When Did Your Policies Stop Matching Your Business?

Your policy folder may look reassuring. It may also be dangerously out of date.

A policy written several years ago can still carry the right logo, legal wording and director signature. But if legislation has changed, technology has altered the risk, responsibilities have moved or employees now complete the work differently, that document is no longer controlling anything. It is simply evidence of what the business once intended to do.

For a UK small business, the consequences can include an injury, payroll error, data breach, employment claim, lost contract, regulatory action and a serious drain on management time.

A policy is not protection merely because it exists. It must reflect the law, describe the current operation, assign responsibility, be understood by the people affected and be supported by evidence that it is followed.

Regulators, insurers and tribunals do not assess the quality of your filing system. They look at what actually happened. A well-written procedure that nobody has been trained to use may even make matters worse, because it can show that the business knew what should happen but failed to make it happen.

This applies across the business. Your absence procedure must reflect current statutory rules. Your privacy notice must describe how personal data is collected and used today. Your cyber policy must cover cloud systems, remote access, AI tools and supplier accounts, not only the office server you retired years ago.

The direct fine is rarely the whole cost. The wider bill often includes:

• Management time spent investigating, retrieving records and answering questions from employees, clients, insurers or advisers.
• Lost productive time while work stops, systems are isolated or managers attend meetings.
• Emergency professional fees to update policies, contracts, training and records under pressure.
• Overtime, temporary cover, recruitment and retraining after an incident or employee departure.
• Lost tenders and client confidence when you cannot quickly provide current policies and evidence of implementation.

A modest internal failure can become a five-figure distraction before any fine or compensation is considered. Two directors spending 35 hours each on an investigation at an internal value of £75 per hour is £5,250 alone. Add staff disruption, specialist advice and delayed work, and the operational cost grows quickly.

Documentation is not assurance

A risk assessment or policy can identify the right control, but it does not guarantee that control exists in practice.

The key distinction is simple. Documentation says what should happen. Assurance checks that it is happening, before work begins and while conditions change.

If a policy requires two approvals before a payment detail is changed, the workflow should make those approvals clear and record them. If a risk assessment requires scaffolding, someone should check the scaffolding is in place before work starts. If a cyber policy requires multi-factor authentication, someone must verify that it remains enabled.

A review is unfinished until every action has an owner, deadline, completion record and effectiveness check.

An annual review date is useful, but it is not enough. Policies should also be reviewed when a meaningful change happens.

• Legislation, regulatory guidance, industry standards or client requirements change.
• A new system, AI tool, machine, vehicle, data source or communication channel is introduced.
• The business adds a site, appoints a manager, uses subcontractors or changes responsibilities.
• An incident, near miss, complaint, grievance, data breach or repeated error reveals a failed control.
• Employees create a workaround because the documented process is too slow or impractical.
• Training, spot checks or audits show inconsistent understanding or compliance.
• A client, insurer or tender request asks for evidence the business cannot quickly produce.

If none of these events has triggered a review in several years, that is not necessarily proof of stability. It may show that the business does not have a functioning system for identifying change.

Technology is one of the most common causes of policy drift. Many businesses now rely on Microsoft 365, cloud accounting, remote working, WhatsApp groups, online payment systems, AI note-taking and generative AI.

A generic instruction to use strong passwords is not a cyber-management system. A current policy should answer practical questions, including:

• Which systems require multi-factor authentication and who checks it?
• Who can approve a change to supplier bank details, and how is that request independently verified?
• Can employees enter client, employee or commercially sensitive information into public AI tools?
• Who removes access when an employee or supplier leaves?
• Where are backups held, when were they last tested and who can restore them?
• Who leads the response to a suspected cyber incident?

Your policy must also reflect real behaviour. If people use personal phones, shared passwords or unofficial messaging because the approved process is frustrating, do not simply write a stricter rule. Find the operational problem and create a control the team can realistically follow.

Start with a policy register

Do not begin by rewriting every document. Begin by gaining control of the portfolio.

Create one simple policy register containing the policy name, owner, approver, version, approval date, next review date, relevant legal or contractual basis, training required and location of supporting evidence.

Then prioritise by exposure. Start with areas where failure could injure someone, break the law, expose personal data, underpay staff, disrupt cash flow or damage a major client relationship. Health and safety, employment, payroll, data protection, cyber security, financial authorisation, complaints and business continuity are usually high-priority areas.

A policy review does not need to become a six-month project. Use a focused process and work through the highest-risk areas first.

First, compare the document with reality. Ask people doing the work to explain what actually happens. Observe the process where appropriate. Workarounds often reveal a missing tool, unclear responsibility or unrealistic approval route.

Second, check external requirements. Identify relevant legislation, regulatory guidance, insurer conditions, client contracts and industry standards. Use specialist legal, HR, safety, data protection or technical advice where needed. An operational review should organise and implement expert requirements, not invent legal advice.

Third, make ownership explicit. Every policy needs a named owner responsible for monitoring change, proposing updates and checking evidence. “The management team” is not an owner.

Finally, translate the policy into practical action. Update linked procedures, forms, checklists, system permissions, training, induction materials and manager guidance. Communicate what changed and ask employees to demonstrate the new process. A read receipt proves delivery, not understanding.

Keep approved versions, training records, acknowledgements, checks and action closures together. Make the current version easy to find and archive old versions so employees cannot accidentally follow them.

Choose one high-risk policy and sit down with its owner and one employee who uses it. Ask:

• Is it legally and technically current?
• Does it describe what we actually do today?
• Are responsibilities named and accepted?
• Can an employee find the current version in under two minutes?
• Do the linked procedures, forms and system controls match it?
• Can we prove people were trained and that the control is checked?
• Were actions from the last review completed and tested?

Any answer of “no”, “not sure” or “I think so” is an action. Assign it to someone and set a date before the meeting ends.

Current, practical policies create clarity, consistency and control. Old, contradictory or ignored policies create false confidence. Do not wait for an accident, complaint, cyber incident or client challenge to discover that your written policies no longer match your business.

About the Author

Julie-Ann Adams

Founder, The Efficiency Method

Julie-Ann has spent thirty years running operations, including building a waste and recycling business to £8 million, and is the first certified lead auditor in the world for EN 50625 and EN 50614. She now works with owner-managed businesses across the UK, finding where money, time and control are being lost, and fixing the cause rather than the symptom.