Policy Writing

3. Draft Structure

Standard policy structure:

1. Purpose and scope: What this policy covers and who it applies to
2. Definitions: Only if needed for clarity
3. Policy statements: The actual rules, clearly numbered
4. Roles and responsibilities: Who does what
5. Procedures: How to comply, step by step
6. Exceptions: How to request an exception
7. Enforcement: Consequences of non-compliance
8. Review and updates: How often the policy is reviewed
9. Effective date and version history

4. Writing Principles

• Use plain English — policies are only useful if people read and understand them
• Use "must" for mandatory requirements, "should" for best practices, "may" for optional actions
• Be specific about obligations — "employees must complete security training within 30 days of hire" not "employees should be trained"
• Include practical examples where they clarify abstract rules
• Don't include aspirational language that creates unenforceable obligations
• Cross-reference other relevant company policies rather than duplicating content

5. Regulatory Alignment

When a policy has regulatory drivers:

• Cite the specific regulatory requirement being addressed
• Map each policy provision to the applicable regulation
• Flag areas where the minimum legal requirement differs from best practice
• Note jurisdictional variations if the company operates in multiple states or countries

6. Output

• Deliver the complete policy document
• Include a cover note with: regulatory requirements addressed, key decision points for the attorney, and recommendations for implementation and training