Policies that fit: drafting internal policy that serves the organisation — and survives scrutiny.

Every internal policy has two audiences. The first is the person who must follow it — the employee, the manager, the committee. The second is met later, and never on a good day: the person who reads the policy against the organisation. A commissioner at the CCMA. An assessor from the Information Regulator. An auditor tracing a procurement decision. A funder’s due diligence team. A director asking where a delegated power actually came from. Most policies are written for the first audience only. The ones that survive are written for both.

The commonest failure is the borrowed policy: downloaded, lightly renamed, adopted without ever being read against the organisation’s own founding documents or the way it actually works. It looks complete. It is also the easiest document in the file to dismantle, because it makes promises the organisation never intended and claims authority it does not have. Five disciplines separate a policy that fits from a policy that merely exists.

1. Anchor it to the instruments above it.

A policy sits at the bottom of a hierarchy, not in open space. Above it stand legislation — the Companies Act 71 of 2008, the Labour Relations Act 66 of 1995, the Protection of Personal Information Act 4 of 2013, and whatever sector statutes apply — then the organisation’s founding instruments: the Memorandum of Incorporation, an NPO’s constitution, a trust deed; then any collective agreement; then the frameworks the board has adopted above it. A policy cannot hand management a power the MOI reserves to the board, soften a statutory duty, or contradict a collective agreement. So before drafting a line, answer three questions: what sits above this policy, what do those instruments require or permit, and who has the authority to adopt it. A remuneration policy approved by management when the board’s charter reserves it to a committee is not a weak policy. It is not a policy at all.

2. Decide what it is — and keep policy and procedure apart.

Policy states the organisation’s position: what it permits, prohibits and requires, who decides, and on what principles. Procedure states how that position is carried out, step by step. When the two are blended into one document, both suffer. Every operational tweak becomes a formal amendment nobody gets around to, so the document quietly parts company with practice; and matters of principle become editable by whoever last updated step seven. Keep principle in a board-approved policy, keep the steps in a management procedure that expressly serves it, and let each be owned, amended and reviewed at its own level and on its own cycle.

3. Write only the rules you intend to enforce.

When a workplace rule is tested, the questions are well established. Schedule 8 to the Labour Relations Act — the Code of Good Practice on dismissal — asks whether a rule existed, whether it was valid and reasonable, whether the employee knew it or could reasonably have been expected to know it, and whether it has been consistently applied. A rule written but not enforced is therefore worse than no rule: inconsistent application is itself a recognised ground of unfairness. The same logic reaches beyond labour. A procurement threshold that is routinely bypassed, a gift register nobody completes, a retention schedule nobody implements — each becomes evidence of the gap between what the organisation says and what it does. Watch promissory language, too. “The company will” creates an expectation, and our courts have in appropriate cases been willing to treat policy content as forming part of the employment relationship. Use must for obligations you will actually enforce, may for discretion that is genuinely exercised, and delete aspiration dressed up as rule.

4. Build in the machinery.

The clauses nobody reads until they are needed are the ones that decide whether the policy holds. Definitions, used consistently. A scope clause that says who is covered — employees only, or contractors, volunteers and board members too. The approval authority and the date of adoption on the face of the document. A named owner responsible for the policy between reviews. A deviation clause: who may approve an exception, in writing, recorded where — because without one, the first exception is granted informally, and informal exceptions are where consistency goes to die. Commencement and transition, so that matters already in progress are not left in limbo. Version control and a review date. A policy without an owner and a review date does not stay neutral; it ages into fiction.

5. Test it against the reader who disagrees.

Before adoption, read the draft the way the second audience will. An arbitrator probing consistency. The Information Regulator reading a privacy or retention policy against POPIA’s actual conditions, not against good intentions. An auditor checking whether the delegations on paper match the signatures in practice. A verification agency or funder reading the procurement and HR policies for substance. A director asking where the policy found the authority it claims. And the plainest test of all: can the people it governs understand it on one reading? A policy the workforce cannot understand governs nobody — and “the employee did not know the rule” is a defence that succeeds. Whatever the hostile reading finds, fix it in the document now. It is far cheaper than fixing it in argument later.

The test of a policy that fits

The best evidence that a policy fits is dull. When it is finally tested — in a hearing, an audit, an inspection — both sides quote it, because it actually answers the question. That is not luck; it is drafting. A policy that fits is one the organisation can follow without heroics and defend without embarrassment.

This piece is general commentary on drafting practice. It is not legal advice on any specific matter, and no professional relationship arises from reading it.