​​​A risk manager recently wrote to ECRI with questions about managing the organization's policies and procedures. For example, the risk manager asked, what is the difference between a policy and a standard operating procedure? And how often should policies be reviewed?

In our reply, we noted that a policy is the guidance or framework setting forth the organization's objectives and goals for addressing a particular issue. Policies are the principles or rules that guide decisions and articulate the organization's intentions. A procedure is the particular way to accomplish the policy. A procedure incorporates the steps or actions necessary to accomplish the goal. 

The member also sought clarification regarding what should be contained in a policy manual, and whether separate manuals should be maintained for administrative policies and nursing policies. We noted that a policies and procedure manual often contains both administrative and practice (nursing) policies and procedures. However, if it is helpful for the organization to have separate policy and procedure manuals for nursing and administration so that those staff members can focus on the policies and procedures they address most often, this approach can be used.

Organizations opting for multiple manuals should bear in mind that all manuals must be regularly maintained, reviewed, and updated so that one version does not contain old policies and procedures while another version contains the updated policies and procedures. Another way to address this issue is to maintain electronic copies so that appropriate staff can refer to these policies and procedures as needed.

Both policies and procedures should be reviewed regularly. The frequency of review should be specified and must be within the organization's ability to accomplish. ECRI recommends yearly review of policies and procedures as a good practice; however, if the volume of policies and procedures is large, review every other year is acceptable (half in one year, half in the next year on a rolling basis). It is also advisable to review and revise policies and procedures when the organization establishes a new goal or expands into a new practice area, when new equipment or a new technology is obtained, or when governing laws or regulations change. Signing and dating each policy and procedure provides a clear indication that the policy and procedure was reviewed and approved. For each policy, a standard page or place, such as a cover page, should indicate who reviewed the policy and when. For an example of how to document this information, see theSample Policy and Procedure Template.

When review of a policy results in a change, staff must be notified of the change; accomplishing this can vary by organization. For example, some organizations use an e-mail system to communicate new policies and procedures to staff. Sending an e-mail describing the policy change and requesting a response acknowledging that the staff member received and reviewed the policy is a good way of notifying staff of policy changes and documenting staff awareness of the changes. Another way of notifying staff of a change in policy is making an announcement at a staff meeting, asking staff to sign off indicating that they have been informed of the policy change. Some organizations also use in-service sessions, a "lunch and learn," or paper handouts.

For more information and tools for policy development and management, see the Risk Management Fundamental Resource Collection.

The recommendations contained in Ask ECRI do not constitute legal advice. Facilities should consult legal counsel for specific guidance and develop clinical guidance in consultation with their clinical staff.