Other media can augment policies, making them more appealing and useful to intended readers. Reading policies is not very interesting to most employees. These supplements generally consist of some kind of electronic media for them to be effective.
Audio/Video Productions
Many organizations have started to use media convenient for the telecommuter. Video productions can be easily downloaded to the computer of an offsite employee, who can then review it at leisure and send an acknowledgment to the office. Once stored on the employee's computer, these productions can provide future reference for the employee.
Classroom Training Sessions
Most organizations offer formal classroom training sessions to present policies to employees and to obtain feedback from them. Classrooms provide the opportunity to learn from other attendees relative to policy methods and wording. The classroom setting provides an opportunity for attendees to meet with the instructor as well as other employees, and to exchange viewpoints. Instruction of this type may be restricted to the individual employee or include groups sharing policies.
Each organization has a culture that functions best in some environments but not in others. Before arbitrarily spending time and money offering supplements to written policies, weigh each media option and select carefully.
Policy Distributions
Drafting is not the only step to developing complete and effective policy documents. Policies must be disseminated to the target audience in the most-effective and efficient means possible.
To be truly effective and efficient, policies must be distributed to the intended audience to convey the message. It is not reasonable to expect all policies to apply to all employees at all times. Applicable policies should be distributed to the intended audience in a timely and effective fashion. After distributing the policies, it is important in some cases for employee acknowledgments to be executed and returned to the Human Resources unit for accountability purposes. This would be the case with policies such as the use of e-mail.
Consider the use of online policy manuals. Using this online method, a smaller number of policies with application to specific business departments or functional units can be developed, disseminated, and easily modified. They are easier to disseminate and are more easily updated and distributed than the larger companywide paper versions.
While conducting an operational assessment, the auditor asked to see the organization's manual of policies and procedures. She was presented with a six-volume set of operational and administrative policies and procedures comprising near 3000 pages. These binder pages were a hodgepodge of legal terminology, operational guides, and executive mandates. Later the auditor was presented with additional policy volumes relevant to procurement requirements, a funding guide, and an operations policy binder. There was no central index, nor were there searchable electronic versions available. These volumes were kept at several locations and access was very limited to two of the volumes. The auditor asked to whom these policies applied? The senior manager replied, "all employees."
To be truly effective and efficient, policies must be distributed to the intended audience to convey the message. It is not reasonable to expect all policies to apply to all employees at all times. Applicable policies should be distributed to the intended audience in a timely and effective fashion. After distributing the policies, it is important in some cases for employee acknowledgments to be executed and returned to the Human Resources unit for accountability purposes. This would be the case with policies such as the use of e-mail.
Consider the use of online policy manuals. Using this online method, a smaller number of policies with application to specific business departments or functional units can be developed, disseminated, and easily modified. They are easier to disseminate and are more easily updated and distributed than the larger companywide paper versions.
Policy Writing Techniques
Writing policies is a lot like creative writing. Very few folks have the skills right away, but with some experience and practice nearly everyone can write policies and become proficient at drafting a document that is easy to understand and carries substantial weight in the organization. Here are some general best practices in drafting policy documents.
Plain Language
Generally, policies are written to specific employees in particular business units. For example, information technology policies are replete with language and abbreviations that are so cryptic that other employees have little appreciation or understanding of the policy's purpose or direction. Policy language should aim to be as clear as possible and every sentence should say exactly what it is intended to say. For example, a drafted policy may say an employee is entitled to two weeks of vacation annually. What does this policy mean? Does the employee accrue vacation time during the year? What is the term of that year? Is it a calendar year or other term of year? Can the employee take vacation in less than a two-week period? Is the term "2 weeks" a 15-day period or is it 10 work days?
Policies should be drafted in the simplest words possible that still convey the meaning to the reader. Avoid colloquial terms, unexplained foreign language terms, technical terms, and slang. For example, what is the meaning of the term "rip-off." Today's usage would include definitions such as defraud, theft, or embezzle. However, to those of previous generations it refers to an action similar to removing wallpaper.
A major problem with technical writers is that they often aim at correctness and choose the biggest and most specific words. Remember, words serve little useful purpose if they are not understood. Policies should not be written like college textbooks requiring exhaustive study. Employees do not have the time or interest to engage in deep study. On the other hand, do not draft policies using terminology that makes them seem simplistic and condescending.
Spelling and Grammar
Avoid careless spelling and grammar mistakes. Word processors and spreadsheet applications have spell checkers and grammar checkers for a reason: the credibility of your policy documents depend on them.
Gender Words
In recent years, writers have been trying to avoid using "he" because it implies masculinity and possible bias. Sometimes we see a trend of using the terminology of "he/she" or "he or she." This phraseology gets tiresome very quickly in written form and is very awkward in conversation. It is acceptable to use a combination of "he and she" in writing or in conversation, depending on the location of the intended audience. It is important to remember to geography of the audience; for example, in some Middle Eastern nations it is appropriate to use the male gender and masculine words, while other nations prefer nongender words such as "team members" or "performance analysts." Policy documents must avoid offending employees if they are going to be considered credible. When drafting policies, it is a matter of credibility to be sensitive to the intended audience.
Eternal View
Policies should be in a written tone as though they have always existed and will continue to exist. Unless specific references are critical to the policy's application, avoid references to specific products, current computer architecture, or technologies. Also, policies should always refer to positions in the organization rather than to specific persons. Whenever possible, policies should not reference an employee's name, address, telephone number, floor, or mail station unless absolutely necessary. Rather, policies should reference positions such as the Human Resources Manager, located at a given location, telephone number, mail stop, and so on. If named business functions are referenced in the policy, they should be carefully identified, leaving no uncertainty in the mind of the reader. Be certain to do your homework when referring to a position; with recent restructuring and business unit consolidations happening on a daily basis, it is important that the correct position and office is named.
Application
"I did not think it applied to me." This is a common explanation given to auditors when an employee avoids policy compliance. The most-effective way to remove this excuse is to specifically state who must comply with the instructions of the policy. Such application statements are probably best stated in the context of which employees are responsible for adherence rather than stating those employees who are not required to comply. For example: "This policy applies to all employees who have remote network access." This is a much better policy statement than "This policy does not apply to those without remote network access."
Responsibility for Compliance
Well-written policies will explicitly identify the group or individual responsible for enforcing policy compliance. This statement can include those responsible for monitoring compliance, auditing adherence, and those who are responsible for uniform application of the policy across the organization.
Plain Language
Generally, policies are written to specific employees in particular business units. For example, information technology policies are replete with language and abbreviations that are so cryptic that other employees have little appreciation or understanding of the policy's purpose or direction. Policy language should aim to be as clear as possible and every sentence should say exactly what it is intended to say. For example, a drafted policy may say an employee is entitled to two weeks of vacation annually. What does this policy mean? Does the employee accrue vacation time during the year? What is the term of that year? Is it a calendar year or other term of year? Can the employee take vacation in less than a two-week period? Is the term "2 weeks" a 15-day period or is it 10 work days?
Policies should be drafted in the simplest words possible that still convey the meaning to the reader. Avoid colloquial terms, unexplained foreign language terms, technical terms, and slang. For example, what is the meaning of the term "rip-off." Today's usage would include definitions such as defraud, theft, or embezzle. However, to those of previous generations it refers to an action similar to removing wallpaper.
A major problem with technical writers is that they often aim at correctness and choose the biggest and most specific words. Remember, words serve little useful purpose if they are not understood. Policies should not be written like college textbooks requiring exhaustive study. Employees do not have the time or interest to engage in deep study. On the other hand, do not draft policies using terminology that makes them seem simplistic and condescending.
Spelling and Grammar
Avoid careless spelling and grammar mistakes. Word processors and spreadsheet applications have spell checkers and grammar checkers for a reason: the credibility of your policy documents depend on them.
Gender Words
In recent years, writers have been trying to avoid using "he" because it implies masculinity and possible bias. Sometimes we see a trend of using the terminology of "he/she" or "he or she." This phraseology gets tiresome very quickly in written form and is very awkward in conversation. It is acceptable to use a combination of "he and she" in writing or in conversation, depending on the location of the intended audience. It is important to remember to geography of the audience; for example, in some Middle Eastern nations it is appropriate to use the male gender and masculine words, while other nations prefer nongender words such as "team members" or "performance analysts." Policy documents must avoid offending employees if they are going to be considered credible. When drafting policies, it is a matter of credibility to be sensitive to the intended audience.
Eternal View
Policies should be in a written tone as though they have always existed and will continue to exist. Unless specific references are critical to the policy's application, avoid references to specific products, current computer architecture, or technologies. Also, policies should always refer to positions in the organization rather than to specific persons. Whenever possible, policies should not reference an employee's name, address, telephone number, floor, or mail station unless absolutely necessary. Rather, policies should reference positions such as the Human Resources Manager, located at a given location, telephone number, mail stop, and so on. If named business functions are referenced in the policy, they should be carefully identified, leaving no uncertainty in the mind of the reader. Be certain to do your homework when referring to a position; with recent restructuring and business unit consolidations happening on a daily basis, it is important that the correct position and office is named.
Application
"I did not think it applied to me." This is a common explanation given to auditors when an employee avoids policy compliance. The most-effective way to remove this excuse is to specifically state who must comply with the instructions of the policy. Such application statements are probably best stated in the context of which employees are responsible for adherence rather than stating those employees who are not required to comply. For example: "This policy applies to all employees who have remote network access." This is a much better policy statement than "This policy does not apply to those without remote network access."
Responsibility for Compliance
Well-written policies will explicitly identify the group or individual responsible for enforcing policy compliance. This statement can include those responsible for monitoring compliance, auditing adherence, and those who are responsible for uniform application of the policy across the organization.
Subscribe to:
Posts (Atom)
Popular Posts
-
The composition of the crisis and incident response teams should reflect the personnel required to analyze and deal with any events, fro...
-
Incident and problem management processes are intended to handle problems that are raised through the service desk as well as responses t...
-
Each company will define the composition and structure of its own crisis response group dependent on the nature, size, and scope of the ...
-
Often crisis responders will initiate a crisis notification through a verbal briefing. As such, it is imperative that a clear and accurate ...
-
The first step in implementing a strategy for deploying physical scanners is to select a central location to which all scanners will re...
-
There are many ways to deploy a system, and what is needed for the operating environment will possibly affect the solution chosen. In so...
-
Nessus is a popular open-source scanner for organizations that choose not to spend the money on other proprietary products. There are s...
-
Incident Management Guidelines Office block, facility, or hotel fires can present unique risks depending on the operating region in which th...
-
Once vulnerability information has been collected, it must be categorized and evaluated. The methods of evaluation and categorization va...
-
The first step in dealing with critical incidents rests with becoming aware that an adverse event has happened. The detection of critic...