Morgan Compliance Group
Policy vs Procedure vs Work Instruction: What├ö├Â┬úÔö£├é├ö├Â┬úÔö£┬║├ö├Â┬úÔö£Ôòùs the Difference?
A policy states an organisation├ö├Â┬úÔö£├é├ö├Â┬úÔö£┬║├ö├Â┬úÔö£Ôòùs overall intentions and commitments. A procedure explains how a process operates, including responsibilities and stages. A work instruction provides detailed task-level directions for the person doing the work. The right level of detail depends on the business, the activity and the level of risk; not every activity needs all three.
Book a Free ConsultationReviewed by Daniel Morgan, TechIOSH - Last reviewed 2026-09-24
A policy answers the question ├ö├Â┬úÔö£├é├ö├Â┬úÔö£┬║£what does this business commit to?├ö├Â┬úÔö£├é├ö├Â┬úÔö£┬║├ö├Â┬úÔö£ÔöÉ rather than describing how that commitment is delivered day to day. It is typically short, high-level, and reviewed periodically rather than for every operational change.
A procedure sits below the policy and describes a process in enough detail that someone unfamiliar with it could understand who does what, in what order, and what records the process produces. Procedures are where accountability and sequence live.
A work instruction is the most detailed level, focused on a single task, and is most valuable where precise, repeatable steps genuinely matter - operating a specific piece of equipment, carrying out a specific inspection, or following a specific safety-critical sequence.
Proportionality is the key principle across all three levels. A small business with simple, low-risk activities may only need policies and procedures, while a business with more complex or higher-risk operations benefits from detailed work instructions as well. Documentation that exceeds what a business genuinely needs becomes a burden rather than a control.
A frequent, avoidable mistake is writing detailed work instructions without involving the people who actually do the task. A work instruction written from a desk, without input from the person carrying out the work, often does not reflect how the task is genuinely performed, and is quietly ignored in practice as a result.
Frequently asked questions
Does every business need all three levels?
Not necessarily. A small business with simple, low-risk activities may only need policies and procedures, while more complex or higher-risk operations benefit from detailed work instructions as well.
Can a policy and a procedure be combined into one document?
For a small business this is common and acceptable, provided the document still clearly separates the commitment from the detail of how it is carried out.
Who should be involved in writing a work instruction?
The people who actually carry out the task should usually be involved, since a work instruction written without their input often does not reflect how the work is really done.
How often should these documents be reviewed?
Policies are typically reviewed periodically or when the business changes significantly; procedures and work instructions should be reviewed whenever the underlying process or equipment changes.
What is the risk of having too much documentation?
Excessive documentation becomes a burden that staff quietly stop following, which can be worse for genuine compliance than having less documentation that is actually used.
Do ISO standards require all three levels?
ISO standards generally require documented information proportionate to the organisation├ö├Â┬úÔö£├é├ö├Â┬úÔö£┬║├ö├Â┬úÔö£Ôòùs needs, not a mandatory three-tier structure - the right level of detail depends on the specific business and its risks.
Related
Not Sure Where to Start?
Book a free consultation and explain what your business is trying to achieve. Morgan Compliance Group will help identify the most practical next step.
Book a Free Consultation
