What is the difference between policy and procedure in the SOP hierarchy?

• A. Policy states intent and requirements; procedure provides step-by-step instructions to meet the policy.
• B. They mean the same thing.
• C. Policy explains steps; procedure states intent.
• D. Policy is for external parties only.

Answer: (A)

In the SOP hierarchy, the main idea is that policy states the intent and the requirements, while the procedure provides the step-by-step instructions to meet that policy. The policy sets the direction, authority, and rules—it explains why something is required and what must be achieved. The procedure translates that into concrete actions: who does what, in what order, using which tools, and how success is verified. This separation helps keep guidance stable at the policy level while allowing processes to be updated as practices change.

For example, a data protection policy might state that personal data must be protected and access must be controlled. The corresponding procedure would then outline the exact steps for verifying requests, granting or revoking access, applying encryption, handling passwords, and logging activity. This makes compliance clear in practice without changing the underlying intent.

It isn’t correct to think they mean the same thing or that policy explains steps. Policy isn’t just about external parties either; it generally governs internal governance and sets expectations that procedures implement.