Why do policy roll-outs fail?
Many NGOs have good policies that nobody remembers. The policy was emailed once, filed in a folder and never discussed. When a problem happens, staff say they never saw it, and the organization cannot prove otherwise.
A good roll-out solves two problems: people know what the policy says, and you can show that they were told.
Donors and auditors increasingly ask for the second. They want to see that safeguarding, conflict of interest and procurement policies were not only written but also delivered to staff. A record of who confirmed which version is simple evidence, if you keep it from the start.
How do you write a policy people will read?
- Keep it short. Aim for two pages for most policies. Put the rule in the first lines.
- Use plain words and short sentences. Define terms.
- Say who it applies to, what is required, what is forbidden, and who to ask.
- Add examples. One or two real situations make a rule concrete.
- Number the version, give it a date, and name an owner.
- Say how a breach is handled and where to report a concern.
If a policy matters, ask two staff from different levels to read the draft and tell you what they understood. Fix what they miss. Check the reading level too: a policy for field staff who read in a second language needs shorter sentences than one for head office managers. Put the key rule in a box or a bold line, so a reader who skims still gets it.
Who should read which policy?
Do not send every policy to everyone. Staff stop reading when everything is urgent. Make a simple map.
| Policy | Who must confirm |
|---|---|
| Code of conduct, safeguarding | All staff and volunteers |
| Conflict of interest | All staff, with a yearly declaration for key roles |
| Procurement | Staff who request or approve purchases |
| Data protection | Staff who handle personal data |
| Security and device use | All staff with accounts |
Our article on conflict of interest declarations shows how an annual declaration works alongside the policy.
How do you run the roll-out?
- Publish the version in one agreed place, so everyone reads the same text.
- Announce it with a short note: what changed, who must act and by when.
- Brief people. For important policies, run a 20-minute session with questions, in the language people use.
- Ask for acknowledgement. Each person confirms that they have read the policy.
- Follow up. After the deadline, send reminders. Then ask line managers to follow up.
- Close it. Report completion to leadership, with the names still outstanding.
For new staff, include the key policies in their first week and set a date to confirm. Do the same for volunteers, interns and short-term consultants who have access to your records or work with communities.
Set a rhythm. Many NGOs review all policies once a year, refresh the high-risk ones and keep a simple calendar with the owner and next review date for each. Our article on building a compliance calendar shows how to keep such dates from slipping.
What should the record show?
A useful record lets you answer, quickly, “Did this person confirm this version?” For each acknowledgement, keep:
- the policy and its version number,
- the person’s name,
- the date and time,
- the method, such as an in-system confirmation or a signed sheet.
When a policy changes, issue a new version and ask the affected staff to confirm again. Keep the old versions so you can show which text applied at a given time.
Does an acknowledgement prove understanding?
No. A click or a signature shows that a person confirmed they read the policy. It does not show they understood it, and it does not prove legal compliance. Say this plainly to staff, too, so they do not treat the click as the end of the task. Add other steps for the policies that matter most: a short quiz, a case discussion in a team meeting, or a yearly refresher. Watch for signs of confusion, such as repeated questions, and fix the text.
Where EMPOBase fits
In EMPOBase, authorized users publish policy versions in Compliance and monitor staff acknowledgements. Attestation records include the policy version, the staff identity, a timestamp and the method. An acknowledgement records that action, and it does not by itself prove understanding or legal compliance. Confirm that this workflow is available for your organization, and keep your briefings and refreshers alongside it. Read the documentation for the current steps, or ask us for a demonstration.