Standards, Policies, and Procedures
What this domain tests
You must distinguish a standard (a mandatory statement of what must be achieved, often tied to an external authority such as a regulation or accreditation condition) from a policy (management's written position on how the organization will meet the standard) and a procedure (the step-by-step how, usually operational and role-specific). Questions love to blur these lines.
Know the anatomy of a usable policy: purpose, scope, definitions, responsibilities, the requirement itself, exceptions/approval path, references, and review cycle. Policies should be approved by the governing body or delegated authority, dated, version-controlled, and reviewed at defined intervals (commonly annually or when regulation changes).
Traps to expect
- Policy vs. procedure confusion: a question describes a detailed workflow and asks what document type it is - answer: procedure.
- Approval authority: staff can draft, but the governing body (or its delegate) adopts. A question offering "the compliance officer approves the policy" is usually wrong.
- Retroactive documentation: policies cannot be backdated to cover a past act.
- Accessibility: a policy nobody can find is not effective; distribution and acknowledgment matter.
- Conflicts: when an internal policy conflicts with a statute, the statute governs and the policy must be corrected.
Rule of thumb
If the sentence answers what must be true, it is a standard; what we have decided, a policy; who does which step, in what order, a procedure. When a question gives you a document with numbered steps and assigned roles, it is a procedure.
Worked example
A hospital's document states: "All workforce members must complete privacy training within 30 days of hire." That is a policy statement implementing a regulatory standard. A companion document lists: "HR notifies the training system on day 1; the LMS assigns module P-101; the manager verifies completion on day 30; non-completion escalates to the privacy officer." That is the procedure. A question asking which document the privacy officer should revise to change the escalation timeline points to the procedure, not the policy.