Policies being ignored? Why it happens, why it matters.
“We have a policy for that.”
It is a reassuring thing to say in a board meeting or to a client during due diligence. But having a policy and having people follow it are two different things.
Why policies get ignored
Everyone understands that some rules are necessary. They also have a job to do, a deadline to meet and a client waiting for an answer. If a process feels slow, confusing or disconnected from the work in front of them, they may decide that their way is better. Or less hassle.
Sending a password in the same email as the document may directly contravene your information security policy, but it’s faster than using the approved process. Making a quick fix to a live system without following change management procedures because the client needs that answer now.
What people may not see is the experience, obligations and hard lessons behind the process they are bypassing.
The knowledge behind the rule
A good policy is more than a list of instructions. It captures what a business has learned: good practice developed over time, lessons learnt from things that went wrong, commitments made to clients and requirements that the business must meet.
Someone joining the company today cannot be expected to know every incident or decision that shaped the way it works. A clear policy makes that collective knowledge available to them, even if the embarrassing incident that resulted in that paragraph in a policy is not.
To the uninitiated, an extra process may seem unnecessary. To a colleague who has dealt with the fallout from an incident, its purpose is much clearer. You should not have to experience that incident yourself to benefit from what the business learned.
Policies can also give people confidence. When a situation is unfamiliar, knowing what to do, who can make a decision and when to ask for help is useful. Good processes make that knowledge easier to find when it matters.
Why the board cares
For a board or executive team, policies help the business operate consistently. They set expectations that do not depend entirely on who happens to be doing the work that day.
They also help demonstrate that the business is being run with care. A policy alone is limited evidence; the stronger evidence is that people understand it, use it and review it when circumstances change.
Clients may want that reassurance too. They need to trust their supplier to handle their information and deliver their services responsibly. Clear ways of working can support that trust, especially when responsibilities or standards are written into a contract.
That is why policies matter to the business. But it doesn't explain why someone should follow one when they're under pressure to get the job done.
Make the purpose visible
If people see only the instruction, they will judge it by the effort it adds. If they understand the reason, they can make a better decision.
A policy should answer a few simple questions:
What are we trying to protect or achieve?
What do I need to do?
When does this apply?
Who can help me if the usual process does not fit?
The answers need to be easy to find and written in language people use at work. A document that is technically complete but difficult to understand will struggle to shape day-to-day decisions.
“If people are not following a policy, get curious before you get cross.”
Training helps, but a single session when someone joins the company is rarely enough. Managers need to use the processes themselves, explain them in context and make it comfortable for people to ask questions. The policies need to become part of the fabric of the company. If leaders routinely take shortcuts, others will notice.
Listen to the workarounds
When a policy is regularly ignored, it is tempting to conclude that people need reminding. Sometimes they do. But a repeated workaround is also useful feedback.
Perhaps the process takes too long. Perhaps it assumes a system the team no longer uses. Perhaps nobody knows who can approve an exception. Or perhaps a rule created for a serious risk has been applied to routine work where it adds little value.
Ask people what they are trying to achieve and where the process gets in their way. Keep the controls that matter, simplify the steps that do not, and make a clear route for situations the policy did not anticipate. Involving the people who do the work makes the result more practical and gives them a reason to trust it.
Making policies work in practice
Good policies help people to make good decisions with the benefit of the organisation’s shared experience.
If people are not following a policy, get curious before you get cross. Do they know it exists? Do they understand why it matters? Can they follow it while doing their job? And does it still reflect how the business works?
A useful policy protects the business, reassures its clients and helps its people. When those people can see that value in practice, following it becomes a much easier choice.