Your Policies Say One Thing.
Your Operations Do Another.

Your Policies Say One Thing.
Your Operations Do Another.

Your access policy says every user has an individual account. A team still shares a login because the application makes individual access inconvenient. Your vendor policy requires a review before onboarding. A department starts using a new service before anyone knows it exists.

These gaps are easy to miss when a review stops at the policy document. A policy describes the intended approach. Conversations, records, and observed workflows help show what actually happens.

Week 1 started with visibility. Week 2 focused on identifying what matters. Week 3 explored the processes that depend on one person. This week brings those ideas together: compare what your organization says it does with the way work gets done.

1. Align Policies With Reality

Choose one important policy requirement and follow it through a recent example. If the policy says access requires approval, look at a recent access request. Who requested it, who approved it, and what record shows that the approval happened before access was granted?

Ask the people doing the work to explain the process in their own words. Check whether the document reflects the systems, roles, and exceptions they actually use. An outdated policy may describe a workflow the business left behind months ago.

Close the gap deliberately. Decide whether the process needs to change, the policy needs an approved update, or both. Avoid weakening a requirement merely to make the document match a risky habit. Keep applicable commitments and obligations in view.

2. Confirm Control Ownership

A policy can name a department without making anyone accountable for a control. Ask who performs the work, who reviews it, and who follows up when something is missed. “IT handles it” leaves room for different assumptions.

Give each key control a named owner, a realistic schedule, and an authorized backup. Clarify what completion looks like and where the evidence belongs. For a periodic access review, that might mean a dated review record, an approver, and tracked actions for unnecessary access.

Ownership also requires capacity and authority. Leaders should make sure the person responsible has the time, access, and support needed to carry out the work.

3. Check for Workarounds

People often create shortcuts to keep work moving: sending files through an unapproved service, skipping a review during a busy period, or using a shared account when an individual account is unavailable. A workaround can become the normal process without anyone formally deciding to accept its risk.

Ask a practical question: “Where does the official process make it difficult to get the job done?” Make it safe for staff to describe the friction. Look for missing tools, unclear instructions, slow approvals, and steps that no longer fit the work.

Record the reason for the workaround and agree on a safer, usable path. Where a temporary exception is necessary, have the appropriate owner approve it, identify safeguards, and set a review or expiry date.

4. Verify Access Practices

Access policies are only useful when account creation, permission changes, and offboarding follow them consistently. Trace a recent joiner, role change, and departure through the systems that matter most to your business.

Confirm that access was authorized, appropriate to the role, and updated or removed when needed. Include cloud services, vendor portals, privileged accounts, and other systems outside the central directory. An inactive user record does not always mean every session, credential, or permission has been addressed.

Use approved records and authorized review methods. Have responsible system owners investigate and correct exceptions. Keep the evidence in an appropriate location without copying passwords or sensitive account details into a general tracking sheet.

5. Measure and Improve

Use simple, repeatable checks to see whether a control is working. Depending on the process, you might track completed access reviews, overdue offboarding actions, vendors awaiting review, or unresolved exceptions. Define what each measure means and who follows up.

Start with a manageable sample and a review cadence that fits the risk. Record what was checked, what was found, the action owner, and a due date. After a fix, revisit a recent example to confirm that the new approach works in practice.

A completed checklist alone does not prove a control is effective. Pair the measure with a look at the underlying work and explain what the check does—and does not—cover.

Start With One Policy and One Real Workflow

You do not need to review every policy at once. Choose a process that handles sensitive information, affects customers, or repeatedly creates exceptions. Bring together the policy owner and someone who performs the work.

1. State the requirement. What should happen, and why?
2. Walk through a recent example. Which people, systems, approvals, and records were involved?
3. Identify the difference. Is the gap caused by unclear ownership, outdated instructions, missing resources, or a deliberate shortcut?
4. Assign a practical action. Agree on an owner, a due date, and any approved interim safeguards.
5. Check again. Review a later example to see whether the change is working.

The goal is a process people can carry out consistently, with enough visibility to notice when it drifts. Connecting policy to real work helps your organization make clearer decisions about risk and improvement.