Hello everyone and welcome. My name is Sylvia and I’m a senior consultant here at IntegriSURE Group Services. Thanks so much for taking the time to join us here today. It’s really great to have you here and we’re looking forward to taking you through this webinar and how we can support you to get a Board-Ready View of your policy framework.

Before we get started, just a few housekeeping items. The session will run for approximately 30 minutes plus question time. So please pop your questions into the chat and we can come back to them later on. If there are any that we don’t have time to answer, we will follow them up with you after the session as well. We will also share a recording of this webinar with you following the end of the session.

And now I’d like to introduce today’s presenter, Stephanie Werner, founding partner here at IntegriSURE Services. Steph will be taking you through the session today and sharing her insights on how to take a more strategic, structured approach to reviewing your policy framework and identifying what needs attention. Over to you, Steph.

Good afternoon everyone and thanks Sylvia. My name is Stephanie Werner and I am the founding partner of IntegriSURE Services. My team and I work closely with organisations to bring greater clarity, structure, consistency to the way they operate, helping them navigate complex requirements, strengthen decision making and accountability and turn changes into practical, workable solutions with one of our areas of expertise,

Being governance, risk, and compliance, and some serious expertise in policy.

IntegriSURE Services itself is a management consulting firm. As I said, we specialise in governance, risk and compliance, also organisational improvement or operational and business excellence. And we focus on supporting effective governance, clear accountability and practical decision making.

Our core governance risk compliance services include the development of policy and governance frameworks, establishment of risk and compliance frameworks and processes, management systems and assurance processes and certification, organisational improvement and operating frameworks, and strategic and advisory support.

For policy review, our focus is not simply where the policies are current, but whether you have the right policies in place, whether they’re working effectively together, and what should be addressed first. So let me take you through what we’re going to cover today.

The first thing we’re going to cover is why policies matter to us and why we can’t avoid them.

Then we’re going to look at the visibility gap between what we can see and report on and what we can’t.

We’ll look at our IGS approach to getting a clear, BoardReady View of your policy framework. What support we can offer you today.

And as Sylvia mentioned, we’ll have 15 minutes at the end for questions, so pop them in the chat, Sylvia will collect them and we will address them at the end of the session.

Straight into it. So I might start with perhaps a little on why most of us are here. Typically we have an unwieldy policy suite.

So perhaps your policies have been developed gradually over time in response to things happening within your organisation, or perhaps you’ve had a consulting firm come in and write all of your policies for you in one fell swoop, or perhaps a little bit of both.

Maybe your policies have been appearing here and there out of the blue, or policies have come up that you’re unaware of.

Or worse, you need a policy to be able to address a situation and it’s nowhere to be found or it hasn’t been written yet. That one is for our HR and compliance people on the webinar. I’m sure you know exactly what I’m talking about there.

What about those of you who haven’t had an executive or a board member or a board committee member or even a regulator ask about policies which causes scrambling to get the list together of all of your policies, their versions, their review dates? Believe me, I’ve sweated through all of these situations and it’s tough.

And what’s the quick and nasty solution available to us these days? Get AI to write them for you. But…

The consequences of doing that can be devastating, and we’re seeing this a lot within regulators at the moment. AI rarely gets it right without putting in as much effort as writing the policies from scratch, iterations and iterations and iterations. And the risk is that your policies are creating a situation where you are being committed to doing things that you’re not aware of.

because they haven’t been read properly and they haven’t been iterated properly. Regulators are auditing for this now. So it’s not just about having the policy and the piece of paper and the contents. You need to be able to demonstrate that you are achieving what the policy is stating.

In all honesty, politics can be frustrating and more admin work than we really have capacity for. They’re an administrative burden in one moment and then the most important thing in another. But why are they so important?

They support your organizational direction, your mission, your vision, your values, your expectations, your rules. But at the end of the day, they are your insurance policy for most of the things that could go terribly wrong. They protect your organization, they protect your people, including your team, your stakeholders, your customers.

And, of course, they protect your products and your services.

The results?

More policies. More policies than you can possibly manage. And if any gaps are identified in the current suite of policies, that also results in more policies. Hence the unwieldy policy suite.

One thing that comes up often in highly regulated industries is accidental over-compliance.

This is where you have an abundance of policies and some of those policies commit your organization to a standard well above what you’re actually doing and what you’re obligated to. They are setting you up for failure.

Hopefully this sounds familiar. Well, actually, no, hopefully this doesn’t sound familiar and you’ve got it in hand. But if you don’t, we’ve been working to help try to make this a little easier for you.

The first way this becomes easier is to understand the visibility gap across your framework.

What we’ve found is that typically what is reported to board or executive is that we’ve got 80 policies, 15 are due for review this year, 5 are currently overdue, another 20 have been reviewed and approved over the last 12 months.

We might even have a nice dashboard on this, showing all of the red, amber, and green across all of your policies, or a policy register.

But if I’m sitting on a board, what does that really tell me about the quality and effectiveness of my policies?

We’re reporting the administration of the policy framework, but not a great deal about the condition of the policy framework.

What an important distinction that is, reporting on the administrative work versus the condition of the actual policy suite.

A really well-maintained policy register can tell us a lot, but it only tells us what’s on the register. It can’t necessarily tell us what’s not on the register.

It can’t readily tell us that two different policies are dealing with essentially the same issue, or that something important is spread across three different documents, or that the organisation has changed significantly, but its policy framework hasn’t been kept up to date.

So that started us thinking about what we would actually want to know if we were that executive or that board member.

We’ve derived 3 distinct deliverables.

that provide a holistic view of a policy framework and a practical approach for moving forward.

The first of those is a bird’s eye view of the policy framework through policy gap analysis.

Then a policy by policy assessment to support addressing the quality of each individual policy.

And finally, a pragmatic plan or implementation roadmap that guides what to do to address the findings of the gap analysis and the individual policy assessments. Let’s step through each of these now.

1. Policy Gap Analysis

So the first part of our process is to conduct a policy gap analysis. And this is where we take a bird’s eye view of the policy framework against a proprietary set of criteria to address your policy framework and how it’s sitting.

Let’s take a look at a sample of this now.

This is a policy gap analysis that my team and I produce based on an assessment of a whole of framework view of a policy framework.

First, we go through a bit of introduction in terms of what the gap analysis is doing and why, the purpose of it, and policy architecture, which we’ll show you shortly, how that’s being structured and the principles it’s based on and how to interpret the findings.

Then a very simple dash that shows you the gaps in your policies. Looking at your framework, we identify where you have any compliance, risk, governance or process issues within your policy framework. This particular dash is showing that there are 30 gaps, 30 areas that are not covered by policy and should be.

of those, 19 are governing policies and 12 are service delivery policies. 12 of them are high priority gaps. They need to be addressed very quickly.

12 of them are low priority gaps, six of them are in the middle. And then a breakdown across the organisation where those policy gaps are. So service delivery, as I mentioned, there are 12. Risk and compliance, 7 policies missing or policy areas. Four in governance and accountability, three in information technology, two across health and safety, and then two in people and culture.

Then we go into some of the other work that needs to be done across the policy suite. Often we come across policies that are in fact not policies. They might be processes, guidelines, plans, any number of other documents. And in this particular report, we’re saying that there are 10 policies that need to be demoted or reclassified into different documents.

Seven policies should be procedures across the HR life cycle. So the HR processes might be probation, off-boarding. Two policies that should be plans, so child safety, emergency management, and one policy that should be a guideline, and that’s the probation guideline.

We’ve got policies to consolidate, five of them should be amalgamated, three of them into the employee handbook and some into the acceptable use of IT and digital service and then working from home, flexible and remote working, which may be familiar to some of you. Often there are two or three different policies covering.

Flexible and remote working.

And then finally, those 30 policy gaps, new policies to consider, 19 in governing policies, 11 in service delivery and 12 in high priority, which should be 12 in service delivery.

Then into your policy architecture. This is the hierarchy and structure of the policies that are assessed. At the pinnacle is the policy of policies. This is the policy that governs all other policies, one ring to rule them all. It determines how policies are handled, managed, created, revised.

Archived, retired.

Underneath each of those are parent policies, the code of conduct, employee handbook, OHS policy. And then underneath each of those parent policies are subordinate policies. The colour coding is a red, amber, green approach, though not as obnoxious in colour, to define which policies to retain and review, what just needs renaming and a little

of merging or expanding, what needs to be maintained as a different type of document, and what don’t exist and need to be considered to be developed. So a nice, easy visual, we find that the upper echelons of organizations love this diagram because it gives them a very easy view of what they’ve got in place and what they need.

And then finally, the detail of the gap analysis itself. So all of the current policies, the gap analysis recommendation for those, if they will be changing into a future state policy by recommendation, what area they cover, and the outcomes of the individual policy assessment.

And then finally, the new policy recommendations, what the policy is, what the recommendation is, what the scope of that policy is, the area it’s in and the priority to address it.

So a really great report that provides a very high level view that we have had some great success with across many different industries, profit, not-for-profit, corporate and blue collar as well.

2. Individual Policy Assessments

Now that we’ve looked at the policy gap analysis, which gives us that bird’s eye view of the framework.

We now want to see each of the individual policies, one by one, identify what might be missing.

but still get into the details of each individual policy. We’ve developed a policy status report that gives you individualised recommendations across each of your policies, whether it’s recommended to retain it and review it, whether it’s recommended to retire it. It scores the policy across proprietary criteria.

Area to determine how good it is in terms of implementability.

purpose and scope, compliance, clarity and usability by your end users, and governance and accountability.

Monitoring and assurance.

There’s quite a lot in this assessment, but again, we don’t want to give you all of that complexity. So let’s have a look at the policy assessment and what is involved in that.

This is the policy assessment of policy status report that is the output of the individual policy by policy review. Again.

We are giving a lot of information but we’re trying not to give it too complex.

We have an overall status for the policy. This is one of the most important aspects of the policy assessment. Whether it is in a good state, whether there are opportunities for improvement, it requires revision, and so on. It just gives that very easy to identify status of the actual policy.

We have the assessment outcome across the 12 standard criteria. We look at, as I mentioned, the purpose and scope, compliance and obligations coverage, practicality and operational applicability, how well is it going to be implemented in practice, clarity and usability, governance and accountability, control, effectiveness and proportionality. So where you’ve got rules or expectations or controls defined in your policies,

how proportionate that is and how effective they would be in implementing. Enforceability and consistency, this is one of the biggest areas of issues within policies, how enforceable they are. Are they compliant to the point that we can enforce them?

Internal consistency and cross policy alignment. So where there’s duplication of gaps across with other policies, supporting processes and implementation support. So the subordinate or children documents to the policy, whether they’re required. Monitoring assurance and measurability, document quality and maintenance, and then change management and adoption readiness. How well could this policy truly be implemented?

We go through the policy’s strengths, risks, gaps, and opportunities, as well, and define the documents that should be related to this policy.

Next, we then build an implementation action plan. It is referenced back to the assessment that is done, so we can map this to where we need to across our criteria. It provides you with the overview of the observation, a prioritisation of the action, and then the recommended action to be taken as well. And this feeds into one of the outputs down the track as well.

And then finally, we give you the recommended policy structure and coverage.

So this provides you with a recommended structure to your policy and the focus of each of the areas within that policy. If you’re really savvy, this is something that you can use to actually use AI to write your policies for you. You still need to read them and iterate them,

But this output sample policy assessment, this policy assessment can be used to help you give your AI tools the context that it needs to write very well written and suitable policies.

If you want to do it the conventional way and ensure that they are suitable, proportionate to your organisation, that is also a service that we can help and provide.

3. Implementation Roadmap

Now we’ve seen the bird’s eye view and also the policy by policy reports. The last piece of the puzzle is the implementation roadmap.

This is where we bring everything together into a list of prioritised actions based on the findings from the gap analysis, cross-referenced with the policy assessments. It’s not a written report like you would normally get from a consulting firm. It’s A practical plan that you can work with straight away.

Let’s have a look.

So we do have a summary page and this can be tailored to what your executive and board want to see in terms of managing a project to uplift your policy framework. However, the value is in this implementation plan. This can be transitioned into any of your project management tools or online tools to help

enable utilizing your current business systems, whether it’s…

Microsoft Projects.

Monday.com, any of your tools.

It gives you the policy that the actions relate to. It gives you what the action is based on the outcome of the assessment. An overview of what actually needs to happen in a very short and simple sentence. This is the area that most people don’t provide. We get the practical implementation steps, but your executive and your board just need to know what it is we need to do with the policy.

any key dependencies and sequencing, and then the ability to track progress, timing, ownership, and what’s happening within each of the tasks. It gives it in a very, very practical and easy to follow way. It also gives it in a very reportable way as well.

and that covers all of the identified issues, gaps, d

So now we step through the three stages that we go through. I want to spend a few minutes bringing them all together because while each of them are useful in their own right, the real value is for the bigger picture and what it says collectively.

Let’s go right back to where we started. We talked about the information that management and boards often receive about policies. We know how many policies we have, which ones, well, mostly we do, which ones are due for review, which ones are overdue, and perhaps what has been recently approved. There’s nothing wrong with this information. We absolutely need it.

But what we’ve been trying to do through this service is to add that next layer down.

Once the policy gap analysis is completed, we can start answering some of the questions that a policy register simply can’t. What does the policy framework look like? Do we actually have the policies we need within the organisation?

Where are the gaps? Have we got any duplicates or any overlap?

Are there some things sitting in the wrong type of document, and what should we focus on?

For our future state policy framework.

Then through the policy assessments, we can start answering a different set of questions. Of the policies we already have, which ones are in good shape? Which ones need attention?

What are the actual weaknesses within the policies?

Are the responsibilities clear? Are the controls appropriate? Can the policy be applied in practice? And importantly…

What needs to change?

And then the implementation plan. This takes us from knowing all of that to actually being able to do something with it, and without dependence on anyone else. Rather than handing you a large collection of findings and leaving you with figuring out what happens next, we bring all of those findings together, consider the priorities and the dependencies, and establish A practical sequence

For managing any of the changes you need to make to your policies.

So if I’m sitting on a board or executive team, the conversation I can now have about the policies is quite different. Instead of being told we’ve got 80 policies and 12 are due for review this quarter, I can be told we’ve reviewed the policy framework. These are the areas that we’ve identified gaps. These are the policies in good shape.

and these ones really need attention. These are the higher priority issues we’ve identified and this is how we’re proposing to work through them. For me, that is a much more compelling conversation.

So I appreciate that we’ve shown you a lot today and it doesn’t seem like a small undertaking. Every organisation is starting from a different place and it is very different for each. So rather than offering some sort of sales discount, what we thought would actually be more useful to you is to

Make some time available for you to talk through your own policy environment directly with me.

You’ll get 45 minutes of my time.

to understand what you’ve currently got, what you’re trying to achieve, what your challenges are, and then we can talk through a sensible way forward, whether it’s through some advice during the session or something else entirely.

Based on my experience wrangling policy frameworks, I can very quickly give you a perspective on your policy framework, help point you in the right direction. There is absolutely no obligation attached to this, just the opportunity to talk more specifically about your circumstances and what your next steps are.

I’m going to leave the QR code here for accessing the one-on-one booking link through Calendly. And Sylvia is putting a link to it in the chat now so you can access it while we move into questions section for the webinar. So if you’d like one of these 45 minute sessions directly with me, you can book in now.

All right, Sylvia, I’ll hand back to you.

Thanks, Steph.

All right, so we haven’t had any questions come through in the chat today. However, for those who are on the call, on the Webinar, if anything does come to mind after this session or you’d like to discuss something we’ve covered in more detail, please feel free to get in touch with us after the session. We’d be really happy to continue the conversation with you.

So that brings us to the end of the session today. Thank you all for your time. We hope this has given you a clearer understanding of how a structured policy gap analysis, individual policy assessments, and an implementation roadmap can work together to give you a really practical view of your policy framework and what needs attention. If you would like to…

or how this approach could be applied within your organisation. As Steph has said, feel free to book in with one of those 45 minute sessions or get in touch and we’ll continue that conversation. Thank you again for joining us today.

Thanks, everyone.