Corporate policy management is ordinary policy management plus one hard seam: a group writes a policy, and several local operations have to follow it under different laws, different systems and different sizes. How that seam is handled decides whether the group policy is followed or quietly ignored, and there are only three ways to handle it. This page sets out the three and which one keeps the evidence usable.
Option one: one policy, no variation
The group policy applies everywhere as written. It is the cleanest to administer and it fails wherever local law or local systems make it impossible, at which point the local operation follows something else and nobody records that they did. The failure is invisible from the centre, which is what makes it dangerous rather than merely inconvenient.
Option two: local rewrites, loosely related
Each operation writes its own version. Local relevance goes up and the group loses any ability to say what its policy actually is, because five documents drift in five directions over three years. It also doubles the review load: the worked example's 120 hours a year becomes 120 hours per site.
Option three: group policy with recorded local procedures
The policy is written once and does not vary; the procedures under it are local and each names the group policy it serves. This keeps one statement of what the organisation requires, allows the how to differ where it must, and makes the relationship visible so a policy change lists the procedures that need rewriting.
Why the third keeps the evidence usable
Attestation binds to a version of a document. With one group policy and local procedures, the group can say who has accepted the policy and each site can say who has read its own procedures, and both answers stay true when either layer changes. With five drifting rewrites, neither question has an answer that survives a year.
Questions people ask about corporate policy management
Should local sites rewrite group policies?
No. Keep one policy and let the procedures under it be local, each naming the policy it serves.
What happens if a local law makes the policy impossible?
That is a policy exception and it should be recorded as one. A site quietly following something else is the failure mode nobody sees from the centre.
What does variation cost?
Local rewrites multiply the review load per site: the worked example's 120 hours a year becomes 120 hours for each one.