Policy vs Procedure vs Process: What’s the Difference?

The main difference between a policy and a procedure is purpose. A policy states what an organization requires and why. A procedure gives the step-by-step instructions for one task. A process sits between them, mapping the stages of work that meet the policy across teams. The policy sets the rule, the process maps the journey and the procedure explains how.

Every organization runs on three kinds of documents: policies, procedures and processes. People often use the words interchangeably, but each does a different job. Mixing them up leads to policies that read like instruction manuals, procedures nobody can find and compliance gaps that only show up during an audit.

This guide explains the difference between a policy and a procedure, where processes fit, and how to tell all three apart, with examples from HR, healthcare, IT and compliance. It’s written for compliance officers, HR managers and IT administrators who write, own or enforce these documents.

Policy vs procedure vs process at a glance

What is a policy?

A policy is a formal rule or requirement that sets out what the organization expects everyone to do, and why. Policies reflect the organization’s goals and values and the laws and regulations it has to meet. They are usually approved at senior management or board level.

A good policy states its purpose, who it applies to, what is required, who is responsible and what happens if it isn’t followed. It doesn’t explain every step of how the work gets done; that is the job of processes and procedures. For a fuller definition, see our guide on what policies are and why they matter.

Common examples include a code of conduct, an equal employment opportunity policy, a data protection policy, a health and safety policy and an acceptable use policy for IT systems. If you’re building out your set, this list of essential organizational policies is a useful starting point.

What is a process?

A process is the series of stages needed to reach a business outcome, such as hiring someone, delivering a service or closing a financial period. It shows what happens first, what happens next, who is responsible at each stage and roughly how long each stage takes.

Processes often cross team boundaries. A recruitment process, for example, may involve the hiring manager, HR, finance and IT. Every process must work within the rules its policies set, and it is usually easiest to understand as a diagram, because its main value is showing the order of stages and the handoffs between people.

What is a procedure?

A procedure is the most detailed of the three. It gives step-by-step instructions for one specific task inside a process, written clearly enough that anyone with the right access and training can follow it and get the same result.

Procedures are where consistency is won or lost. If two people do the same task in different ways, one of them may be breaking a policy without realizing it. Clear procedures reduce errors, speed up training and give auditors something concrete to check against.

What is the difference between a policy and a procedure?

Policy vs procedure is the mix-up people make most, because both are written documents that people are expected to follow. A quick test helps:

• If the document says what is required and why, it is a policy.
• If the document says how to do a task, one step after another, it is a procedure.

Keeping them separate has practical benefits. Policies stay short and stable, so they only need formal re-approval when something significant changes. Procedures can then be updated as often as systems and tools change, without sending the whole policy back through senior approval.

What is the difference between process and procedure?

Process vs procedure, or procedure vs process, comes down to scope. Both describe how work gets done, which is why they are easy to confuse. A process covers the whole flow from start to finish, often across several people and teams. A procedure zooms in on one task within that flow and gives the exact steps.

• Process: recruit a new employee (advertise, shortlist, interview, offer, pre-employment checks, start).
• Procedure: how to run and record the background check in the HR system.

A quick test: if you can draw it as a flowchart with handoffs between people, it is a process. If you can write it as numbered steps for one person to follow, it is a procedure.

How do policies, processes and procedures fit together?

Think of them as layers, each supporting the one above it. Policy vs process is the easiest pair to separate: the difference between a policy and a process is that the policy sets the requirement, while the process is the sequence of work that meets it.

• Policy sets the rule and the reason for it.
• Process maps the stages needed to follow that rule in day-to-day work.
• Procedure spells out how to complete each task within those stages.

One policy may be supported by several processes, and one process may contain many procedures. When a policy changes, work down through the layers and check that each related process and procedure still matches. This is where many organizations slip: the policy is updated, but the procedures employees actually use still describe the old way of working.

Where do SOPs and work instructions fit?

A standard operating procedure (SOP) is a formally controlled procedure, typically used for tasks that must be done the same way every time, often in regulated settings. Work instructions go one level deeper, covering a single action at a single workstation or screen. Both sit under the procedure layer. For SOP format and how to write one, see our complete guide to standard operating procedures. If your SOPs aren’t being followed, the cause is often one of these common problems organizations have with SOPs, and these ten steps for rolling out SOPs in SharePoint can help fix them.

Examples of policies and procedures in HR, healthcare, IT and compliance

HR example: recruitment

Policy: The organization recruits on merit and provides equal employment opportunity, without discrimination on the basis of any protected characteristic.

Process: Advertise the role, screen applications against the job criteria, shortlist, interview, make an offer, complete pre-employment checks and confirm the start date.

Procedure: How to complete pre-employment checks, including confirming the offer and salary in writing, verifying eligibility to work in the United States, requesting references and recording the results in the HR system before the start date.

Healthcare example: medication administration

Policy: Only qualified, authorized clinical staff may administer medication to patients.

Process: Receive and store medication securely, authorize staff to administer it, administer it according to the prescription, and record and review every administration.

Procedure: Step-by-step instructions for administering a specific medication, including checking the patient’s identity and the prescription, giving the correct dose by the correct route and documenting it in the patient record.

IT example: user access

Policy: Employees get access only to the systems and data they need for their role, and access is removed promptly when it is no longer needed.

Process: Access request, manager approval, provisioning, periodic access review and removal when an employee changes role or leaves.

Procedure: How an IT administrator adds a new user to the correct Microsoft 365 security groups, confirms multifactor authentication is set up and logs the change ticket.

Compliance example: HIPAA security documentation

Policy: The organization protects electronic protected health information (ePHI) and keeps its security policies and procedures in writing, reviewed on a set schedule.

Process: Draft or update a security policy, approve it, publish it to the staff it applies to, collect read acknowledgments, review it periodically and retain each version.

Procedure: How the compliance team publishes a revised policy to the SharePoint policy library, assigns it to the clinical and administrative staff it covers, and keeps the superseded version for six years, as 45 CFR 164.316 requires.

How do you write a good policy, process and procedure?

• Policies: Keep them short and use plain language. State the purpose, scope, requirements, responsibilities and consequences, and include an owner, an approval date and a review date. Our free policy and procedure template for Microsoft Word gives you a consistent layout to start from.
• Processes: Map them visually, name an owner for each stage and mark where work passes from one person or team to another.
• Procedures: Write numbered steps in the order they happen, start each step with a verb, and add screenshots or checklists where they help. Test the procedure by asking someone new to follow it.
• All three: Link each document to the ones above and below it, so people can see which policy a procedure supports and which procedures carry out a policy.

How do you keep policies and procedures up to date?

Out-of-date documents are a compliance risk in their own right. Set a review date for every policy, and review sooner when a law, regulation, system or role changes. Use version control so you can show which version was in force on any given date, and retire old versions so employees can’t open the wrong one.

If your documents live in SharePoint, these best practices for policy change management in SharePoint cover versioning, naming and approval. For larger organizations with many policy owners, see our guide to scaling policy management with governance frameworks.

How do you prove employees have read your policies and procedures?

Writing a good policy or procedure is only half the job. You also need to get it in front of the right people and be able to show that they have read it. Emailing a link and hoping for the best leaves no evidence when an auditor, regulator or court asks who knew about a rule and when.

That is the problem Collaboris built DocRead to solve. DocRead for Microsoft 365 and SharePoint Online lets you:

• Send policies and procedures to the right people based on role, department, location or group membership
• Ask employees to read and formally acknowledge each document
• Send automated reminders and escalate overdue acknowledgments to managers
• See each person’s full acknowledgment history and track completion on live dashboards
• Keep your documents in your existing SharePoint libraries, with version control and audit trails

Frequently asked questions

Which comes first: the policy, the process or the procedure?

The policy comes first, because it sets the rule that the process and procedures must follow. In practice, many organizations document an existing process first and then realize a policy is needed to formalize it. That is fine, but the finished set should always trace back to an approved policy, so every procedure can show which rule it supports.

What is the difference between a policy and an SOP?

A policy says what is required and why, and it is usually approved by senior leadership. A standard operating procedure (SOP) is a controlled procedure that says exactly how to carry out one task the same way every time. An SOP supports a policy but never replaces it. Most regulated organizations need both, linked to each other.

What is the difference between a process and a procedure?

A process is the end-to-end flow of stages that produces an outcome, such as recruiting a new employee, and it often crosses several teams. A procedure is the detailed, step-by-step instruction for one task inside that process, such as running a background check. One process usually contains several procedures, each owned by the people who do the work.

Can a process exist without written procedures?

Yes, but it is risky. Without written procedures, each person does the task their own way, training takes longer and mistakes are harder to spot. It also becomes hard to show an auditor or regulator how the work is meant to be done. Writing procedures for high-risk or frequently repeated tasks is the best place to start.

How often should policies and procedures be reviewed?

Many organizations review policies on a fixed cycle, such as once a year, and review procedures whenever the task or system changes. Some regulations set their own rules. For example, the HIPAA Security Rule requires covered entities to review their documented policies and procedures periodically and keep them for six years. Any change in law, system or role should trigger an earlier review.

Policy vs procedure vs process: the bottom line

Policies set the rules and the reasons behind them, processes map how work flows from start to finish, and procedures give people clear instructions for each task. Keep them separate, link them together, review them regularly and make sure you can show who has read them. That way your documents do more than sit in a library: they shape how work actually gets done.