Policies often get a bad reputation.
People see them as restrictive, boring, or unnecessary. Sometimes they feel like obstacles rules that slow things down or make work harder than it needs to be.
But as I continue to learn about GRC, I am beginning to understand something important:
Policies don’t exist because people are bad.
Policies exist because people are human.
Humans Are Predictable
Not in a negative way but in a very real way.
Humans:
- forget
- rush
- trust
- get tired
- feel pressure
- want convenience
- make emotional decisions
These behaviours show up in life, at work, and online. And when systems depend only on “doing the right thing,” risk quietly grows.
Policies exist to guide behaviour when emotions, pressure, or distractions take over.
Policies Create Consistency
People don’t all think or act the same way.
Without policies:
- decisions change depending on mood
- responses differ from person to person
- mistakes repeat
- accountability becomes unclear
Policies bring consistency. They ensure that when situations arise, there is a shared understanding of what should happen, no matter who is involved.
That consistency reduces risk.
Policies Support People Under Pressure
When something goes wrong, people panic.
In those moments, policies act like a reference point. They remove guesswork and reduce emotional decision-making.
Instead of asking:
What should I do right now?
Policies answer:
This is what we do.
That clarity protects both people and organisations.
Policies Are Preventive, Not Punitive
A common misconception is that policies exist to punish.
In reality, policies are designed to:
- prevent repeated mistakes
- protect people from blame
- document expectations
- support fair decision-making
They are guardrails not handcuffs.
Why This Matters in GRC
GRC doesn’t assume perfection.
It assumes:
- people will make mistakes
- things will go wrong
- pressure will exist
- decisions will be rushed
Policies are one way GRC helps organisations prepare for those moments.
They don’t remove risk.
They help manage it.
Outside of cybersecurity, policies exist everywhere:
- road rules
- workplace guidelines
- health protocols
- safety procedures
They exist not because people can’t be trusted but because structure keeps things working when human behaviour becomes unpredictable.
On A Final Note…
Policies are not the enemy.
They are a recognition of reality.
People are human and humans need guidance, clarity, and structure to reduce risk and protect what matters.
That is why policies exist.
Not to control people.
But to support them.
