What is the difference between a policy and a procedure?

• A. Policy defines the specific steps to implement the rule.
• B. Policy is optional and does not set expectations.
• C. Policy states intent or rule; procedure describes steps to implement the policy.
• D. Policy and procedure are the same thing.

Answer: (C)

The main idea is that a policy is a high-level statement of intent or rule, setting expectations and guiding behavior, while a procedure is the detailed, step-by-step method for putting that policy into action. A policy answers what must or must not be done and why it matters. A procedure translates that policy into concrete actions—who does what, in what order, using which forms or tools, and how to handle exceptions or changes. For example, a data-access policy might state that only authorized personnel may access confidential data. The corresponding procedure would specify the exact steps to request access, verify identity, log approvals, assign permissions, and revoke access when needed. Policies tend to be stable over time, while procedures can be updated as tools or processes evolve. So the correct statement captures this relationship: policy states intent or rule; procedure describes steps to implement the policy. The other options mix up roles, claim policies are optional, or say they are the same, which doesn’t reflect how organizations separate high-level governance from actionable processes.