Writing Clear Policies and Procedures

Many thought leaders emphasize driving transformations through the lens of people, which I wholeheartedly agree with. People remain the heart of how an organization operates. How do we achieve this? One often overlooked aspect is high-quality procedure documentation.   Procedures are detailed instructions for completing tasks. They are crucial because they: - Improve productivity by eliminating the need to decipher unclear documentation - Break down silos, enhancing team collaboration - Facilitate scalability and growth by simplifying onboarding of new employees - Are the key to consistent and great customer experiences - Manage risks and ensure regulatory compliance - Foster problem-solving and continuous improvement   I’ve seen many organizations struggle with maintaining quality procedure documentation. In one of my consulting projects, we cleaned up a disorganized repository that was a massive pain point for the company.   What’s the key to success? Defining a consistent structure aligned with the business context. The best practice is to organize procedure documentation according to your complete inventory of processes using the Process Inventory framework. This approach offers several benefits: - Scope Definition: Clearly defined boundaries ensure no overlaps in documentation. - Ownership: Assigning a Process Owner for each process ensures accountability for creating and maintaining high-quality documentation. - Employee Alignment: Provides clarity on which employees execute processes, making it easier to close knowledge gaps. - Risk Management Alignment: Helps the risk organization verify that procedures provide the right risk and compliance controls.   This is only possible if an organization inventories every process they perform through the Process Inventory framework. To learn more about this framework, check out my book 'Digital Transformation Success' https://a.co/d/bmYf0oG   #Transformation #PeopleFirst. #ProcessInventory #BusinessScalability #ContinuousImprovement

Most legal disasters don’t start with fraud. They start with silence. A regulator opens your website. • They don’t see a license. • They don’t see how you handle data. • They don’t see what you actually do. When that happens, they assume the worst. I see this with Fintech founders all the time. You think “it’s obvious.” But if it’s not written, it’s not obvious. Big problems don’t explode overnight. They build slowly from unspoken assumptions: • One side thinks one thing. • The other assumes another. • No one checks. No one clarifies. Then - boom. If you want to avoid that boom, communicate. Not once. Not casually. Clearly. Consistently. In writing. Here’s a tight disclosure checklist I suggest every Fintech should follow: 1/ Website landing page - must-show items • Company name, CIN, registered address, contact, grievance officer • Clear regulatory status and license numbers (RBI / SEBI / IRDAI if applicable) • Short plain-language description of your business model 2/ Terms & Conditions - role and risk clarity • Exactly what service you provide and what you don't • Who does what in the transaction chain (platform vs principal) • Data use, liability limits, force majeure, and continuity plans 3/ Privacy policy - data controls you can actually prove • What data you collect, why, retention, deletion rules • Consent mechanisms and user rights under DPDP 2023 • Breach notification procedure and timelines 4/ Product disclosures - customer-facing clarity • KFS and APR for lending (per RBI formats) • Fees, penalties, and party roles for origination and servicing • Risk statements and suitability notes for investment products 5/ Partnership disclosures - who does what, exactly • Full list of LSPs/payment partners and their functional roles • Fund-flow and settlement mechanics, escrow if used 6/ Grievance redressal - easy, visible routes • Grievance officer contact, escalation matrix, tracking link • Links to RBI ombudsman/CMS and other regulatory complaint channels 7/ Operations & resilience - prove you can run safely • Financial summaries (where required), business continuity, and cyber incident response • Third-party risk management and periodic reviews Common mistakes that invite scrutiny - avoid these: • Vague service descriptions • Missing or buried license disclosures • Copy-paste privacy policies that don’t match practice • Hidden fees or unclear partner roles • Weak or missing grievance channels The bottom line: transparency is not optional in Fintech. If regulators can’t find clear information, they assume non-compliance. Make your compliance visible. Make your risks plain. Make your communications consistent. Reply with "Fintech” and I'll share a short checklist to help fintech teams spot red flags. --- ✍ Share with everyone below: What’s the biggest gap you see on fintech websites today - Licensing / Privacy / Disclosures?

📢 "Our QMS should serve us, not the other way around!" 📢 This was a key message in our All Hands Meeting yesterday as we kicked off a company-wide initiative to revitalise our processes. As an ISO 13485 certified manufacturer, we know robust processes are vital in meeting quality objectives - but they need to work for the teams using them. Otherwise the fundamental purpose of a QMS - a set of processes and procedures that ensure a business consistently meets customer requirements and delivers quality products and services - is undermined. ❤️ I might have pushed the boat out a little too far when I suggested that it might even be possible to love an SOP but we live in hope. ⚠️ Here are 5️⃣ warning signs your SOPs might need a refresh (and how to fix them): 1️⃣ The "Optional" Perception When teams view SOPs as optional guidelines rather than essential tools, it often signals a disconnect between process and purpose. Make the link explicit between SOPs and quality outcomes. Attaching meaningful metrics to SOPs can further strengthen this link - does the SOP do what it’s meant to do? 2️⃣ The Knowledge Gap If your team doesn't know SOPs exist or where to find them, centralisation is key. In SaMD development, tribal knowledge isn't enough - we need consistent, accessible, controlled documentation. 3️⃣ The Utility Problem SOPs should be written by and for the people doing the work. In SaMD development, this means ensuring procedures reflect actual workflows while meeting regulatory requirements. A good test for whether a process is useful: does anyone want to own it?! 4️⃣ The Trust Issue  Outdated or incorrect SOPs erode confidence. Create clear paths for updates and feedback - quality systems should evolve with processes. 5️⃣ The Perfectionist Trap An SOP needs to be practical yet comprehensive - a difficult balance to strike! Too much can be as problematic as too little. Make SOPs skimmable with clear checklists for validation. 🎯 The goal isn't bureaucracy - it's enabling consistent, high-quality outputs while meeting regulatory requirements. An effective QMS should feel like a helpful framework rather than a constraining box. 💡 Consider providing TL;DRs for each SOP. Make it clear when an SOP applies and when it doesn’t, not too dissimilar to indications for use. Cater for different types of information absorption: written, graphics, audio and, dare I say it, videos. What's your experience? How do you balance regulatory compliance with practical usability in your SOPs?

🛡️ Security Policies Don’t Kill Innovation—Your Lack of Them Kills Your Business In 2023, a SaaS startup lost a $5M client deal after failing SOC 2 compliance. Their “flexible” policy allowed devs to skip encryption for “speed.” The buyer’s audit found 14 critical gaps. Lesson: Policies aren’t bureaucracy—they’re your sales pitch. —————— 📜 Why Policies = Survival HIPAA fines average $1.5M per violation. A single unencrypted patient record in AWS S3 can bankrupt you. 81% of enterprises now require vendors to prove NIST compliance before signing contracts (Deloitte 2024). GDPR’s “right to audit” clause means your Slack DMs aren’t as private as you think. —————— 💡 Innovate Within Guardrails Critics claim policies limit creativity. Tell that to: Stripe: Their security policy mandates FIDO2 keys for all engineers. Devs built a seamless onboarding tool that cut setup time by 70%. NASA: JPL’s strict access controls didn’t stop them from coding Mars rovers. Truth: Hackers don’t care about your “innovation.” They exploit weak passwords and misconfigured buckets. —————— 🔧 Actionable Policy Hacks 1️⃣ Write Policies Devs Actually Read Ditch 50-page PDFs. Use Notion templates with embedded checklists and GIFs. Reward teams for finding policy loopholes (yes, really). 2️⃣ Automate Compliance Tools like Vanta auto-generate audit reports. AWS Config rules enforce encryption, logging, and access controls. 3️⃣ Test Like the Enemy Run quarterly “Policy Stress Tests”: Hire ethical hackers to breach your own rules. Fix failures publicly. Shopify shares post-mortems company-wide. —————— 💥 When Policies Backfire A fintech forced 30-character passwords + 90-day rotations. Result: 62% of employees reused passwords across tools. Fix: Swap complexity for phishing-resistant MFA (WebAuthn, passkeys). Would you rather lose a week writing policies or a year recovering from a breach? #CyberSecurity #Compliance #InfoSec #TechLeadership #GDPR

An editor at The Atlantic was accidentally added to a high-level Signal group chat where Trump administration officials were planning military strikes in Yemen. Yes, you read that right. A journalist, in a chat with top government officials, while they were actively discussing where and when to launch missiles. It's an appalling breach of national security. It’s also a teachable moment for employers. If the highest of federal officials can accidentally include a reporter in a thread outlining imminent military action, your company's employees can accidentally include the wrong person in a message about a client, a deal, a product launch, or a sensitive HR issue. This is your reminder to: ‣ Audit your internal communication tools. Who has access to what, and why? ‣ Train employees to think before they type. Not everything needs to be shared via chat, and definitely not in group messages with unclear boundaries. ‣ Define acceptable platforms. Personal WhatsApp groups aren't secure. Neither are random Slack DMs or rogue Teams channels. ‣ Limit use of informal tools for formal business. If it needs to be preserved, secured, or privileged, it shouldn't live in a disappearing message or outside of your network. And if you don't already have a digital communication policy, here are a few essentials: 1. Specify approved platforms for internal and external comms. 2. Define levels of confidentiality and how/where each type of info can be shared. 3. Address personal device usage (BYOD) and security requirements. 4. Outline consequences for noncompliance. 5. Make it real. Don't just write the policy—train on it, talk about it, and revisit it regularly. Because in today's digital world, one accidental message could be all it takes to destroy trade secret protections, create legal liability, or land your company on the front page.

🔥 7 Common Drafting Mistakes Lawyers Make (and How to Avoid Them) + Practical Tips for Limiting Key Clauses to Protect Your Client Drafting is an art—and even seasoned lawyers can fall into common traps. Here’s a breakdown of frequent mistakes and practical ways to avoid overly broad clauses that might expose your client to unnecessary risk: 🔑 1. Termination Clauses: Termination rights shouldn’t be a free-for-all. Define clear, objective triggers—like "material breach" or "failure to meet payment obligations within 15 days of notice." Stay away from vague phrases like “for convenience” unless that’s intentional. And always specify notice periods and cure rights to keep things fair. 🔑 2. Indemnity Clauses: Indemnities can become a liability nightmare if you’re not careful. Narrow the scope to specific risks—like third-party claims directly arising from the other party’s gross negligence. Avoid blanket phrases like "any and all losses" unless you really mean it (and your client is comfortable with the exposure). Caps on liability and exclusions for consequential damages are must-haves. 🔑 3. Confidentiality Clauses: A strong NDA doesn’t mean throwing in the kitchen sink. Define “Confidential Information” carefully—exclude information that’s public or independently developed. Make sure the confidentiality period is reasonable (2-3 years is standard) and allow necessary disclosures, like sharing info with legal or financial advisors. 🔑 4. Governing Law & Jurisdiction: It’s tempting to default to your local jurisdiction, but think strategically. Choose a venue that’s favorable—and practical—for your client. Be explicit about whether it applies to procedural matters, and clarify if disputes go through litigation, arbitration, or mediation. 🔑 5. Force Majeure Clauses: Not every inconvenience counts as force majeure. Clearly list covered events—natural disasters, pandemics, government actions—and exclude foreseeable risks. Require prompt notice (e.g., within 10 days) and set a limit on how long performance can be excused. 🔑 6. Payment Terms: "Payment due upon receipt" sounds clear, but it’s open to interpretation. Spell out the due date (e.g., "net 30 days from invoice receipt"), acceptable methods of payment, and consequences for late payments. Including interest rates for delays can encourage timely compliance. 🔑 7. Dispute Resolution Clauses: Don’t just insert "arbitration" because it sounds sophisticated. Consider the cost, enforceability, and speed of resolution. If you choose arbitration, name the institution (like ICC or LCIA), location, and number of arbitrators. And don’t forget timelines—open-ended dispute processes rarely benefit your client.

The first procedure I ever wrote? Unreadable. Unusable. Unforgivable. It was too long, unclear, not aligned with other SOPs, and impossible to follow. Inadequate SOPs often appear in 483s and Warning Letters (according to FDA). Not because they’re missing. But because they’re misunderstood on the page. An SOP gives direction. It sets the actions, in the context of a process. So how do you write one that works? → Start from the user’s perspective. If it’s not usable, it won’t be used. → Include the why, how, and what. → Use active voice. Keep it precise. Step-by-step. → Treat “may,” “must,” and “should” with intent. Each one changes meaning. → Keep the structure sharp: header, purpose, scope, related docs, definitions, roles, procedure, appendices, revision history, signatures. → Track versions. Test for understanding. → Only write a procedure when there’s something concrete to explain. A weak SOP causes confusion. It breaks flow. It adds noise. And it spreads doubt. A good SOP sets the tone. It informs. It guides. And it works. Here are some resources that will help me improve over time:  📌 A Basic Guide to Writing Effective Standard Operating Procedures (SOPs) : https://lnkd.in/edncHXeN 📌 What is plain language? https://lnkd.in/eK8nQp_M 📌ISO 24495-1:2023 📌 Write it right (a must read) 📌Technical Writing 101 📌On Writing Well

Restaurant brands should take this page out of Amazon’s playbook: Focus on the guest, not your competition. In an early shareholder letter, Jeff Bezos said, "We're not competitor obsessed; we're customer obsessed. We start with what the customer needs, and we work backwards." Amazon’s public pledge was, and still is, to be the most customer-centric company on the planet. Here’s how restaurants can apply this principle: Culture: Great restaurants race ahead of the pack when they treat their employees like internal guests. Great hospitality starts with the person providing it. Menus: Using feedback data, find the intersection between what guests crave and what’s good for your business. Details: Information about guest preferences and previous orders can drive personalization at scale, whether you’re 5 or 500 locations strong. A great example of this in motion: Sonny's BBQ has been putting the guest first since 1968. Throughout their 90+ locations around the Southeast, their fans, the ‘Q Crew, come for the BBQ and stay for the hospitality. It’s also not unusual to see stories of employees with decades-long tenures at Sonny’s. The brand’s long-standing guest-centered foundation is amplified by a tech stack that gives them a deeper understanding of their guest base and a data-driven approach to their business. From BBQ pit to plate, the guest is at the center of it all. I’m curious, what does your brand do to stay guest-focused? Let’s talk about it ⬇️

Dear gentle reader, have you considered that former employees might hold your organization accountable for breaching data protection laws? In today’s edition of Data Protection Whispers, we delve into the recent determination by the Office of the Data Protection Commissioner (ODPC) regarding an employer’s liability for data breaches caused by former employees. This case highlights how the unauthorized access and disclosure of personal data even after employment ends can expose organizations to significant liability and enforcement actions. In a this determination, a complainant reported receiving calls, messages, and emails from former employees of a bank who offered assistance with renewing her vehicle insurance. The complainant stated that her personal data had been shared with the bank when she sought vehicle financing and to facilitate annual insurance renewals. In its defense, the bank argued that since the individuals who contacted the complainant were no longer employed there, they no longer had access to data maintained by the bank. The Data Commissioner determined that the unauthorized access and disclosure of the complainant's data constituted a personal data breach under the Data Protection Act, 2019 (DPA). Furthermore, the bank failed to report the breach as required under the DPA, resulting in an order to compensate the complainant with Ksh 250,000 and an enforcement notice issued against the bank. From the holding of the data commissioner, it is evident that organizations must take proactive steps to mitigate privacy risks. This includes implementing mechanisms that ensure the confidentiality and integrity of personal data is maintained. Here are some actions you can take. 📌Implement strong access controls. Ensure that only current employees have access to customer data and that access is immediately revoked upon an employee’s departure. Regularly audit access permissions to detect and correct any unauthorized access. 📌Establish comprehensive offboarding procedures. Develop a clear process for terminating access to sensitive data during employee offboarding. This may include disabling logins, retrieving devices, and updating passwords to prevent former employees from accessing company data. 📌Review and revise employee contracts with data protection clauses. Update employee contracts to include data protection clauses that survive employment termination. Specify consequences for breaches of this clause, along with adherence to the organization’s data protection policies, to reinforce the seriousness of data privacy obligations. 📌Implement proper data classification and data sharing protocols. Classify data based on sensitivity and establish clear protocols to prevent unauthorized disclosure, including restrictions on transferring or copying data to personal devices. #dataprivacy #dataprotection #compliance

Legal help feels costly until the day it saves you.  Too many founders delay bringing in a GC because they’re “not big enough yet.” Then an agreement, a dispute, or a missed clause forces the issue on the worst possible timeline.  That’s exactly why I built GC for a Day.  One focused sprint to surface the risks, fix what we can in the room, and leave you with a clear, prioritized roadmap.  Here’s how it works and why teams love it: Before we meet, you complete a short pre-visit questionnaire so I walk in with a prior understanding, with context on your team, agreements, and current pain points.  We then spend a half or full day together walking through your docs:  - Operating agreements - Employment and contractor paperwork - Handbooks - NDAs - MSAs - Vendor contracts - IP and data terms - Insurance basics. It won’t be a lecture full of legal jargon. We work the list in real time, marking up clauses, clarifying authority, fixing fuzzy language, and making decisions in the room.  Where it makes sense, I’ll rewrite key sections on the spot so you leave with “done,” not just “to do.” We also map roles and approvals so everyone knows who decides what, and when.  I translate the legal into plain English so your leaders understand the “why,” not just the “what.”  By the end of the day, you get a prioritized roadmap:  Green/yellow/red risks, owners, deadlines, and quick wins that reduce exposure immediately.  You’ll also receive updated or annotated versions of your most-used agreements plus a short debrief video for your leadership team.  The goal is momentum and peace of mind through cleaner contracts, clearer lanes, fewer surprises in diligence or disputes.  The program is built for founder-led companies that grew faster than their guardrails and want practical guardrails without red tape.  If you’ve been wincing at contractor classifications, IP ownership, privacy terms, or partner docs, this is your reset button.  Think of it as borrowing a steady-handed general counsel (legal plus business judgment) for one focused sprint.  You leave with clarity you can feel and a plan you can execute.