Policy, Procedure, and the Real Standard

Idea one

The written rule and the real rule

A policy states the organization's intended rule — what must happen, what must not, who is permitted to decide, and what standard is being protected. A procedure explains how people are expected to apply it. Together they are supposed to make work more consistent, safer, fairer, and less dependent on individual memory.

But every organization also has a real rule. The real rule is the version people actually follow when work is urgent, ambiguous, inconvenient, or caught between teams. It may be sensible. It may be a useful adaptation to circumstances the written policy did not anticipate. Or it may be an unofficial workaround that quietly weakens the control the policy was designed to provide.

The difference matters because employees learn the real rule much faster than they learn the written one.

A new manager at Northstar is given the credit-control policy. It states that goods must not be released to accounts on hold without Finance approval, and explains the approval levels and the information required. That is the written rule.

Then an urgent equipment failure happens at an important customer site, and an experienced colleague says: "Do not put this through the normal mailbox. Call the finance manager directly, get Daniel to confirm the customer's position, and tell the warehouse supervisor that Finance is likely to approve." That is the real rule.

It may be a practical shortcut, and it raises hard questions. Is the direct call an approved urgent route, or merely a personal favour? Does every service manager know it exists? Can a newly promoted manager use it with the same confidence as an experienced one? What happens when the finance manager is absent? Does the warehouse release the part after a recorded approval, or because someone says "Finance is aware"?

A policy cannot be judged only by the quality of its wording. It must be judged by the behavior it creates.

Idea two

A workaround is usually evidence, not resistance

If employees regularly work around a policy, leaders often assume that the employees are resisting discipline. Sometimes that is true. People may ignore a rule because it is inconvenient, or because they have developed a habit of treating controls as someone else's problem.

But repeated workarounds are often evidence that the policy and the work no longer fit each other.

The written rule may have been designed for a normal case while employees deal with a recurring situation that is not normal in practice. It may assume decisions can wait until the next business day when customers need answers in hours. It may require information that is difficult to obtain at the moment of need. It may assign responsibility to one team while giving the authority to another. It may contain sensible controls but no usable exception route.

In those circumstances, employees do not experience the policy as a clear standard. They experience it as an obstacle to doing the job they are held responsible for doing.

That is how unofficial rules take hold. Someone discovers the shared Finance mailbox is not monitored closely after four o'clock but the finance manager answers a direct message. Someone learns Product will not reconsider a portal issue unless a senior account executive raises it. Someone finds an engineer gets a routine part faster by calling the warehouse supervisor than by updating the system in the prescribed order.

None of these adaptations may begin with bad intent. People are trying to help customers, protect delivery, and avoid unnecessary waiting. Over time, however, the workaround becomes the operating system. The documented procedure remains in a folder, and employees teach one another the route that actually gets results.

"The system says one thing," they tell a new colleague, "but this is how it really works." That sentence should concern any manager.

Idea three

When the process runs on personal access

It does not follow that every informal practice must be eliminated. Informal knowledge is unavoidable, and often valuable. Experienced employees know context a written document cannot contain — how to speak to another team so the issue is clear, which facts matter to Finance, which technical details Technology needs.

The problem begins when informal knowledge is required to make an ordinary process work.

A service manager's relationship with the warehouse supervisor can be useful. A quick conversation establishes whether the part is physically available, whether it has been reserved, and whether an engineer can collect it before closing. That direct contact is not a failure of procedure. It may be a sensible complement to the system.

But if the part can be released only because the supervisor trusts that particular manager, while another manager must wait for a formal instruction that arrives too late, Northstar has created an uneven standard. The organization is no longer operating through a reliable process. It is operating through personal access.

The same appears in customer communication. If the approved message merely says "your issue has been logged" while customers repeatedly cannot obtain important records, advisers will find ways to give a more useful answer — sending documents manually, saying the problem is widespread, suggesting a particular account executive can help. These actions may be helpful. They also create inconsistency. One customer gets a manual document within an hour because they reached an experienced adviser. Another gets a generic response. A third is told a fix is expected soon, although no priority decision has been made.

The written policy aims for consistency. The real rule produces variation based on who knows the workaround.

Which is why policies can create the appearance of control while concealing operational risk. Leaders look at the policy and assume the standard is clear. Employees sign that they have read it. Audits confirm the document exists and has been reviewed. Meanwhile the actual work happens through calls, private messages, spreadsheet trackers, verbal agreements, and exceptions that are never recorded clearly enough to be examined. The organization then has two versions of reality.

Idea four

It has removed the evidence

The risk is not simply inconsistency. It is that the organization cannot learn properly from decisions it cannot see.

If credit-hold exceptions are agreed informally, Finance may not know how often Operations is encountering urgent cases, which customers create repeated exposure, or whether Sales is resolving the underlying debt disputes. If Support advisers send service records manually without recording the effort, Product may underestimate the cost of leaving the portal defect unresolved. If engineers use unofficial routes to obtain parts, Operations may miss evidence that the formal stock process is too slow.

Workarounds solve the immediate problem while hiding the recurring one.

And from inside, the people doing it are behaving well. They know Finance needs the account balance, part value, customer history, operational impact and the commercial view before an urgent exception can be decided. Rather than submit a general request and wait for questions, they gather the information themselves and approach the finance manager directly. From their perspective, they are being responsible.

From the organization's perspective, the process may be learning nothing. The shared mailbox appears to receive few urgent requests. The formal procedure appears to be working because few cases are recorded as exceptions. The Finance Director may never see the volume of emergency releases, the time service managers spend coordinating them, or the number of cases where Sales committed before Finance assessed the risk.

The workaround has not removed the problem. It has removed the evidence.

Which leads to the warning worth keeping. Leaders should be cautious when a policy appears to be followed perfectly. Perfect compliance can mean that the rule is clear and practical. It can also mean that employees have stopped using the official route because they know it will not help them.

The most revealing question is often not, "How many policy breaches have we recorded?" It is, "What do people do when they need the policy to work quickly?" If the answer is "they call Sarah because she knows who can approve it," or "they copy the director because that gets a response," the organization has discovered a hidden process. It may work today. It is unlikely to be dependable.

Idea five

Treat the policy as a hypothesis

A useful policy should therefore be treated as a hypothesis about how work can be done safely and well. It should be tested against reality.

Managers need to ask employees not only "are you following the policy?" but also "what do you do when the policy does not fit the situation?" The answer may reveal a necessary exception that should be built into the procedure. It may reveal a training gap, where people bypass a rule because they do not understand its purpose. It may reveal a weak control that needs reinforcing. Or it may reveal that the organization has asked employees to meet two conflicting standards without giving them a way to choose.

Northstar may tell service managers that critical equipment must be restored quickly, while also telling them that no part can be released under credit hold without a Finance decision that takes a business day. If urgent cases occur regularly, the conflict is not an employee problem. It is a design problem.

And when the written standard does not resolve a real trade-off, people resolve it informally. The same is true of a rule with no credible exception route. If a critical failure occurs and the only approval route is a mailbox reviewed the next business day, the policy has treated a recurring operational reality as though it were an unusual inconvenience. The predictable result is escalation through personal networks — someone calls the finance manager, someone asks Daniel to contact Priya, someone tells the warehouse that approval is "coming." A policy without an exception route does not eliminate exceptions. It makes them unofficial.

So the organization must decide what the real standard should be. Perhaps the rule remains that no held account receives goods without Finance approval, but a verified critical failure has a two-hour urgent decision route with defined thresholds and named deputies. Perhaps Sales must provide specified commercial information before Finance considers it. Perhaps the service manager remains the outcome owner and must keep the customer updated while the decision is made. That revised rule preserves the control while making it usable.

The strongest policies do not attempt to eliminate judgment. They make judgment more visible, more consistent, and easier to review. They state the purpose of the rule, define the normal route, describe the boundaries of discretion, and provide a real route for exceptions. When employees understand why a policy exists, they are more likely to apply it intelligently. When they know what to do in an unusual case, they are less likely to rely on hidden networks. When leaders examine workarounds without immediate blame, they can distinguish between dangerous non-compliance and evidence that the formal process needs repair.

The written rule matters; it expresses the intended standard. But the real rule determines what customers, employees, and managers actually experience. If the two are far apart, the policy is not governing the work. The informal organization is.