Polished, Printed and Pointless: Seven Policy Habits That Fail the Boardroom Test

There is a particular kind of comfort in a well-formatted policy. It has a cover page, a version number, a distribution list and a paragraph beginning "the Company is committed to". It is filed. It is referenced in the board pack. And in many organisations it has not altered a single working decision since the day it was signed off.

That is the compliance museum: a collection of documents curated for the reassurance of visitors rather than the performance of the business. Nobody sets out to build one. It accumulates, exhibit by exhibit, usually because adding a policy feels safer than removing one.

Why the archive keeps growing

Policies multiply for understandable reasons. A regulator raises a point; a template arrives from a trade body; a new contract demands evidence of a control; an incident prompts a hurried redraft. Deleting anything requires a decision that someone might later be asked to defend, whereas publishing something new requires only effort.

The result is a library that grows faster than the organisation's capacity to maintain it. And maintained documents — reviewed, tested, owned, amended — are the only kind that carry evidential weight. An unmaintained policy does not merely fail to help; it can actively harm a firm's position, because it documents an intention the business has demonstrably not met.

Seven warning signs of an exhibit

1. No owner, only a custodian. The document says it is "maintained by the Compliance function", which in practice means nobody holds a mandate to change it. A genuine policy has a named accountable executive and a deputy, both recorded.

2. A review date that has been quietly rolled forward. Three consecutive annual reviews with no substantive amendments usually indicate that the review is a formality rather than an examination of whether the control still fits the risk.

3. No test, no evidence, no sample. If the organisation cannot produce a single artefact showing the policy in operation — an approval log, a training completion record, a sample of decisions made under it — the document describes an aspiration, not a control.

4. One-way distribution. The policy was published on the intranet, which is treated as equivalent to communication. There is no acknowledgement, no attestation and no evidence that the relevant staff could locate it under time pressure.

5. Unfalsifiable language. Phrases such as "appropriate due diligence", "reasonable steps" and "adequate oversight" appear without thresholds, definitions or escalation triggers. Nobody could ever be shown to have breached them, which means nobody can be shown to have followed them either.

6. Fossilised references. The document cites withdrawn guidance, superseded legislation, a former regulator structure or a committee that no longer meets. Stale cross-references are the most reliable single indicator that a policy has left the realm of active governance.

7. It has never been stress-tested. No tabletop exercise, no walkthrough with the front line, no post-incident review has ever probed the policy. Where an incident has occurred, the policy was not updated in response — the strongest possible evidence of dormancy.

The retirement-or-rewrite test

Boards and compliance leads do not need a lengthy methodology. Three questions, applied honestly, will triage most of a policy library in an afternoon.

• Does it change a decision? Name a real decision made in the past twelve months that would have gone differently without this document. If none can be named, the policy is decorative.
• Could you evidence it? If a regulator, customer or insurer asked for proof that the policy operates in practice, could you supply it within a working day? If not, the gap is either in the control or in the record-keeping, and both are fixable only if someone owns the document.
• Does it still match the risk? Has the underlying activity, supplier base, technology or regulatory expectation moved since the last substantive redraft? Where the answer is yes and no respectively, the policy is a candidate for rewrite.

A document that fails all three should be retired, not refreshed. Retiring a policy is a governance decision that deserves a recorded rationale: who approved the removal, what control replaces it if any, and how the change was communicated. That record is itself valuable — it demonstrates that the firm distinguishes between documents it relies on and documents it has shelved.

Making retirement respectable

Culturally, the hard part is persuading people that a shorter, sharper policy set is a stronger position than a comprehensive one. Two arguments tend to land with boards.

The first is evidential. In any enforcement or litigation context, opposing parties read what you wrote and compare it with what you did. Every dormant policy is a sentence that can be quoted back. A lean set of tested controls is easier to stand behind than a sprawling set of untested ones.

The second is operational. Front-line staff under pressure follow the rules they can remember. A policy library of forty documents competes for attention with the day job; a library of twelve, each with a clear owner and a recent test, has a far better chance of shaping behaviour.

A practical sequence for 2026

Start with an inventory that records, for each document, the owner, the last substantive change, the last test and the regulatory or contractual driver. Group the results into three piles: keep, rewrite, retire. Then schedule the rewrites against real risk rather than alphabetical order, and publish the retirement decisions with the same ceremony as the original approvals.

Finally, build a review trigger that is not purely calendar-based. A change in supplier, a new product line, a regulatory consultation outcome or an internal incident should each prompt an assessment of whether a specific policy still earns its place. Calendar reviews reward diligence in appearance; event-driven reviews reward it in substance.

A compliance function that can say, with evidence, "we have twelve policies and we can show each one working" is in a considerably stronger position than one that says "we have forty and they are all up to date". The second statement invites a follow-up question. The first answers it before it is asked.