What Project Managers Need to Know About Policy and Procedure

The 12 sections below cover the definitions, the PMBOK® Guide connection, the 7 policy types that shape projects, the project manager’s role, and the PMP exam angle.

What Is the Difference Between a Policy and a Procedure in Project Management?

A policy is a mandatory rule that states what the organization requires and why. A procedure is an ordered set of steps that states who does the work, when, and how. Policies set the boundary, and procedures deliver compliance inside it.

The two documents answer different questions. A policy answers “what” and “why.” A procedure answers “who,” “when,” and “how.” Neither replaces the other.

Take purchasing. The policy: every purchase above the approval limit requires competitive quotes. The procedure: the requester submits the purchase form with a budget code, procurement collects the quotes, and the finance approver signs. The policy never names the form. The procedure never argues the principle.

How Do Standards, Guidelines, and SOPs Relate to Policies and Procedures?

Policies sit at the top of a 5-level documentation hierarchy. Standards set measurable requirements, procedures and SOPs set the steps, work instructions set task-level detail, and templates capture the records. Guidelines advise the team but never mandate an action.

Each level narrows the one above it.

A standard operating procedure (SOP) is a procedure written for a routine, repeatable task. In project work the SOP and the procedure serve the same function: a mandatory sequence of steps. A guideline sits outside the hierarchy. It recommends a practice, and teams adapt it to the project.

Where Do Policies and Procedures Fit Inside the PMBOK Guide?

Policies and procedures are organizational process assets (OPAs) in the PMBOK Guide. OPAs feed most planning processes as inputs. The PMBOK Guide Sixth Edition defines 49 processes in 5 process groups, and OPAs supply the organization-specific rules those processes follow.

The Sixth Edition organizes 49 processes into 5 process groups and 10 knowledge areas. Those processes describe project work in general. They do not carry your organization’s rules for that work. OPAs carry the rules.

The PMBOK Guide defines OPAs as the plans, processes, policies, procedures, and knowledge bases the performing organization owns and uses. OPAs fall into 2 categories:

• Processes and procedures: human resources policies, health and safety policies, ethics policies, project management policies, quality procedures, financial control procedures, change control procedures, and templates.
• Knowledge bases: lessons learned, historical information, completed schedules, risk data, and earned value data.

The project team updates OPAs at closure, when lessons learned enter the knowledge base. Policies and procedures arrive before the project starts. The project manager inherits them.

Which 7 Types of Policies and Procedures Affect Project Managers Most?

Project managers work under 7 recurring policy areas: change control, procurement, risk escalation, quality assurance, status reporting, records and information security, and resource onboarding. Each area maps to a PMBOK knowledge area and produces a procedure the project team follows.

Each row is a document pair: 1 policy and 1 procedure. Pull the pair for every row before baselining the project management plan.

What Is the Role of the Project Manager in Policy and Procedure?

The project manager locates, applies, enforces, and improves policies and procedures. Executives own policy. A policy and procedure manager, PMO, or compliance team owns the document library. The project manager owns compliance inside the project and reports gaps upward.

A policy and procedure manager is a role that sits in compliance, quality, operations, or the PMO. That person maintains the library, runs the review cycle, and tracks staff acknowledgment. The project manager works with this role, not against it.

The project manager holds 4 duties:

• Locate every applicable policy before the project management plan is baselined.
• Apply each procedure to the matching project process.
• Enforce compliance through kickoff briefings, checklists, and spot audits.
• Improve gaps by sending change proposals to the document owner.

Project managers rarely write company-wide policy. They do spot the gaps, because they sit inside the work every day. A procedure gap shows up in 3 signals: recurring rework, a missing approval step, and slow contractor onboarding.

How Does a Project Manager Find and Apply the Right Policies and Procedures?

Ask the PMO and sponsor first, search the document management system second, and read the contract third. Then map every policy found to a project management plan component and log each policy conflict. The full sequence runs 5 steps.

Project policies come from 5 sources: the sponsor or client, the performing organization, the project manager, industry bodies such as PMI, and legal or regulatory authorities. A single project answers to several of them at once.

1. Ask the PMO and the sponsor for the policy library and the governance requirements.
2. Search the intranet, SharePoint, or document management system for each policy area in the 7-type list above.
3. Read the contract and statement of work for client policies and regulatory clauses.
4. Map each policy to a component of the project management plan, such as the change management plan or the communications management plan.
5. Record conflicts between policies in the issue log and escalate them to the sponsor before execution starts.

The guide What is a Project Management Plan? lists the 8 components where each policy lands: scope, schedule, budget, risks, quality, communications, resources, and changes.

What Is the Policy and Procedure Development Process?

The policy and procedure development process runs 7 stages: identify the gap, assign an owner, draft the policy, draft the procedure, review with stakeholders, approve and publish, then monitor and revise. Project managers contribute at stages 1, 4, 5, and 7.

1. Identify the gap. Log the recurring issue, its cost in hours or rework, and the risk it creates.
2. Assign a document owner with approval authority. The owner is a named role, not a committee.
3. Draft the policy statement in 1 paragraph: purpose, scope, requirement, and consequence of non-compliance.
4. Draft the procedure as numbered steps. Give every step a role, an input, and an output.
5. Review both drafts with the people who perform the work, plus legal or compliance.
6. Approve and publish the document with a version number, an effective date, and a training session.
7. Monitor adoption through audits, then revise on a fixed cycle.

The project manager brings gap evidence at stage 1, procedure drafting at stage 4, work-level review at stage 5, and adoption feedback at stage 7.

How Do You Write a Procedure Project Teams Actually Follow?

Write each procedure as numbered steps with one action per step, a named role, and a defined output. Use plain verbs, spell out every acronym, and add a help contact. Test the draft with 3 real users before you release it.

These 5 rules produce a procedure people follow:

• Start every step with a verb.
• Name the role that performs the step.
• State the output the step produces.
• Mark each decision point with its yes and no paths.
• Cite the policy the step enforces, so the team sees the reason.

The change request procedure shows the format. The PMTI guide Understanding the Change Management Process: A Comprehensive Guide documents 7 steps:

The policy behind the table fits in one sentence: no baseline changes without CCB approval. CCB membership varies by organization, and the project manager sits on some boards and not others. The project manager always documents and communicates the board’s decisions.

What Is a Policy and Procedure Management System?

A policy and procedure management system is a central, searchable repository that stores approved documents, controls versions, routes approvals, and records staff acknowledgment. Organizations build it in tools such as SharePoint, Confluence, or dedicated policy management platforms like PolicyTech.

A working system performs 6 functions:

• Store approved documents in one searchable repository.
• Control versions, so only the current release is visible.
• Route drafts through an approval workflow with named approvers.
• Restrict access by role, project, or department.
• Schedule review reminders for each document owner.
• Record acknowledgment and keep an audit trail.

A policy and procedure management program wraps the system in governance: a named owner per document, a 12-month review cycle, and 2 tracked metrics, on-time review rate and acknowledgment completion rate. A policy and procedure management solution combines the system and the program.

Projects feed the library. Register project-specific procedures, such as a communications protocol or a defect triage procedure, with the PMO so they enter the organization’s library at closure.

How Do Policies and Procedures Work in Agile and Hybrid Projects?

Agile and hybrid projects keep policies fixed and adapt procedures. Security, regulatory, and financial policies apply to every sprint and every release. Procedures shrink into lightweight working agreements, a Definition of Done, and approval steps that match the iteration cadence.

Approximately 60% of the July 2026 PMP exam targets agile or hybrid approaches, so this split matters for both delivery and certification. Tailoring changes the procedure. A policy exception needs formal approval.

These 3 examples show tailoring in practice:

• Embed the security scan and the peer review in the Definition of Done. The policy is met every sprint without a separate checklist.
• Replace a long communications procedure with a 1-page working agreement on meeting cadence and channels.
• Run stakeholder approvals at the sprint review instead of a separate approval meeting.

What Happens When a Project Violates a Policy?

A policy violation triggers 3 consequences: audit findings, rework or contract penalties, and lost sponsor trust. The project manager responds in 1 of 3 ways: comply, request a formal exception, or propose a policy change through the document owner.

Regulated sectors raise the stakes. Healthcare projects answer to HIPAA, public companies to the Sarbanes-Oxley Act, and US government contractors to the Federal Acquisition Regulation (FAR). A violation in those settings carries legal penalties on top of project impact.

Handle a deviation in 4 moves:

1. Document the deviation in the issue log the day it surfaces.
2. Notify the sponsor and the policy owner.
3. Submit an exception request that states the impact and the duration.
4. Track the exception to closure and record the outcome in lessons learned.

Why Do Policies and Procedures Matter for the PMP Exam?

The PMP Business Environment domain carries 26% of the exam under the July 9, 2026 outline, and it covers governance and compliance. Scenario questions reward the project manager who follows organizational policy, documents deviations, and escalates conflicts instead of overriding the rule.

Business Environment grew from 8% to 26% in the 2026 update. 3 habits earn the points on scenario questions:

• Check the organizational policy before choosing an action.
• Follow the documented procedure, even when a shortcut saves time.
• Escalate a policy conflict to the sponsor and record the decision.

PMTI prepares candidates for all 3 exam domains through its PMP certification training, delivered by a PMI Premier Authorized Training Partner that has trained 80,000+ professionals since 2003.