Standards, Policies, and Procedures
What the domain tests
This domain covers the written architecture of a compliance program: codes of conduct, policies, standards, and procedures, and how they are drafted, approved, communicated, and maintained. Candidates should distinguish standards (what is required and why), policies (management's positions and rules), and procedures (how to execute step by step). A code of conduct states values and expected behaviors at a high level; policies translate them into rules; procedures make them operable.
Concepts to master
- Hierarchy and consistency: code → policy → standard → procedure → work instruction; conflicts resolved by a documented precedence rule.
- Lifecycle: drafting with subject-matter and legal input, approval by the right authority, effective dating, communication, training, attestation, periodic review, and retirement.
- Risk-based tailoring: controls proportionate to the risk the policy addresses.
- Plain language and accessibility, including translations and formats.
- Exception and waiver processes with documented approval at an appropriate level.
Traps
Questions often test whether a policy is "effective" merely because it exists. Existence is not enough: it must be approved, communicated, understood, and enforced. Another trap is a procedure that conflicts with a policy, or a local policy that undercuts a global standard; the answer usually requires escalation and alignment, not local discretion. Watch for waivers granted informally - waivers need documented authority.
Rule of thumb
A policy is only as good as its approval, communication, and enforcement. If you cannot show who approved it, who received it, and what happens when it is breached, the control is weak.
Worked example
A business unit wants a local gifts-and-hospitality limit higher than the global policy. The best answer: escalate through the policy governance process, obtain documented approval from the policy owner, update or issue a formal exception, and record the rationale - not simply adopt the local practice.