IT Policies, Standards, and Procedures form the backbone of any organisation's governance — they are the rulebook, the measuring stick, and the instruction manual rolled into one. Without them, an IT department would be chaotic, inconsistent, and constantly vulnerable to security breaches. For a CISA candidate, understanding the difference between these three layers is critical because the exam tests your ability to evaluate whether each is properly designed and implemented to meet business objectives.
Jump to a section
A simple way to picture IT Policies, Standards, and Procedures
First, your family decides that the kitchen must stay clean and safe for everyone, so you create a set of general rules that everyone agrees on. This leads to a clear hierarchy of documents that guide how the kitchen actually runs. The 'Policy' is the high-level principle: 'The kitchen must be a clean, safe, and organised space for meal preparation.' It doesn't tell you how to clean, just the overall goal.
Next, 'Standards' are the specific, measurable requirements that support the policy. For example, 'All countertops must be wiped down with disinfectant after every use' and 'All food must be stored in sealed containers within 2 hours of cooking.' These are mandatory benchmarks that everyone must meet. Finally, 'Procedures' are the step-by-step instructions that explain exactly how to meet the standards. A procedure might be: '1. Take out the antibacterial spray. 2. Squirt spray onto a clean cloth. 3. Wipe the entire countertop surface. 4. Let it air dry for 2 minutes.' In an organisation, the IT policy is the top-level commitment (like the family's cleanliness rule), the standard is the mandatory measurement or requirement (like the disinfectant and time limit), and the procedure is the detailed 'how-to' checklist (like the countertop cleaning steps). Without the policy, there is no direction; without the standard, there is no measure of success; and without the procedure, everyone does it differently and the standard is never met.
IT governance is the framework that ensures IT investments support business goals, manage risks, and optimise performance. The three key components of this framework are Policies, Standards, and Procedures. They sit in a hierarchy: Policy is the highest level, Standards are the middle layer, and Procedures are the lowest, most specific layer.
What is an IT Policy? An IT Policy is a high-level, board-approved statement of management intent. It answers the question 'what are we trying to achieve?' A policy is not technical; it is strategic. For example, a 'Data Protection Policy' might state: 'All sensitive customer data must be protected from unauthorised access and disclosure.' It does not say how to protect it — that comes later. Policies are long-lasting and change rarely, only when business strategy or major regulations change. They set the tone from the top, establishing the organisation's position on a given issue. Every employee must comply with policies, though the method of compliance can vary.
What is a Standard? A Standard is a mandatory requirement that supports a policy. It is the 'how good' or 'how much' — a measurable benchmark that everyone must meet. Standards are more specific than policies but less detailed than procedures. For instance, to support the data protection policy, a standard might say: 'All databases containing customer personally identifiable information (PII) must be encrypted using AES-256 encryption.' This standard tells you the algorithm and the type of data, but not the steps to apply the encryption. Standards are often set by external bodies (like ISO 27001 or NIST) and adopted by the organisation. They are mandatory, and non-compliance is a risk that must be formally accepted or remediated.
What is a Procedure? A Procedure is a detailed, step-by-step set of instructions that tells someone exactly what to do to achieve a standard. It is the 'how-to' guide. Procedures are the most changeable of the three, because they adapt to new tools, software versions, or process improvements. Continuing the example, a procedure for the encryption standard might include: - 1. Log into the database server using admin credentials. - 2. Open the Database Configuration Manager. - 3. Navigate to the 'Security' tab. - 4. Select the PII database from the list. - 5. Choose 'Encrypt' and select the AES-256 option. - 6. Confirm the encryption operation. Procedures are critical for consistency — they ensure that every IT employee performs a task the same way, every time, which reduces errors and security gaps.
Why do we need all three? Imagine you are building a house. The policy is the architect's vision ('we will build a warm, safe home'). The standard is the building code ('walls must be 2x4 studs spaced 16 inches on centre, with R-13 insulation'). The procedure is the foreman's instructions ('cut the studs to 92 5/8 inches, nail them at the top and bottom plates, staple the insulation in place'). Without the policy, there is no vision; without the standard, the house might collapse; without the procedure, each worker builds walls differently.
How are they developed? Typically, senior management (like the CIO or board of directors) approves policies. IT managers and security teams then create standards based on industry frameworks and legal requirements. The IT staff who do the actual work write the procedures, often in collaboration with subject matter experts. All three documents must be reviewed regularly — at least annually — and updated when something changes, such as a new version of software or a change in regulations like GDPR.
What is the relationship to governance? Policies, Standards, and Procedures are the core of IT governance. They ensure that IT activities are aligned with business goals, that risks are managed, and that resources are used efficiently. The CISA exam will ask you to evaluate whether these documents are present, appropriate, and followed. You need to know that policies are approved by top management, standards are mandatory benchmarks, and procedures are detailed work instructions.
Identify the need for a new policy or standard
A need arises from a new regulation (e.g., GDPR), a security incident, a business strategy change, or an audit finding. The organisation recognises that a gap exists in its current governance documents. This step is critical because it triggers the entire lifecycle.
Draft the document
The IT governance team or a subject matter expert drafts the policy, standard, or procedure. For a policy, they write high-level statements. For a standard, they define specific, measurable requirements. For a procedure, they write step-by-step instructions with screen captures if needed. The draft must align with the organisation's existing framework (e.g., COBIT).
Review and approve the document
The draft is circulated for review by stakeholders (legal, security, operations). Comments are incorporated. Then the document is sent for formal approval: senior management for policies, IT management for standards, and operational managers for procedures. Approval must be documented in meeting minutes or a signature page.
Communicate and train staff
Once approved, the document is published (e.g., on an intranet or document management system). All affected staff must be informed of the new or updated document. For significant changes, training sessions are held. This step ensures that awareness and understanding are achieved, which is essential for compliance.
Monitor compliance and enforce
The organisation must regularly check that staff are following the policy, standard, and procedure. This can be done through internal audits, automated system checks (e.g., verifying encryption settings), or management reviews. Non-compliance must be addressed through corrective action or formal risk acceptance.
Review and update regularly
At least annually, or after a major change (new software, new law), the governance team reviews each document. They assess whether it is still relevant, accurate, and effective. If not, they update it, restarting the cycle from the draft step. This ensures continuous improvement and ongoing alignment with business needs.
Let us walk through a realistic scenario at a medium-sized company called 'FinServe Ltd', a financial services firm regulated by the UK's Financial Conduct Authority (FCA). The company stores customer bank account details and transaction histories. An IT auditor is assigned to evaluate the design and implementation of the organisation's IT policies, standards, and procedures.
Step 1: The auditor starts by requesting the Information Security Policy. This is a high-level document signed by the CEO. It states: 'FinServe Ltd will protect the confidentiality, integrity, and availability of customer financial data in compliance with all applicable laws and regulations.' This is the policy. The auditor checks that it is approved by the board and is current (not more than 12 months old). This checks the 'design' part of the audit — is the document well-structured and authorised?
Step 2: The auditor then looks for supporting Standards. The company has adopted the ISO 27001 standard and has created its own internal standards based on it. For example, Standard IT-SEC-007 states: 'All customer data at rest must be encrypted using AES-256. All transmissions of customer data must use TLS 1.2 or higher.' The auditor checks that these standards are documented, that they clearly link back to the policy (they mention 'customer data'), and that they are measurable. The auditor also checks that the standards are mandatory and that there is a formal process for granting exceptions (called a risk acceptance).
Step 3: Next, the auditor reviews Procedures. He asks the database administrator for the 'Procedure for encrypting customer databases'. The procedure is a 10-page document that includes screenshots, command-line scripts, and step-by-step instructions. The auditor checks that the procedure is version-controlled, that it matches the current software version (SQL Server 2022), and that the database administrator follows it exactly.
What does the auditor actually look for in practice? - Does the policy exist, is it approved by senior management, and is it up to date? - Do the standards exist for each policy area, and are they linked to a recognised framework (e.g., ISO 27001, NIST, COBIT)? - Do the procedures actually match what staff do in reality? (This is called a 'walk-through' test.) - Are there any gaps — for example, the policy says 'protect customer data' but there is no standard for encryption of data in transit? - Are exceptions to standards properly documented and approved? - Are procedures reviewed at least annually?
The auditor's final report might highlight that the policy is fine, but the standards are missing for remote access, and the procedures for patch management are outdated. The report will recommend that the organisation update its standards to cover remote access (adding a new standard, for example, 'Remote connections must use a VPN with MFA') and rewrite the patch management procedure to reflect the current tool (Microsoft SCCM instead of manual patching).
The CISA exam tests your ability to evaluate the design and implementation of IT policies, standards, and procedures. This is not about memorising definitions — it is about applying them to scenarios. Here is exactly what you need to know.
First, the exam loves to test the hierarchy and ownership. The classic question is: 'Who must approve an IT policy?' The answer is always senior management (board of directors, CEO, or equivalent). Standards are approved by IT management (e.g., IT director, CISO). Procedures are approved by operational managers (e.g., IT team lead). The exam will try to trick you by suggesting that IT staff approve policies. Never fall for it.
Second, the exam tests the difference between policies, standards, and procedures. A common question: 'Which document provides the most detailed instructions?' Answer: Procedures. 'Which document is the highest-level?' Answer: Policy. They may present a scenario where an employee is unsure how to perform a task — the right answer is to refer to the procedure, not the policy.
Third, the exam focuses on the life cycle of these documents. You need to know that they should be reviewed at least annually, or when significant changes occur (e.g., new regulation, new system, merger). The exam might ask: 'When should a procedure be updated?' The answer includes 'when the underlying system or process changes' and 'at least once a year.'
Fourth, the exam tests your knowledge of frameworks. COBIT (Control Objectives for Information and Related Technologies) is directly mentioned in the exam. The CISA exam expects you to know that COBIT provides a framework for governance and management of enterprise IT, and that it directly relates to the design of policies and standards. You do not need to memorise COBIT's details, but you need to recognise that it is a best-practice framework.
Fifth, the exam tests non-compliance handling. If a standard is not being followed, the organisation must either enforce compliance or formally accept the risk (documented by management). The exam will test that the acceptance must be documented and approved by the appropriate level of management.
Finally, the exam tests the concept of 'tone at the top'. If policies are not enforced by senior management, they are meaningless. The exam will ask: 'What is the most important factor in ensuring compliance with IT policies?' The answer is management support and enforcement.
Common traps:
Mixing up who approves what (senior management vs. IT management vs. operational staff).
Confusing a standard (a mandatory benchmark) with a guideline (a suggestion). Standards are mandatory; guidelines are optional. The exam will explicitly test this.
Thinking that a procedure is the same as a policy. Know the difference: policy is 'what', procedure is 'how'.
Forgetting that procedures must be documented, not just known by the staff. If a procedure is not written down, it does not exist from an audit perspective.
To memorise easily: Policy = high-level direction (board approved). Standard = mandatory benchmark (IT management approved). Procedure = step-by-step instructions (operational manager approved).
An IT Policy is a high-level, board-approved statement of management intent that sets the overall direction for a specific area (e.g., data protection, security).
A Standard is a mandatory, measurable requirement that supports a policy and must be complied with, often based on external frameworks like ISO 27001 or NIST.
A Procedure is a detailed, step-by-step set of instructions that tells staff exactly how to perform a specific task to meet the standard.
Policies must be approved by senior management (CEO or board), standards by IT management, and procedures by operational managers.
All three types of documents must be reviewed at least annually, or whenever a significant change occurs, to remain current and effective.
Non-compliance with a standard must be formally accepted as a risk by the appropriate level of management, or the deficiency must be remediated.
COBIT is a widely used governance framework that directly informs the design of IT policies and standards, and is specifically tested in the CISA exam.
Procedures must be documented, version-controlled, and actually followed by staff; otherwise, they are not auditable or effective.
These come up on the exam all the time. Here's how to tell them apart.
Policy
High-level statement of management intent
Approved by senior management (board/CEO)
Answers 'what are we trying to achieve?'
Standard
Specific, measurable mandatory requirement
Approved by IT management (IT director/CISO)
Answers 'how good must it be?' (e.g., encryption algorithm)
Standard
Mandatory benchmark (e.g., password length of 12 chars)
Does not include step-by-step instructions
Often based on external frameworks (ISO, NIST)
Procedure
Step-by-step work instructions
Includes commands, screen captures, exact steps
Changes frequently (with new software versions)
Policy
Long-lasting, rarely changes
Approved by senior management
Sets the overall direction and principles
Procedure
Frequent updates, tied to specific tools and processes
Approved by operational manager
Details the exact tasks to perform
Guideline
Optional recommendation
Not mandatory to follow
Suggests best practice but allows flexibility
Standard
Mandatory requirement
Must be complied with or risk formally accepted
Defines the minimum acceptable level
Mistake
Policies, standards, and procedures are all the same thing, just with different names.
Correct
They are distinctly different layers. A policy sets the overall direction, a standard defines the mandatory requirements, and a procedure provides the specific steps to achieve compliance.
People often use the terms interchangeably in casual conversation, but in an audit context, the difference is critical. The CISA exam will exploit this confusion by mixing them up in scenarios.
Mistake
IT staff can create and approve policies on their own.
Correct
Policies must be approved by senior management (board of directors or CEO) because they set the organisation's overall direction and commit the organisation to a stance. IT staff can draft them, but only top management can approve them.
In small companies, IT staff often write 'policies' themselves, leading to the mistaken belief that this is the norm. But in a properly governed organisation, top-level approval is required for authority and enforceability.
Mistake
Once a policy or standard is written, it does not need to be updated unless something goes wrong.
Correct
All IT policies, standards, and procedures should be reviewed and updated at least annually, or whenever significant changes occur (new regulations, new technology, major process changes).
People often treat these documents as 'set and forget'. But the exam tests the concept of continuous improvement. Standards change, software updates, and regulatory requirements evolve, so documents must stay current.
Mistake
A procedure is optional; staff can use their own judgment if they know a better way.
Correct
Procedures are mandatory work instructions in a controlled environment. If staff deviate, it creates inconsistency and risk. Any deviation must be formally approved through a change control process.
In some organisations, procedures are treated as 'guidelines' rather than strict rules. In a regulated environment (like finance or healthcare), following the procedure exactly is often a legal requirement, so auditors expect strict adherence.
Mistake
If a standard is outdated, it is better to ignore it than to update it.
Correct
An outdated standard is still the official requirement until it is formally updated or retired. Ignoring it creates non-compliance and risk. The correct action is to flag it for review and get it updated through the formal process.
People avoid paperwork and think 'just do the right thing' is enough. But audit relies on evidence of compliance to the documented standard, not on what staff think is correct. This is a common trap in CISA questions.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A policy is a high-level statement of intent approved by senior management (e.g., 'We will protect customer data'). A standard is a mandatory, specific requirement that supports that policy (e.g., 'All customer data must be encrypted with AES-256'). Policy says 'what', standard says 'how good'.
IT policies must be approved by senior management — typically the board of directors, the CEO, or an equivalent top-level governing body. This gives the policy authority across the entire organisation.
No, procedures are mandatory work instructions. In an audit, if a procedure exists, staff must follow it exactly. Any deviation is considered non-compliance unless formally approved through a change control process.
IT policies should be reviewed at least annually, or whenever a significant change occurs, such as a new regulation, a major technology upgrade, or a change in business strategy. The review ensures the policy remains relevant and effective.
COBIT (Control Objectives for Information and Related Technologies) is a governance framework published by ISACA. It provides best-practice guidelines for designing and implementing IT policies and standards. The CISA exam expects you to know that COBIT is often used as the basis for an organisation's governance framework.
No. A standard defines a mandatory requirement or benchmark (e.g., 'password must be 12 characters'), while a procedure provides the step-by-step instructions to implement that requirement (e.g., 'go to Control Panel > User Accounts > Change Password'). They serve different purposes and are written at different levels of detail.
You've finished IT Policies, Standards, and Procedures. Continue through the CISA study guide to build a complete picture of the exam.
Done with this chapter?