ABSTRACT
Organizations have been encouraged for decades to document their expectations by publishing policy documents that outline high-level guidelines for proper conduct. The absence of policy documents can result in confusion or lack of accountability, as expectations are not clearly defined. The lack of procedures documents often result in inconsistent performance, finger-pointing, and lack of accountability as well. The reality is that organizations can ill-afford not having detailed policy and procedures documents. A de-centralized approach is also useful, whereby individuals in their corresponding units prepare, maintain, and update these documents. Standard audit procedures dictate that internal auditors ask auditees for the policy and procedures documents for the areas under review. The key is to establish ownership of these procedures documents and make it a part of someone's job responsibilities. Policy and procedures documents play a key role ensuring expectations are documented and serve as a basis for reviewing compliance with those expectations.
