
2. That the board has appointed someone to report on and enforce the policy
3. Any training requirements
4. Any audit or review elements and the timing of these aspects

Writing Strong Procedures

Procedures, of necessity, are more granular and complex. Procedures are the basic building blocks of a compliance management system. Of course, procedures do not stand alone, as a bank also needs policies, training, monitoring, audit, etc. But while these other components guide the way people make decisions, procedures state the "how-to" for completing a task or process.

Generally, each procedure should consider:

1. What to do
2. When to do it
3. How to do it correctly
4. Who is supposed to do it (usually assigned by job title)

There are generally two instances that require written procedures: when compliance requires it and for most routine tasks. Best practice is to speak with your employees about challenges. They might alert you to tasks that need procedures (like transferring funds) or where existing procedures are weak and need clarification (like filling out a form). Audit and monitoring results may also uncover where procedures are needed or weak.

Procedures are oriented toward actions. They outline steps to take, and the order in which they need to be taken. Well-written procedures are typically precise, instructional, and to the point.

Many procedures have clear steps: "Complete A, then B, then C." But this can lead to volumes of instruction, and sometimes fewer words are better. For example, most people do not need to completely read their new car’s manual before starting to drive it, but do need clear, simple instructions on how to change the clock when we spring forward.

Design elements or graphics (e.g., a picture, diagram, flowchart, or screenshot) can sometimes be more straightforward and timesaving than writing out lengthy procedures. Inserting hyperlinks to further resources or to explain particulars may also be useful, so readers can choose their level of granularity. Procedures should link to related policies, and in some cases, it may be prudent to add frequently asked questions.

Best Practices

• Do your research. Good writing starts with doing your research and gathering all the information available to you. For policies, this may mean understanding relevant laws and for procedures, it may mean interviewing staff to understand a task.

   

• Don’t reinvent the wheel. Unless the requirement is brand new, somebody is already doing it. And if what that person is doing is working and compliant, then there’s no need to duplicate efforts. Sometimes it’s just about formalizing what is already happening.

   

• Know your audience. Make sure you don’t include unfamiliar terms. For example, there are terms underwriting may use but loan operations may not know. Don’t assume the reader has experience and make procedures clear enough for any new hire to understand.

   

• Keep it active. All writing should be clear and written in active voice.

   

• Double-check it fits. After writing, your documents should be reviewed, validated, and approved. This also helps to ensure that management teams support and endorse the efforts.

• Support your documents with training. Don’t expect users to simply read and retain new information. If you obtained buy-in during the information gathering phase, these new tools should be welcome. Effective training will include the “why,” as knowing the reason for the policies and procedures helps with comprehension, retention, and implementation.

Let Us Do It for You

If you still don’t want to tackle the task, Capco Regulatory Advisory Services Premium Members have access to our Sample Policy Manual, which contains over 100 sample policies in Microsoft Word format. Premium members can utilize entire policies or modify portions to meet the needs of their institution. Also, Premium Members can submit their own policies for a Capco Subject Matter Expert review.