Policy software that holds policies and nothing else is a smaller purchase than it looks, because policies are the stable half of the problem. A typical organisation has a handful of policies that change every few years and several dozen procedures under them that change constantly. Managing the stable half beautifully while the volatile half stays on a shared drive solves the part that was not broken. This page sets out what breaks and the link that fixes it.
Policies are few, stable and rarely the problem
Expenses, information security, code of conduct, safeguarding: a handful of documents, each signed off by somebody senior, each unchanged for years at a time. They matter enormously and they are not where the maintenance burden is. A system that only manages these will look well-behaved and will not have touched the actual cost.
Procedures are many, volatile, and where the hours go
The worked example on this site is 48 procedures at 2.5 hours of review each once a year: 120 hours and $6,600. That is the recurring cost, and it sits entirely on the side a policy-only system does not hold. If 30% are overdue, which is the example's default, that is 14.4 documents currently unverified and 36 hours to clear.
The link is what makes either of them usable
A procedure that names the policy it serves can answer why it says what it says, which is the question that stops arguments about changing it. A policy that lists the procedures under it can answer what has to be rewritten when it changes. Neither answer exists if the two live in different systems.
What to ask a policy-only vendor
Where do the procedures go. If the answer is attachments, that is a shared drive with better branding, and version history on an attachment is not version history. If the answer is a second product, ask what the two cost together before comparing anything.
Questions people ask about policy software
Is policy software enough on its own?
Rarely. Policies are few and stable; the procedures under them are many and volatile, and that is where the recurring cost sits.
Why does linking them matter?
A procedure that names its policy can answer why it says what it says, and a policy that lists its procedures says what to rewrite when it changes.
What does the volatile half cost?
On the worked example, 48 procedures at one 2.5-hour review each a year is 120 hours and $6,600.