Policy Execution with BSC Designer

“Policies” are formalized guidelines that help organizations align behavior with strategic intent and ensure compliance. In this article, we’ll discuss the policy execution framework, focusing on such use cases as continuous monitoring of controls, mechanics to gather feedback from stakeholders, and alignment between the policies and the overall strategy.

Stakeholders of Policy Lifecycle

Traditionally, policies are created, enforced and adapted by different groups of stakeholders:

• Governance bodies and legal teams (create policies)
• Operational managers (implement policies)
• Compliance officers or department heads (maintain policies)
• Auditors or risk managers (evaluate effectiveness of policies)

While roles in the policy lifecycle are distributed across different stakeholders, this separation should not lead to fragmentation. The ultimate goal of policy implementation is to unify policy intent with actual delivery¹.

Structure of a Typical Policy Framework

A comprehensive policy framework follows a hierarchical structure where the degree of abstraction is gradually decreasing from the high-level regulation or strategic intent to the level of operational implementation with specific controls:

• Regulations / Governance: Legal requirements and internal corporate principles.
• Policies: High-level statements outlining the organization’s position.
• Standards: Specific, measurable rules.
• Procedures: Step-by-step instructions on implementing standards in practice.
• Guidelines: Recommended best practices that support procedures.
• Controls: Mechanisms to prevent, detect, or correct non-compliance.

Automating Policy Execution with BSC Designer

As emphasized by multiple standards (for example, ISO 37301, Compliance Management Systems), policy execution should be seen as a part of overall strategy implementation.

The BSC Designer platform offers seamless alignment between core strategy and the supporting policies. Below we examine how the policy execution framework can be implemented in practice with strategic planning software.

Policy Structure and Alignment

The overall structure of the policy framework:

• At the scorecard level, users can define overarching policies or regulations. Those policies can be global for the organization or specific for a business unit or function.
• Depending on their role, different groups of stakeholders are granted access rights to certain parts of policy implementation. For example, following RACI model.
• Within the scorecard, strategic intent can be decomposed into supporting standards, procedures, and controls using a hierarchy of items.
• Policies or their controls can be aligned with specific objectives from strategic scorecards. Such alignment supports a shift from the traditional compliance role of policies to one where compliance acts as a key enabler of corporate strategy. ²

Policy Controls and Continuous Improvement

The mechanics of performance metrics is used to define the controls:

• The performance measurement framework allows tracking efficiency and effectiveness of policy implementation.
• The properties of the specific controls can be customized depending on the role of the control via custom fields. For example, controls for business continuity and 3-rd party vendor validation will have different properties.

In the policy execution framework, the controls are dynamic:

• Continuous monitoring is enabled through real-time data updates, with traceability supported by audit trails. A good example of the need for continuous monitoring is tracking periodic training (see four-levels training measurement model) on policy updates³.
• Various cases of performance measurement are supported, such as qualitative assessments, binary compliant/non-compliant statuses, gradual performance changes, and the ability to detect attached evidence, etc.

The platform provides traditional policy management functionality:

• Supporting documentation such as policy files, procedures, and audit reports can be uploaded and linked to relevant objectives or controls.
• Action plans related to control implementation or policy updates can be tracked within the system, with ownership assigned and alerts triggered based on deadlines or performance changes.
• Dashboards and strategy maps provide powerful visualization tools, helping stakeholders quickly assess performance, identify gaps, and understand the relationships between policies, controls, and outcomes.

To support the feedback mechanics:

• Stakeholders can engage directly via the comment function, providing feedback or documenting issues for audit purposes.
• The platform can issue automatic regular reports to the relevant stakeholders.

We discussed more examples and implementation techniques in the article on GRC controls.

Scaling and Maintenance

Policy maintenance:

• By design, each control includes a required actualization interval. This interval defines when performance data must be uploaded automatically or by the responsible person. If actualization interval is missed, these controls will be marked “update required.”

To ensure easier scaling of policy frameworks:

• Organizations can define policy templates once and replicate them across departments or business units.
• The controls and templates of controls can be static or can be synchronised dynamically.

Conclusion

The discussed approach transforms policy execution from a static documentation process into a dynamic, measurable, and strategically aligned system.

• By linking policies to operational controls and strategic objectives, organizations can ensure not only compliance but also elevate the role of policies as strategic enablers.
• The role of software automation is to reduce the complexity of the strategic planning domain for key stakeholders involved, ensure consistency and traceability of performance data.

Alexis Savkín

Alexis Savkin is a Senior Strategy Consultant and the CEO of BSC Designer, a Strategy Architecture & Execution Platform. He has more than 20 years of experience in the field, with a background in applied mathematics and information technology. Alexis is the author of the “Strategy Implementation System”. He has published over 100 articles on strategy and performance measurement, regularly speaks at industry events, and his work is frequently cited in academic research.