Case Study: Clear Policies That Drove Efficiency — an IT Governance Program

Policies are supposed to make an organisation faster, not slower: they answer recurring questions once, so people do not have to renegotiate them in every meeting. This engagement started from the opposite situation — a policy library nobody used — and ended with a smaller, clearer set of documents that people actually follow.

The client

A mid-sized financial-services firm whose policy set had grown by accretion: templates bought from consultancies, documents written for past audits, and overlapping standards owned by nobody in particular.

The challenge

The firm was not short of policies — it had too many. Staff could not tell which document was authoritative, exceptions were granted informally, and every audit cycle triggered a scramble to reconcile what the documents said with what teams actually did.

What we did

• Inventoried the full policy estate and retired or merged the redundant documents
• Rewrote the surviving policies in plain language, each with a named owner and a review cycle
• Mapped every policy statement to the controls and evidence that prove it, so audits start from a lookup rather than a hunt
• Introduced a lightweight, recorded exception process — making deviations visible instead of silent
• Set up a governance cadence that reviews changes in hours per quarter, not weeks

The outcome

Audit preparation stopped being a project of its own. Teams reference the policy set because it is short enough to read and specific enough to be useful, and management finally has an accurate picture of where the firm deviates from its own rules — and why.