SOP and policy design
Plain-language procedures that people follow, each linked to the risk it controls and the approval level it needs.
Plain-language procedures for vendor onboarding, gifts and hospitality or investigations, mapped to risks and approval levels.
Many control failures start with a procedure that is unwritten, out of date or too complicated to follow. People improvise, and the improvisation becomes the process.
We write procedures in plain language for the areas where risk is highest: vendor onboarding, purchasing, gifts and hospitality, conflicts of interest and investigations among them. Each step is mapped to the risk it controls, and approval matrices and delegation of authority make clear who can decide what.
A procedure works only if people know it. Roll-out includes training and acknowledgement, and procedures are written so that internal audit can test whether they are followed.
Procedures are unwritten, outdated or quietly ignored.
Signs we see most often
- 01Procedures are unwritten, inconsistent across units or years out of date.
- 02Approvals depend on who is available rather than on a defined authority.
- 03Audit findings point to people not following the process.
- 04A new system, acquisition or business line needs procedures.
- 05There is no written policy on gifts, conflicts or investigations.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01InventoryList existing policies and procedures and find the gaps.
- 02Map riskLink each process step to the risk it controls.
- 03DraftWrite procedures in plain language, with process maps.
- 04AuthoriseSet approval matrices and the delegation of authority.
- 05Roll outTrain users and collect acknowledgements.
- 06ReviewSet owners and review dates so procedures stay current.
Procedures people actually follow, each linked to the risk it controls.
- Plain-language SOPs with process maps
- Approval matrices and a delegation of authority
- Policies on gifts and hospitality, conflicts of interest and investigations
- Training materials and acknowledgement records
- A policy register with owners and review dates
The law and frameworks this work is aligned to
- COSO Internal Control: Integrated Framework (2013), principle 12 on policies and procedures
- Aligned to ISO 37301 compliance management systems
- Aligned to ISO 37001 anti-bribery management systems
- Companies Act, 2013 s.134(5)(e) on internal financial controls
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerWhere this service meets BDI's technology.
The platforms below record, monitor or act on the work this service produces.
Questions clients ask before we start.
Can you work with our existing templates?
Yes. We keep your format and house style where it works, and focus on content, clarity and the link to risk.
How long should a procedure be?
As short as it can be while still telling someone what to do, who approves and what to record. Most good procedures fit on a few pages with a process map.
Who should own each procedure?
The function that runs the process, with compliance or internal audit checking that it is followed.