251-217-9733
Policy Development
A policy you do not follow is worse than a policy you never wrote.
Why Policies Cut Both Ways
Policy development is the drafting of the internal rules a business runs on (standard operating procedures, codes of conduct, communications and social media policy, record retention, and increasingly the rules governing how employees may use artificial intelligence).
There is a trap in this that catches businesses regularly. Writing a policy creates a standard you can be held to. A company with no written escalation procedure is judged against what a reasonable business would do. A company with a written escalation procedure it did not follow is judged against its own document, read back to it.
Which means the goal is not more policies. It is the right policies, written so the people who have to follow them realistically can, and reviewed when the practice changes.
What We Handle
Standard operating procedures
The documented process for work that has to happen the same way every time, and the ones where variation is the actual risk.
Codes of conduct
Expectations for behavior, conflicts of interest, gifts, and reporting, including how a complaint is supposed to travel.
Communications policy
Who speaks for the company, through which channels, and what happens when someone speaks anyway.
Social media policy
What employees may and may not post about the business, drafted within the limits of what an employer can lawfully restrict.
AI use policy
What employees may put into an AI tool, what they may do with the output, and where the hard lines are.
Record retention
What to keep, for how long, and (just as importantly) what to dispose of, and how.
Legal hold procedures
The process for suspending deletion when litigation is reasonably anticipated. Getting this wrong is its own claim.
Policy audits
Reviewing what you already have against what you actually do, which is where most of the exposure sits.
Sound familiar?
How We Approach It
Start from what you actually do
A policy written from a template describes a company that does not exist. We start by understanding the real process, then decide what should be written down and what should change first.
Write for the reader
The person who has to follow a policy is usually not a lawyer and will not read three pages. If it cannot be understood and remembered, it will not be followed, and an unfollowed policy is a liability.
Review when the practice changes
Do not update policies as an annual ritual. Update them when the business changes. A new tool, a new location, a new service line, or a new regulator all mean the policy set is now out of date.
Who Does This Work
Jordan W Gerheim
Policy development, SOPs, and codes of conduct as outside chief legal counsel, and the litigation experience to know which policies get read back to a company later.
Terri Sharpley Reynolds
Governance, fiscal accountability, and operational policy for nonprofits, public agencies, and grant-funded organizations.
Your Employees Are Already Using AI. Do You Have a Policy?
Most businesses answer no, and most of those have employees using AI tools daily. The gap between those two facts is where the problem sits.
Approved tools
Which tools are permitted, and whether a business or enterprise account is required rather than a personal one.
What may not be entered
Client confidential information, personal data, trade secrets, and anything under a confidentiality obligation.
Review before use
Output is a draft. Who checks it, and against what, before it goes to a client or into a decision.
Disclosure
When AI involvement must be disclosed, to clients, to counterparties, or internally.
Accountability
That the person using the tool remains responsible for the result. This is the sentence that does the most work.
How This Work Is Billed
Want a number for your situation?
Related Services
Frequently Asked Questions
Is a policy legally binding on us?
Often, yes (more than businesses expect). Courts and agencies routinely treat a written policy as the standard the company set for itself, which means failing to follow your own procedure can be used against you even where no law required the procedure in the first place. That is not an argument for having no policies. It is an argument for having ones you actually follow.
What is the difference between a policy and an SOP?
A policy states what the company requires and why. A standard operating procedure states how it is done, step by step. Policies tend to be about risk and expectation; SOPs are about consistency and quality. Most businesses have a few of the first and almost none of the second written down.
Can we just use templates?
As a starting point, sometimes. As a finished product, rarely, because a template describes a generic business and you will be judged against what your document says rather than what a template meant. The most common failure we see is a downloaded policy set describing processes the company has never operated.
What is a legal hold and when do we need one?
It is the instruction to suspend routine deletion of documents and communications because litigation is reasonably anticipated. It is triggered earlier than most businesses assume, often before anything is filed. Getting it wrong can produce a spoliation claim that is worse than the underlying dispute, and it is one of the few areas where a documented process genuinely protects you.
How does this differ from our employee handbook?
The handbook governs the employment relationship (conduct, leave, discipline, benefits) and sits under Employment & Workforce Management. Policy development here covers the operational layer: how the work gets done, how the company communicates, what gets retained, and how tools like AI may be used. They overlap and should be drafted so they agree with each other.
Related Insights
Write the Rules Before You Need Them
Book a Risk-Free Strategy Session. Tell us what your business actually does and we will tell you which policies are worth having.