Policy Development

We help define policies that are useful as well as compliant. Policies fail in three ways. They do not exist, nobody follows them, or they exist, are followed, and lead to poor outcomes anyway. A policy that gives a hiring manager unchecked authority to hire whoever they want, with no accountability to anyone, will be followed faithfully and produce consistently bad results. Hill Dogs Consulting works across all three failure modes.

The most common engagement starts with organizations where good practices exist informally but have never been written down. The goal is formalization that does not alienate the people already doing things right. That means starting from current practice and building toward a more complete and defensible standard, rather than importing an external template and asking people to conform to something foreign. When policies have grown too complex or too ambitious for the organization to follow, we simplify and humanize them without losing their intent.

We have helped startups achieve PCI compliance so they could begin accepting payment information. We have helped large organizations whose policy libraries had become so complex that only auditors could parse them, rewriting from the ground up in language the people subject to those policies could understand and apply. And we have helped companies going through major business model shifts rework their policy landscape as a whole, so new obligations do not overlap or conflict with existing ones.

We work across a broad range of frameworks: NIST, PCI, SOX, HIPAA, GDPR, ITIL, FedRAMP, TX-RAMP, COBIT, and others. Compliance requirements are often the trigger, but corporate culture plays an enormous role in whether policies stick, and we treat that as a design constraint.

Here is a useful distinction between this practice and our Process and Procedures work. Policy defines what will happen, process defines how, and procedure defines the specifics. Take the hiring example. Policy says all candidates will be interviewed. Process says phone screen first, then onsite. Procedure says ask these questions and score with this rubric. The work looks quite different depending on where your need is.