Simon PLC Attorneys & Counselors – August 2025 Memorandum
Urwiller: Implementing Effective Policies and Procedures
Troy, Michigan – Our Firm’s tradition of hiring current and former in-house counsel from financial institutions as Senior Attorneys at the Firm benefits our clients, and the Firm alike. Kenneth L. Urwiller II, Esq is one such valued member of our Team. With an outstanding career working for local Michigan and ultimately National Bank Associations, Ken brings his particular knowledge to the daily matters encountered by our clients. We are proud to share, and republish with Ken’s permission, his latest memorandum.
Implementing Effective Policies and Procedures
© Kenneth L. Urwiller II, Esq.
By Kenneth Urwiller II, Senior Attorney
While the government continues to determine the precise make up of its compliance enforcement agencies, it remains imperative that financial institutions maintain a strong compliance program. An effective compliance program helps a bank or credit union achieve, stability, reputational integrity and long-term profitability while effectively manage its risk. The implementation of proper written policies and procedures that are: tailored to fit the organization, effectively communicated to employees, monitored, and periodically reviewed remain the structural pillars of every successful organization’s risk management program. Appropriate policies and procedures also provide the best framework to achieve efficient operations, consistent results, and regulatory compliance. Conversely, having inadequate or unwritten policies or procedures can become a significant obstacle to achieving the afore-mentioned goals and objectives. While many of the concepts discussed below seem self-evident, they are often overlooked in the overwhelming press of the day-to-day operations of the bank or credit union.
Let’s examine the importance of each policy and procedure pillar:
- Written: Every proper policy or procedure should be reduced to writing. Investigative agencies and courts typically prefer written policies and procedures. Their position is often if it is not in writing – there is no policy or procedure. Further, whatever is in writing (regardless of what is practiced) is the bank or credit union’s policy or procedure. Most importantly, it is the only way a bank or credit union can ensure that the policy or procedure is clear, understood by all involved in or affected by its implementation, and is this effective.
- Tailoring policies and procedures to fit your organization: Every organization is unique in its mission, vision, goals, culture, capital, software, and processes. Customizing policies and procedures is the best approach to guarantee they align with the organization’s distinct needs, objectives, and structural composition. It fosters operational efficiency, minimizes confusion, reduces mistakes, and promotes employee competence.
Some “best practice” policy and procedure creation and design include:
-
- Organically create your own policy or procedure. Look within the bank or credit union to create and design the needed policy or procedure. Sometimes in the crush to create a desired policy or procedure swiftly, a well-meaning employee will simply copy a policy or procedure from another institution (usually a former employer) merely swapping the name of the institution and possibly changing some of the most glaring differences. While the creation of such a policy and procedure checks the box that the bank or credit union has a policy or procedure to cover the specific issue, it probably fails to remedy the organization’s operational need for such a policy or procedure. Even worse, since it is not properly tailored to the specific organization, it may become a liability later during litigation or an investigation.
- Design a process that secures the input and buy-in from all stakeholders. Effectively tailored policies and procedures require the input of all areas of the bank or credit union involved in or effected by the implementation of the policy or procedure. This requires the institution breakdown each aspect and stage in the proposed process, determine the department and employees necessary to implement the process and test the process. If complete input is not secured, the process fails to consider the needs, constraints or limitations of all areas involved in the process. This will increase the probability that the process will, at some point, breakdown or be implemented incorrectly.
- Design a practical process that can and will be implemented efficiently and effectively. Properly customized policies and procedures require practicality in design. They cannot simply look good on paper, contain unrealizable, lofty and utopic goals without the practical recognition of the organization’s operational realities. Policies and procedures that focus solely on achieving a noble result without considering if the policy or procedure can be effectively implemented rarely succeed. They read wonderfully, however, do not actually work in practice for a variety of reasons. For example, employees might not have the time to devote to or possess the necessary experience to complete the process, the information required to perform the required task is unavailable to the individual employee responsible to complete the task or the software the institution employs cannot provide the information necessary to accomplish the task.
- Employee Training: The institution must adequately train the affected employees on the policy or procedure. Properly trained employees are equipped with the knowledge and skills needed to execute tasks routinely and effectively. Training reduces errors, enhances productivity, and cultivates a culture of competence and professionalism. Some banks and credit unions write the policy or procedure and then fail to take the next step required to implement the policy or procedures by failing to adequately train the employees affected by the new or revised policy or procedure. This often occurs when the institution is pressed to produce a policy or procedure but not compelled to implement the policy or procedure. For example, the production of a specific policy or procedure might be an incentivize goal of a particular employee or department but the follow up of its implementation is not incentivized. Also, a regulator may require the development of a specific policy or procedure but the demand for effective implementation is not reviewed until the next regulatory exam. Therefore, the implementation is not immediately prioritized.
- Ensuring Effectiveness and Employee Compliance: Ensuring that a policy or procedure is effectively implemented and that employees are adhering to its requirements is equally as important as creating and training. Monitoring how the policy or procedure is being executed is necessary because it provides the institution with the essential feedback to certify that the policy or procedure is working as designed and that employees can and are adhering to the process. Items in the monitoring process to consider include:
-
- Is the policy or procedure being implemented as designed? To answer this question, you must examine each aspect and step of the policy or procedure (the same breakdown as when it was created) to verify that it works as designed.
- Do all affected employees understand their responsibilities in implementing the policy or procedure? Answering this question will determine if the policy is written in clear and understandable terms and that employee training is effective.
- Is the policy or procedure working as planned? Answering this question will prove that the policy or procedure is working as the creators planned. (For example, if a policy allows for feedback from one employee or department to another but that feedback is not offered because the informing employee or department feels that their feedback is never truly considered, then the policy or procedure may not be designed properly and is not working properly). Informational reports can also help determine if the policy or procedure is working as intended.
Consistent monitoring and enforcement of the bank or credit union’s policies and procedures promotes consistency, reliability, and accountability across all levels of the organization. It also mitigates risks associated with non-compliance, such as legal liabilities, operational disruptions, and reputational damage.
- Periodic Review: The financial industry is dynamic. It changes because of its evolving technologies, new regulations, and ever-changing market trends. Regularly reviewing and revising policies and procedures is required because it enables the bank or credit union to adapt to these emerging technologies, regulations and market trends, identify inefficiencies, and implement improvements proactively – not retroactively.
If a policy or procedure is improperly constructed or incorrectly implemented, the negative result can be significant. For example, a particular policy or procedure may be the pivotal issue in a lawsuit. If any of the aspects discussed above are not followed, it may result in proving that the bank or credit union does not follow its own policies and procedures. This will support opposing party claims that the institution is liable for the alleged wrongdoing. Juries are too often looking for a reason to rule against a bank or credit union – do not give them this one. Same with a government investigation. An institution’s failure to follow its own policies and procedures signals that the organization does not take the issue seriously. Often having a policy or procedure that the organization does not follow is worse than not having a policy or procedure at all.
In conclusion, proper written policies and procedures, when exclusively tailored, well-communicated, monitored, consistently enforced, and periodically reviewed, form the cornerstone of organizational effectiveness, compliance, and adaptability. They lay the groundwork for efficiency, reliability and success in achieving strategic objectives, long-term profitability, stability, resilience, and reputational integrity.
The information contained herein is not meant to be an exhaustive discussion of all aspects of the subject matter. It is meant only to be an introductory dialogue to assist institutions that desire to establish an approach to manage litigation risk.
N.B. Not Legal Advice: Please contact us if you would like to discuss the facts and circumstances of your specific matter. Simon PLC Attorneys & Counselors expressly disclaims all liability in respect to actions taken or not taken based on any or all the contents of this memorandum. The information contained herein may not reflect current legal developments and is provided without any knowledge as to the recipient’s location, industry, identity or specific circumstances. No recipients of this content, clients or otherwise, should act, or refrain from acting, on the basis of any content included in this memorandum without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue from an attorney licensed in the jurisdiction for which the recipient’s legal issue(s) involve. The application and impact of relevant laws varies from jurisdiction to jurisdiction, and our attorneys do not seek to practice law in states, territories and foreign countries where they are not properly authorized to do so.
