Your Policies Are Compliant. Are Your Procedures Active?
Auditors almost never find a missing procurement policy. What they find is a policy adopted in 2015, signed by a board that has completely turned over since, describing a purchasing process nobody in the building follows. The document is compliant. The practice is not.
That gap between an adopted policy and a working procedure is where most monitoring findings live, and closing it is cheaper than any other compliance work you can do.
The Uniform Guidance asks for procedures, not just policies
Read the requirements closely and the word that keeps appearing is procedures. 2 CFR 200.302(b) requires written procedures to implement the payment requirements at 200.305, and separately requires written procedures for determining the allowability of costs under Subpart E. 200.318(a) requires documented procurement procedures. 200.318(c)(1) requires written standards of conduct covering conflicts of interest.
Written procedures. The regulation asks for the operating instructions, not the position statement. A policy that says the organization will follow federal procurement standards does not satisfy a requirement for procedures that describe how it does.
This distinction is not academic. A reviewer who asks for your cost allowability procedure and receives a one page policy stating that the organization charges only allowable costs has learned nothing about your controls, and will say so in writing.
What separates the two
A policy answers what and why. Your governing body adopts it, it changes rarely, and it establishes the standard. A procedure answers who, when, in what order, and with what record. Staff own it, it changes as systems and people change, and it produces evidence.
The test is simple. Hand the document to someone who started last week and ask them to do the thing. If they can, it is a procedure. If they need a colleague to explain what actually happens, you have a policy with an oral tradition attached, and the tradition leaves when the colleague does.
Both matter. Losing the policy means losing the authority behind the practice. Losing the procedure means the practice was never repeatable in the first place, which is the harder problem to see from the inside.
What makes a procedure active
Active is a specific condition, not a feeling about whether people are trying.
Five marks of an active procedure
- A named owner, by position rather than by person, so turnover does not orphan it.
- A trigger that says when it runs: a purchase over a threshold, a monthly close, a new subaward.
- An artifact it produces, and a specific place that artifact gets filed.
- A review date, and evidence that the last review happened.
- Somebody other than the author who has actually followed it start to finish.
Run that list against your procurement procedure this week. Most organizations find the owner and the trigger, and come up short on the artifact and the review. That is a two hour fix, not a consulting engagement.
A policy nobody follows is worse than no policy, because it documents the standard you failed to meet.
Why this matters more this year
The rewrite of 2 CFR reclassifies the Uniform Guidance from guidance into binding regulation, applied government wide. As our breakdown of that shift explains, the practical effect lands on your internal documents: every policy and training deck that cites 2 CFR as guidance needs its language updated, and every procedure that leaned on an agency's informal flexibility needs a second look.
That is an opportunity as much as a task. A policy review you were going to postpone another year now has a deadline attached to it, and working through the list is how you find the four procedures that quietly stopped matching reality.
Start with the ones tied to money moving: payment, allowability, procurement. Give each a named owner and a review date, then work outward. Records retention and procurement come next, because those are the two an auditor asks for first.
Download the Grant Systems Self-Check, a free worksheet that walks your systems one at a time and shows you which ones have a procedure behind them and which ones are running on memory.
