Policy vs standard vs SOP: getting the layer right
Before you write anything, know what you’re writing. Four document types cover most IT operations. Each answers a different question. Confusing them — writing a policy when you needed an SOP, or promoting an SOP into a policy because it sounds more serious — produces documents nobody uses and audit findings nobody expected. The four types, in one sentence each Policy — the rule. Answers what is expected, and why. Standard — the requirement that makes the rule measurable. Answers what must be achieved. Procedure (SOP) — the steps. Answers how to do the thing. Work instruction — the granular detail inside a step. Answers exactly how to do that one action. They stack: ...