Policies and Procedures

20.3 – Policies and Procedures (Rev. 308, Issued: 10-26-18 Effective: 09- 01- 18, Implementation: 11-27-18) Policies and procedures are a set of established guidelines or rules for conducting the affairs of a business. Good policies: • Are written in clear, concise, and simple language. They are updated as necessary, signed and dated. • Address what the guideline or rule is; not how to implement the guideline or rule. • Are readily available and properly communicated to staff. Procedures are a set of steps in a plan intended to influence and determine decisions and actions. Good procedures are tied to policies and: • Are written in clear, concise, and simple language. • Are tied to the policy. • Are developed and implemented with the user in mind. • Are readily available and properly communicated to staff. Contractors shall have written policies and procedures to achieve their control objectives. These policies and procedures shall be updated in a timely manner to reflect changes in CMS instructions or your internal operations. Contractors shall demonstrate and document that its policies and procedures are actually being used as designed and are effectively and efficiently meeting the control objective, as described in Section 50. Evaluation and testing of the effectiveness of controls are important in determining if the major areas of risk have been properly mitigated. An example of a policy is, “an agency shall establish physical control to secure and safeguard vulnerable assets”. The specific control activities, or procedures, which support this policy may include: all doors to the facility have locks, the locks only have one key, all keys are held by security guards, security guards are stationed at every door. End Section 20.3 – Policies and Procedures: Back to Table of Contents