IT Policies, Standards, Procedures, and Guidelines
Understand the hierarchy of IT governance documents, from high-level policies to detailed procedures and guidelines, for the CISA exam.
IT governance relies on a structured hierarchy of documents that translate strategic direction into operational practice. For CISA candidates, understanding the differences between policies, standards, procedures, and guidelines is essential for both the exam and professional practice as an IS auditor.
The Document Hierarchy
IT governance documents form a hierarchy, with each level providing increasing detail and specificity:
Policies
Policies are high-level statements of management intent and direction. They define what the organization expects and why. Key characteristics of policies include:
- Approved by senior management or the board of directors
- Mandatory for all employees and stakeholders within scope
- Technology-neutral and focused on objectives rather than specific implementations
- Relatively stable and infrequently updated
- Aligned with legal, regulatory, and contractual requirements
Example: "All information assets must be classified according to their sensitivity and protected based on their classification level."
Standards
Standards specify mandatory requirements for implementing policies. They define what must be done to comply with a policy, providing measurable criteria for compliance. Characteristics include:
- Mandatory and enforceable
- More specific than policies but still technology-neutral where possible
- Define minimum acceptable levels of performance or security
- Updated more frequently than policies to reflect changing requirements
Example: "Passwords must be a minimum of 12 characters and include uppercase letters, lowercase letters, numbers, and special characters."
Procedures
Procedures are detailed, step-by-step instructions for performing specific tasks. They describe how to implement standards and policies in practice. Characteristics include:
- Mandatory when established
- Highly detailed and specific to particular systems or processes
- Include specific roles, tools, and sequences of actions
- Updated frequently as technology and processes change
Example: "To reset a user password: 1) Verify the user's identity using two forms of authentication, 2) Generate a temporary password using the identity management system, 3) Set the account to require password change at next login, 4) Communicate the temporary password through a secure channel."
Guidelines
Guidelines are recommended practices that provide flexibility in implementation. Unlike policies, standards, and procedures, guidelines are not mandatory. Characteristics include:
- Advisory and discretionary
- Provide best practice recommendations
- Allow flexibility based on specific circumstances
- Help users make informed decisions when procedures do not cover a specific situation
Example: "When selecting a cloud service provider, consider evaluating their SOC 2 Type II report, data center locations, and incident response capabilities."
Developing Effective IT Governance Documents
Organizations should follow these principles when developing governance documents:
- Consistency: Documents at all levels should be consistent and not contradict each other
- Clarity: Use clear, unambiguous language appropriate for the intended audience
- Accessibility: Ensure documents are readily available to those who need them
- Currency: Establish a regular review cycle to keep documents current
- Ownership: Assign clear ownership and approval authority for each document
The IS Auditor's Role
IS auditors evaluate the governance document framework by assessing:
- Whether the hierarchy is complete and internally consistent
- Whether documents are approved by appropriate authority
- Whether documents are communicated to and understood by relevant personnel
- Whether compliance is monitored and enforced
- Whether documents are reviewed and updated on a regular schedule
CISA Exam Tips
The CISA exam frequently tests the distinction between these document types. The key differentiator is that policies, standards, and procedures are mandatory, while guidelines are discretionary. Remember that policies are approved at the highest level (board or senior management) and set direction, while procedures provide the detailed implementation steps.