Policy vs Procedure vs Process: What’s the Difference?
By Helen Jones · Last updated November 2, 2026
A policy states what an organization requires and why. A process maps the stages of work, often across teams, that deliver an outcome within that policy. A procedure gives the exact steps for one task inside the process. The policy sets the rule, the process maps the journey and the procedure explains how to do each step.
People use the three words interchangeably, but each document does a different job. Mixing them up produces policies that read like instruction manuals, procedures nobody can find and gaps that only show up during an audit. This guide explains the differences, shows where standards, guidelines, SOPs and work instructions fit, and traces one example through every layer. It also covers how to keep the whole set current and how to prove the right people read it. It’s written for compliance, HR, quality, information security and IT teams who write, own or enforce these documents.
Policy vs procedure vs process at a glance
| Policy | Process | Procedure | |
|---|---|---|---|
| Answers | What is required, and why? | What happens, in what order, and who is involved? | How exactly do I do this task? |
| Scope | The organization or a large group | One end-to-end flow, often across teams | One task, usually for one role |
| Level of detail | Broad | Stages and handoffs | Step by step |
| Usually approved by | Senior leadership or the board | The process owner | The department or process owner |
| Changes | Rarely, after a law, regulation or strategy change | When the flow of work between people changes | Often, whenever a system or task changes |
| Typical format | Written statement with scope, responsibilities and consequences | Flowchart, swimlane diagram or stage list | Numbered steps, checklist or SOP |
| Example | “Access is removed when an employee leaves.” | Leaver process: notice, approval, access removal, equipment return, final pay | “How to disable a leaver’s account and remove group memberships” |
What is a policy?
A policy is a formal rule that sets out what the organization expects and why. Policies reflect the organization’s goals and values and the laws and regulations it must meet, and they are usually approved at senior management or board level. The University of Texas at Austin’s compliance office describes policy as telling people “what” is important, “why” it’s required and “who” is responsible for carrying it out (UT Austin).
A good policy states its purpose, who it applies to, what is required, who owns it and what happens if it isn’t followed. It doesn’t explain every step of the work. For the full definition, types and examples, see our guide to what policies are, or start your set with this list of essential company policies.
What is a process?
A process is the series of stages that turns a trigger into an outcome: hiring someone, onboarding a customer, closing a financial period or removing a leaver’s access. It shows what happens first, what happens next, who is responsible at each stage and where work passes from one person or team to another.
Processes often cross team boundaries. A leaver process may involve the line manager, HR, IT, facilities and payroll. Every process must work inside the rules its policies set, and it’s usually easiest to understand as a diagram, because its main value is showing the handoffs.
What is a procedure?
A procedure is a written, step-by-step method for completing one task the same way every time. Procedures are the most detailed of the three documents: they sit inside a process and carry out a policy, and they’re written clearly enough that anyone with the right access and training can follow them and get the same result.
What a good procedure includes
- Purpose and scope: the task it covers and who must follow it
- Related policy: the policy it carries out, named and linked
- Roles: who does each step and who checks or approves the result
- Numbered steps: in the order they happen, each starting with a verb
- Records: what must be logged, where and for how long
- Owner, version and review date: so readers can see it’s current
For layout and writing rules, see our guide to SOP format and writing guidelines.
What is the difference between a policy and a procedure?
A policy answers what and why. A procedure answers how. Quick test: if the document says what is required and why, it’s a policy. If it says how to do a task, one step after another, it’s a procedure.
| Policy | Procedure |
|---|---|
| States a rule or requirement | Explains how to carry out a task |
| Short, broad and stable | Detailed and updated often |
| Approved by senior leadership or the board | Approved by the department or process owner |
| Applies across the organization or a large group | Applies to the people who do that task |
| “Passwords must be changed after a suspected compromise.” | “How to reset a user’s password and revoke active sessions in Microsoft Entra ID” |
Keeping them separate pays off. Policies stay short and only go back to senior approval when something significant changes. Procedures can be updated as often as systems change, without reopening the policy. For more definitions, see our guide to compliance terminology.
What is the difference between a process and a procedure?
The difference is scope. A process covers the whole flow from trigger to outcome, often across several people. A procedure zooms in on one task within that flow. Quick test: if you can draw it as a flowchart with handoffs between people, it’s a process. If you can write it as numbered steps for one person, it’s a procedure.
| Process | Procedure | |
|---|---|---|
| Scope | End to end | One task inside the process |
| People involved | Several roles or teams | Usually one role |
| Focus | What happens, in what order | How to do one step correctly |
| Format | Flowchart or swimlane diagram | Numbered steps or checklist |
One process usually contains several procedures, and the same procedure can be reused in more than one process.
What is the difference between a policy and a process?
The policy sets the requirement. The process is the sequence of work that meets it. A policy can say “all suppliers must be vetted before we pay them”. The purchasing process then shows each stage from request to approval to payment, and where the vetting happens.
Where standards, guidelines, SOPs and work instructions fit
Most document sets have more than three layers. From the most general to the most specific:
| Document | What it does | Mandatory? | Example |
|---|---|---|---|
| Policy | Sets the rule and the reason for it | Yes | Acceptable use policy |
| Standard | Sets a specific, measurable requirement the policy calls for | Yes | Passwords must be at least 14 characters |
| Process | Maps the stages of work that meet the policy | Yes, as the agreed way of working | Joiner, mover and leaver process |
| Procedure or SOP | Gives the steps for one task; an SOP is a formally controlled procedure | Yes | Disable a leaver’s account |
| Work instruction | Covers one action at one screen or workstation in detail | Yes | Screens for disabling an account in the admin center |
| Guideline | Recommends good practice where judgment is allowed | No | Tips for securing a home router |
The University of Texas at Dallas describes guidelines as “not enforceable like policies and standards” (UT Dallas). Use a procedure when a task must be done one way every time, and a guideline when people need advice they can adapt.
A standard operating procedure (SOP) is a procedure under formal document control, common in regulated settings. Work instructions sit one level below it. For definitions and examples, see our complete guide to standard operating procedures. Some organizations also write a metapolicy, a policy on policies that sets how every other document is written, approved and reviewed.
One example through every layer: removing a leaver’s access
The easiest way to see how the documents connect is to follow one requirement from the rule down to the record. This illustrative example uses a common IT and information security scenario.
| Layer | What it says |
|---|---|
| Policy | Employees have access only to the systems they need for their role, and all access is removed when they leave. |
| Standard | Accounts are disabled by the end of the employee’s last working day. |
| Process | The manager confirms the leaving date, HR records it, IT disables accounts and removes group memberships, facilities collects equipment and badges, payroll closes the record. |
| Procedure (SOP) | How the IT service desk disables a leaver’s account, removes them from Microsoft Entra ID and SharePoint groups, and closes the ticket. |
| Work instruction | The exact screens and fields to use in the admin center, with annotated screenshots. |
| Record | The closed ticket, with the date and time access was removed and who removed it. |
When the policy changes, work down through the layers and check that each process, procedure and work instruction still matches. Many organizations slip here: the policy is updated, but the procedure people actually use still describes the old way of working.
More examples
| Policy | Process | Procedure | |
|---|---|---|---|
| HR: recruitment | We recruit on merit and provide equal employment opportunity. | Advertise, screen, shortlist, interview, offer, pre-employment checks, start date | How to request and record a background check in the HR system |
| Healthcare: medication | Only qualified, authorized clinical staff may administer medication. | Receive and store medication, authorize staff, administer, record and review | How to check patient identity and prescription, give the dose and document it |
| Compliance: security documentation | Security policies and procedures are kept in writing and reviewed on a set schedule. | Draft, approve, publish, collect acknowledgments, review, retain versions | How to publish a revised policy to the SharePoint policy library and assign it to the staff it covers |
For more HR examples, see these key HR management policies.
Which document do you need?
| If you need to… | Write a… |
|---|---|
| State a rule, the reason for it and who it applies to | Policy |
| Fix a measurable requirement, such as a setting or a deadline | Standard |
| Show how work moves between people or teams | Process map |
| Make sure one task is done the same way every time | Procedure or SOP |
| Show exactly how to do one action on one screen or machine | Work instruction |
| Share good practice where people can use judgment | Guideline |
| Set how all of the above are written, approved and reviewed | Metapolicy |
Write the policy first, because it sets the rule everything else must follow. If you’re documenting an existing way of working, it’s fine to map the process first, but the finished set should always trace back to an approved policy.
Who owns, approves and follows each document?
| Role | Responsibility |
|---|---|
| Document owner | Keeps the document accurate, starts reviews and decides who must read it. Named by role, not by person. |
| Approver | Signs off the content before publication: usually senior leadership for policies, the process owner for processes and procedures, and quality or compliance where rules require it. |
| Line manager | Makes sure their team reads new and changed documents on time and follows up on overdue readers. |
| Employee | Reads the documents assigned to them, confirms they’ve read them and follows them. |
| Compliance or quality team | Runs the document control system, the review calendar and the reporting auditors ask for. |
How to write policies, processes and procedures
- Policies: keep them short and in plain language. State the purpose, scope, requirements, responsibilities and consequences, with an owner, an approval date and a review date. Start from our free policy and procedure template for Word or the policy template pack.
- Processes: map them visually, name an owner for each stage and mark every handoff between people or teams.
- Procedures: write numbered steps in the order they happen, start each step with a verb and test the draft with someone who has never done the task. The free SOP template pack includes a Word SOP template and an Excel revision and review log.
- All of them: link each document to the ones above and below it, so readers can see which policy a procedure carries out.
Once your policies and procedures are written, bring them together in one manual with a shared structure, owners and review dates.
Version control, approval and review
Out-of-date documents are a compliance risk in their own right. Give every document a version number, an approver and a review date, review sooner when a law, system or role changes, and keep superseded versions so you can show which version was in force on any date. See why policy versioning matters and how to set up policy review reminders.
Some regulations set the rules for you, but only for the organizations they cover:
- HIPAA Security Rule (US covered entities and business associates): written policies and procedures must be kept for 6 years from creation or the date last in effect, whichever is later, made available to the people who implement them, and reviewed periodically (45 CFR 164.316). See our HIPAA compliance guide.
- US drug manufacturers: written production and process control procedures, and any changes to them, must be reviewed and approved by the quality control unit, and any deviation must be recorded and justified (21 CFR 211.100).
If your documents live in SharePoint, these best practices for policy change management in SharePoint cover naming, versioning and approval. You can also build a policy approval workflow with Power Automate.
How do you prove employees have read your policies and procedures?
Managing policies and procedures involves five separate jobs, and different tools cover different ones:
- Store the documents in one controlled place.
- Approve and control versions so only the current approved version is published.
- Assign reading to the people each document applies to, with a deadline.
- Capture acknowledgment from each person, against the version they read.
- Demonstrate completion to an auditor or regulator with a report.
What Microsoft 365 does on its own
| Feature | What it does | What it doesn’t do |
|---|---|---|
| SharePoint document library and version history | Stores documents with permissions and keeps each version, with who changed it and when (Microsoft Support) | Assign a document to readers or record that anyone read it |
| Microsoft Entra ID groups | Group users so access and permissions can be managed together (Microsoft Learn) | Send reading tasks or track who in the group has read a policy |
| Microsoft Purview audit log | Records activities such as file access. Records are kept for a default 180 days unless exported or retained longer (Microsoft Learn) | Show that a person read and accepted a specific version |
| Power Automate approvals | Builds approval flows that you design yourself (Microsoft Learn) | Provide a ready-made read-and-acknowledge program. Deadlines, reminders, escalation and reporting are yours to build and maintain. |
For a closer look, compare Microsoft Purview vs policy acknowledgment software, or read how to prove policy compliance in Microsoft 365 audits.
What DocRead adds
DocRead covers jobs 3 to 5 inside SharePoint, using the libraries and version history you already have. It assigns policies and procedures to SharePoint groups or Microsoft Entra ID groups, and assigns them automatically to new joiners as they’re added to a group. It sets reading deadlines, sends reminders and escalates overdue readers to their managers. Readers must open the document before they confirm, and each confirmation is time-stamped against the exact version they read. Reports show who has and hasn’t read each document and can be exported for auditors.
An acknowledgment shows that a person confirmed they read a document. It doesn’t prove they understood it or are following it. Where understanding matters, the DocSurvey add-on adds quizzes with a pass mark. Following the procedure is still checked through supervision, training and audits.
DocRead comes in two editions: DocRead for Microsoft 365 for SharePoint Online, and DocRead for SharePoint Server for SharePoint Server 2019 and 2016. Prefer to start on paper? Download our employee acknowledgment form template.
Common mistakes and how to avoid them
- Policies that read like manuals. Move the steps into a procedure and link to it.
- Procedures with no policy behind them. Name the policy each procedure carries out, or ask whether the rule needs writing down first.
- Several versions in circulation. Publish from one controlled library and retire old copies.
- No owner or review date. Give every document a named role as owner and a date it must be reviewed by.
- Changing the policy but not the procedure. Check each linked process and procedure whenever a policy changes.
- Emailing a link and calling it communicated. Assign the document to the people it covers, set a deadline and record each acknowledgment.
Frequently asked questions
What is the difference between a policy and a procedure?
A policy states what the organization requires and why, and is approved by senior leadership. A procedure gives the step-by-step instructions for one task so the policy is followed. The policy sets the rule; the procedure explains how.
What is the difference between a process and a procedure?
A process is the end-to-end flow of stages that produces an outcome, such as recruiting a new employee, and often crosses several teams. A procedure is the detailed instruction for one task inside that process, such as running a background check.
Which comes first, the policy or the procedure?
The policy, because it sets the rule the process and procedures must follow. You can map an existing process first, but the finished set should always trace back to an approved policy.
What is an example of a policy and a procedure?
Policy: all access is removed when an employee leaves. Procedure: how the IT service desk disables the leaver’s account, removes their group memberships and closes the ticket.
What is the difference between a policy and an SOP?
A policy says what is required and why. A standard operating procedure (SOP) is a formally controlled procedure that says exactly how to carry out one task the same way every time. An SOP supports a policy but never replaces it.
What is the difference between procedures and guidelines?
A procedure is mandatory: staff must follow its steps. A guideline recommends good practice where people can use judgment and isn’t enforceable in the way policies and standards are.
How often should policies and procedures be reviewed?
On a fixed cycle set by the document owner or your compliance team, and sooner when a law, system or role changes. Some rules set their own requirements; the HIPAA Security Rule, for example, requires covered organizations to review documented policies and procedures periodically and keep them for 6 years.
How do you prove employees have read a policy or procedure?
Assign it to the people it applies to, set a deadline, send reminders and record a time-stamped acknowledgment from each person against the version they read. DocRead does this inside SharePoint and Microsoft 365.
The bottom line
Policies set the rules and the reasons for them, processes map how work flows from start to finish, and procedures tell people exactly how to do each task. Keep them separate, link them together, review them on schedule and make sure you can show who has read the current version. Browse more policy and procedure articles, or see how DocRead tracks acknowledgment inside SharePoint.
Book a demoRequest a quoteStart the 30-day SharePoint Server trial