Read with the right scope
Editorial implementation guidance for organisations of different sizes. Specific policies, training and review duties depend on the applicable law, regulator and activities.
Status: Practical implementation guide · source-checked 1 November 2026
A policy needs an operating process
A policy explains a position and expected behaviour. It needs accountable people, a practical procedure and evidence that the procedure works. The Wates Principles provide a governance framework for large private companies, including responsibility and risk oversight. They are not a universal statutory policy checklist, and the governance reporting rules have their own scope.
This guide offers an editorial workflow for keeping policies usable. Start with the risks and obligations that apply to the organisation. Avoid adding documents simply because a generic library contains them; equally, do not omit a required policy because it seems inconvenient.
Build a concise policy register
The register should let someone find the current approved version and understand who is responsible. Distinguish the person who maintains the document from the person authorised to approve its substance. For a small organisation, one person may hold several roles; record that arrangement and how conflicts or absence are managed.
- Purpose and scope: activities, people, locations and exclusions.
- Authority: relevant obligation, contractual commitment or organisational decision.
- Ownership: accountable sponsor, working owner, approval route and replacement contact.
- Lifecycle: version, approval date, next review and event-driven review triggers.
- Operation: linked procedure, required training, evidence and exception route.
Test understanding, not only circulation
An email attaching a policy demonstrates distribution, not understanding. Match learning to the role and the decisions people face. A short scenario may reveal more than a general acknowledgement: who can approve a gift, how should a suspicious payment be escalated, or what happens when the usual reviewer is absent?
Keep training records proportionate and protect personal information. Record the policy version used, intended audience, completion and follow-up. Where completion is overdue, assign responsibility rather than allowing the dashboard to conceal it among aggregate totals.
Review after events as well as dates
A scheduled review is useful, but incidents, changed services, acquisitions, technology changes and new obligations can require earlier attention. Ask whether the policy still reflects real work and whether staff have developed an unofficial workaround. Trace recurring exceptions to their cause.
When updating a policy, explain what changed, why, who needs to act and what evidence will show implementation. Archive superseded versions with a clear status, preserve records where required and remove misleading copies from everyday use. Close a review only when approval, communication and necessary process changes are complete.
Put the guide to work
Start with the evidence.
- The current approved version, its scope and the person responsible for maintaining it.
- A real process record showing the policy being applied to everyday work.
- A role-specific understanding check using the procedure staff are expected to follow.
- An exceptions and changes record showing what was corrected, communicated and checked.
Your first three steps
- Choose one policy with operational consequences and identify its owner and approver.
- Ask a user to follow it through a real or clearly marked practice scenario.
- Fix ambiguous instructions, update affected staff and confirm the revised process can be followed.
Common gaps to look for
- An annual approval date disguises an outdated operating process.
- Staff acknowledge receipt but cannot explain the next step.
- Superseded copies remain easier to find than the approved version.
Review when: Review when services, systems or responsibilities change, or when incidents and repeated workarounds expose an impractical instruction.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the governance guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- FRC — Wates Principles for large private companies ↗Source checked 1 November 2026 · Primary source
- Companies House — director responsibilities ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.