Policy vs Process vs Procedure: What's the Difference?Paul Elson-Vining
One of the questions I have often been asked over the years is, what is the difference between a policy vs process vs procedure? As I have both created lots of business management documentation myself and seen a great deal of processes, policies and procedures being created by Triaster’s and Process Envision's customers, I know that deciding which information should be captured in which type of document can be a real minefield. So here is the answer...
Policy vs Process vs Procedure: What's the Difference?
I find it really helpful to think of these documents in a three layered pyramid:
What is a Policy?
At the top of the pyramid are the policies.
A policy sets out the strategic direction of the organisation as decided by senior management. A policy will lay out a destination, but won’t give any direction on how this is to be executed. For example a policy would contain a statement such as: ‘Time and attendance with be tracked for all staff and contractors in a clear and consistent way', but wouldn't give any indication as to how that should be done.
What is a Process?
Under policies are the processes.
The ISO definition of a process is:
‘A process is a set of inter-related activities that turn inputs into outputs’
For me, a process sets out what you do, but not how you do it. A business process for tracking time and attendance for all staff and contractors, may contain an activity such as ‘Complete time and attendance spreadsheet’ but give no detail on how that is performed. There is an assumption that the responsible person would know how to perform the task and where to find the appropriate materials to do so. Any further guidance or detail should be set out in a procedure or work instruction.
Looking at the process map below, this contains five activities and shows the person responsible for each. It is expected that for example the Project Manager will know how to 'Confirm project scope' or if they don't, they will know how to find this out. Where appropriate, documentation on how to perform the activity - the procedure or work instruction - can be linked to from the relevant activity on the process map.
What is a Procedure or Work Instruction?
These are the third layer of the pyramid.
A procedure or work instruction should detail the exact steps an individual would need to go through to complete any activity detailed in a process. Continuing on the time and attendance theme, a procedure may have the instruction: ‘The time and attendance spreadsheet can be found in the HR folder of the network drive. Populate the employee number and hours worked in columns C and D’
The Practical Application
I hope that my sharing these policy, procedure and process guidelines with you has been helpful.
A common reason for being interested in the difference between a policy, a process and a procedure is that having clarity and consistency around different types of information is absolutely key in encouraging your employees to follow the agreed process. However this is still the most difficult thing to achieve in any process improvement project - because it relies on people to individually check and follow the correct documentation.
Recognising this, Triaster have developed the ATC Platform. This is a process execution engine which sets your processes as lifecycles which everyone has to follow. To read more about this and to sign up for ATC Free please click here:
This is an updated and refreshed edition of an article originally written in 2017.
Written by Paul Elson-Vining
Paul is the Managing Director of Process Envision; in a previous life he was Principal Consultant for Triaster. With over 15 years of process experience and over 25 years experience in implementing and training software systems, he has personally been involved in over a 100 Business Process Management (BPM) implementations globally. He has a Diploma in Professional Consulting from the Chartered Management Institute and is a IRCA certified Lead Auditor for 9001:2015, QMS Internal Auditor, TickIt plus practitioner, TPMA certified training practitioner, GASQ Certified GDPR Practitioner and Microsoft Certified Professional.