Organizational policies play an important role in governance, internal control, compliance, and corruption prevention. They express institutional direction, governing principles, expectations, and applicable requirements concerning matters relevant to an organization’s objectives and responsibilities.

A policy provides a framework for organizational decisions and conduct. Its implementation, however, requires appropriate processes, procedures, and control activities that translate its provisions into practice.

This distinction is fundamental. Approving and communicating a policy does not, by itself, demonstrate that the organization follows it or achieves its intended objectives.

Consider a board member who asks management whether the organization has a conflict-of-interest policy.

The response may be accurate. However, it addresses only the policy’s formal existence and communication. It provides no meaningful assurance that potential conflicts of interest are being identified, disclosed, evaluated, and appropriately managed.

Three Questions That Matter

1. Is the Policy Implemented?

An organizational policy expresses the institution’s direction, governing principles, and expectations concerning a particular matter. Its implementation requires appropriate processes, procedures, and control activities that translate those expectations into organizational practice.

Consider a conflict-of-interest policy requiring employees and decision-makers to disclose potential conflicts.

Its implementation requires more than communicating that obligation. The organization needs functioning arrangements for receiving disclosures, evaluating reported conflicts, determining appropriate responses, and monitoring compliance with relevant requirements.

The governing body should therefore ask whether these arrangements operate as intended and whether the individuals responsible for their execution discharge their assigned duties.

2. What Evidence Demonstrates Its Operation?

Management’s assurance that a policy is implemented should be evaluated against relevant and reliable evidence.

In the case of a conflict-of-interest policy, such evidence includes disclosure records, documented assessments of reported conflicts, decisions taken by authorized personnel, and records of measures adopted to manage identified conflicts.

However, the existence of these records is not necessarily sufficient to demonstrate effective implementation.

A completed disclosure form confirms that information was recorded. It does not, by itself, demonstrate that the disclosed conflict was properly evaluated, that an appropriate decision was made, or that the required measures were implemented.

Similarly, a documented management decision does not necessarily demonstrate that the decision was appropriate or that the resulting measures adequately addressed the identified conflict.

3. How Are Exceptions and Failures Identified and Addressed?

Even well-designed and effectively implemented organizational policies cannot guarantee complete compliance with their requirements.

An important indication of effective implementation is whether the organization can identify departures from its requirements, evaluate their significance, and respond appropriately.

Who identifies exceptions? How are they evaluated? Who determines corrective action? Does management examine recurring weaknesses or patterns that indicate broader deficiencies?

An organization that identifies and documents exceptions and addresses them appropriately may demonstrate stronger oversight than one that reports no exceptions without sufficient evidence of effective monitoring.

The objective is not to demand an absence of failures. It is to determine whether the organization has effective mechanisms to identify, evaluate, and address them.

The Role of Competent Questioning

These considerations illustrate the practical significance of Competent Questioning, a concept developed by Mike Masoud and published by The American Anti-Corruption Institute (AACI).

Competent Questioning requires more than formulating relevant questions. It also involves critically evaluating the answers received, considering supporting evidence, and recognizing when further inquiry is warranted.

When management responds, “We have a policy,” the response may adequately address a question about the policy’s existence. It does not necessarily answer questions about implementation, effectiveness, or unresolved risks.

A competent questioner must recognize that distinction.

This does not mean that every incomplete answer indicates deception, negligence, or corruption. The information provided may simply be insufficient for the particular oversight purpose.

Nor does Competent Questioning replace internal control, internal audit, compliance monitoring, or other governance and assurance mechanisms. Rather, it strengthens how decision-makers evaluate and use the information those mechanisms produce.

From Formal Compliance to Meaningful Oversight

Policies are important instruments of organizational governance. Their value, however, depends substantially on their relevance, design, implementation, consistent application, and contribution to organizational objectives.

Boards and executives should therefore distinguish among three different conclusions:

These conclusions are related but distinct. Each requires an appropriate evidentiary basis.

The responsibility of those charged with governance is not satisfied merely by confirming that a policy exists. Meaningful oversight requires evaluating whether organizational practices are consistent with the policy and whether the available evidence supports conclusions about its effectiveness.

References and Further Reading