Risk and Improvement

At The Policy Place, we are committed to regularly reviewing and updating our online policies to ensure they meet the highest standards and reflect the latest developments in the field. Our next review will focus on policies related to abuse, child protection, and safeguarding vulnerable adults.

These policies are crucial for compliance with the Social Sector Accreditation Standards, Health and Disability Standards, and legislation such as the Children’s Act 2014.

Our Review Process

When we review and update our online policies, we take into account feedback from our members, as well as current laws, regulations, and best practice codes. This comprehensive approach ensures that our policies are not only compliant but also practical and effective for our diverse membership.

In the upcoming review, we will be incorporating two significant developments: the Specialist Family Violence Organisation Standards and the Recommendations of the Royal Commission on Abuse in Care. These updates are essential to ensure our policies remain relevant and effective in addressing the needs of those we serve.

The Importance of Specialist Family Violence Organisation Standards

The Specialist Family Violence Organisation Standards (“the Standards”) are a set of comprehensive guidelines developed as part of Te Aorerekura: The National Strategy to Eliminate Family Violence and Sexual Violence. These standards aim to guide consistent and high-quality practice among organizations providing services to individuals affected by family and sexual violence.

Key Features of the Standards

The Standards reflect extensive collaboration and insights from professionals in the family violence and sexual violence sectors, tangata whenua, community representatives, agencies, and victim-survivors. For organisations like ours, they provide a valuable framework for revising and updating policies and procedures. Key criteria include:

• Recognition of various forms of family violence: Including child abuse, elder abuse, and sexual violence, and the differing impacts based on cultural, gender, and care dynamics.
• Ensuring safety and autonomy for victim-survivors: Entailing provision for direct and indirect service users and for the safety and wellbeing of tamariki even when children are not direct service users.
• Victim and whānau-centered risk assessment and safety planning: Conducted in a culturally responsive manner and reflecting knowledge of family-violence related risk factors (eg separation, pregnancy).
• Supporting a trauma and violence-informed approach: a focus on the impact of violence (distinct from other causes of trauma) on individuals and communities and recognising  interconnected experiences of interpersonal and systemic violence.
• Reflecting a ‘primary victim-survivor, predominant perpetrator’ analysis: – Reflected in policies and procedures around risk assessment, planning and service delivery.
• Recognising and addressing the rights and interests of deaf and disabled individuals and adults needing safeguarding – addressing the contexts of care and impacts of stigma and misinformation.
• Promoting culturally safe and appropriate practices: – Recognising intersectionalities and impacts for people of diverse genders, ethnicity and abilities.

How The Standards Apply 

The Standards are vital for organisations providing specialist family violence responses but can also be utilised by any organization wanting to enhance their response capabilities and organisational practices. They complement existing accreditation and practice frameworks from agencies like the Ministry of Justice, Te Kāhui Kahu and the Ministry of Social Development.

The Policy Place Abuse and Protection policies are already aligned with many aspects of the Standards, such as cultural responsiveness, safety planning, and legislative references.

However, we strive to do more. Through review and updating, Policy Place members operating in social service, health, disability and justice sectors will have their policies more specifically aligned to the Standards.  Members will therefore gain the assurance that their policies:

• Comply with legal and regulatory requirements: And reflect best practices.
• Are endorsed and utilised by different sectors: And comply with different accreditation criteria
• Guide the delivery of safe, inclusive, and responsive services: To diverse communities.

This helps build support national consistency in the application of the Standards because, as a leading provider of policies and procedures for agencies in NZ, our reviews and updates positively impact many organisations in Aotearoa. Nationwide, we are helping build a safer and more effective network of services and supports for those impacted by family and sexual violence.

Conclusion

Regularly reviewing and updating our policies is not just about compliance; it’s about ensuring that our members are equipped with the best tools and practices to provide safe, effective, and inclusive services. By aligning with the Specialist Family Violence Organisation Standards and incorporating feedback and new developments, we can support our members in delivering high-quality care and protection to those who need it most. Together, we can make a significant impact in the fight against family and sexual violence.

We’ve just introduced Policy Tracking and Reporting for members of the Police Place’s online policy service.

This new function provides managers with valuable information about the views and use of organisational policies and procedures. It also offers evidence of compliance that organizations can use for audits and assessments, ensuring adherence to the Social Sector Accreditation Standards, Ngā Paerewa Health and Disability Standards and other relevant laws and regulations.

In this post, we’ll cover what Policy Tracking involves, its benefits and how to impelement and use this new function.

If you are a member of the online policy service let us know if you want access to the new function. If you are not yet a member, contact us NOW to discuss joining.

What is Policy Tracking 

Policy Tracking reports on the use and views of an organisation’s policies. It tells you which of your policies have been viewed and by whom, within chosen timeframes.

Here’s an example of a Policy Report:

• The report can be specific to a staff member or group of staff.
• It can be specific to policy pages.
• It can consider policy views within your chosen timeframe. .

The Benefits

We added this function because clients were asking for it. Policy Tracking and Reporting will bring the following benefits:

1. Enhanced Compliance: Policy tracking provides records of policy views that can be used to evidence compliance with policies and laws during audits and inspections. This transparency can protect an organisation from liability and shows a proactive approach to compliance.
2. Risk Management: Ensuring that all staff have viewed and understood critical policies like the Code of Conduct, Health and Safety, and Complaints reduces the risk of non-compliance with laws and regulations and harmful consequences.
3. Operational Efficiency: By automating the tracking of policy views, organisations can save time and resources that would otherwise be spent manually monitoring compliance.
4. Improved Transparency and Responsibility: Policies should be a single source of truth for an organisation. Policy Tracking reminds staff of the need to keep themselves informed about revisions and updates to policies and helps steer organisational members in the same direction.
5. Continuous Improvement: Policy Tracking will provide information that can help investigate workplace incidents or complaints and plan training and service improvements.

Beware of privacy implications

Policy Tracking involves handling staff personal information, so applying privacy safeguards is crucial:

• Inform Staff: Before implementing the Policy Tracking function, let staff know you are going to do it and the purpose behind it.
• Anonymise Data: When using the Tracking data for audit and assessment purposes, remove identifying information. Anonymised and aggregated data provides as good evidence of policy use as identifying data.
• Restrict Access: Only allow authorised personnel to access Tracking data to ensure personal information remains secure. Usually, access will be confined to management.
• Limit Data Use: Tracking data must not be used for any purpose unrelated to the reason it is gathered unless allowed by law.
• Transparency: Inform staff they can request access to the tracking data you collect about their access and use of policies.

Limitations of Policy Tracking

We’ve previously posted about the limitations of a compliance-focused approach to policy. The limitations apply to the new Policy Tracking function.

While policy tracking tells you if a person has looked at a policy, it does not tell you whether they understood the policy or whether the policy has been applied. That’s where our online courses come in. Check them out here. They are short online courses that support members and non-members of the online policy service in understanding and applying policies and procedures in a range of areas.

Conclusion

The new service for tracking staff views of policies and procedures promises many benefits for our online policy members. It will support our policy clients in building service quality and efficiency, reducing risk, and fostering a culture of transparency and responsibility.

If you want to use the Policy Tracking function and you’re one of our online policy service members, then just let us know. If you’re not an online policy service member but are interested in joining, contact us to discuss your policy needs and how we can assist.

Contact us NOW to enhance your compliance and operational efficiency with our new Policy Tracking and Reporting service.

Risk management is a key reason for policies and procedures  –  risks like financial mismanagement, accidents, cyberthreats, privacy.

Take a broad view. No need to be afraid of risk. The wider your view of risk the better prepared you can be and the more able and confident you can feel in your business/organisation.

While risks will be unique to your operation, there are also risks that all of us in business need to manage.  At the Policy Place, we help organisations manage these risks with online policies that are regularly reviewed and updated and with other strategies like guidelines and checklists.

Some of the common risks for organisations are listed below, with some of the more common policies and strategies to help manage these risks:

Financial Risk Management 

• Policy and procedures relating to financial planning and controls
• Fraud and Corruption policy
• Protected Disclosures policy
• Financial Planning and Investment policies

Information Risk Management 

• Preventative & Troubleshooting Maintenance Contracts
• Privacy and Confidentiality policy
• Record Management and Archiving system
• Privacy Breach Procedure
• Information Safeguards policy and procedure

Managing Economic & Political Risks

• Media-related policies and processes
• Hazard-management policy and procedure
• Staff and Governance Recruitment Policies and Procedures
• Strategic & Business Planning
• Hazard & Risk Register

Health and Safety Risk Management 

• Wellbeing policy and procedure
• Health and Safety procedures including Hazard and Risk Register; Staff Participation
• Induction and ongoing staff training
• Pandemic Planning
• Infection Control policy and procedures
• Cultural Safety and Responsiveness policy and training
• Harassment and Bullying policy and procedure

Service-related Risk Management

• Complaints and Feedback Policy and Procedures
• Performance and service planning and review processes
• Quality Management policy and procedure
• Training and development of staff
• Policies to guide delivery
• Business Continuity Plan

No matter what business you’re in, you’re likely to rely on information technology(IT).

In social service, health and education agencies, we use IT for a multitude of functions – enrolments, intakes, planning etc. Essentially, we would be lost without it.

But have you given sufficient thought to preventing and defending against cyber threats?

If you think that cyber attacks are still the stuff of sci-fi movies then think again. It was only 6 weeks ago that the New Zealand Stock Exchange was rendered inoperative because of a cyber attack. Not just once but multiple times.

We are all vulnerable and need to be on guard to prevent and defend against attacks. We need to become cyber-brave!

A good start

For cyber smart week, CERT NZ has published some basic tips to help each of us improve our defence against cybersecurity attacks.  These include password protection, install updates and using multifactor authentication for login access.

We all need to be cyber-aware but it’s especially important if you’re an organisation. Awareness means understanding and regularly reviewing your cyber risks. There may be risks to individuals, your functions, finances, reputation and/or to your agency’s very existence.

Knowing the risks, will guide the safeguards you need to take and what your policies and procedures should address to help you prevent and respond to cyber-attacks.

You need policies and procedures

Given the rate of change in the IT world, it’s important to review and update your policies and procedures to cover off the “must-dos” for your organisation’s security. Key areas to cover include:

• acceptable use of information and communications technology
• access to data
• remote working
• incident planning.

Staff should be trained to implement the policies and to maintain cyber awareness.

Acceptable/unacceptable use of electronic devices at work

Your policies should cover the use of personal devices eg cellphones, as well as what may or may not be done on work computers eg internet and email access not to be used to download unauthorised software and install games and prohibitions against activities such as gambling and use of pornography.

Access to data

As a general rule, access to data should be restricted to those who need it for work purposes. This helps prevent data breaches. It also helps protect privacy which can be jeopardised by unauthorised access to client or staff personal information.

You should have clear procedures in place for removing and changing access rights as people change and leave roles. No one should have access to data and systems they don’t need for their work purposes.

Remote working

With COVID-19, remote working is much more prevalent. But with remote access, there’s potentially more pathways for cyber attacks. Your policies and procedures can help manage these risks. For example:

• outline organisational responsibilities like organising a VPN
• state the safeguards to be taken by staff/remote workers – that they use their home internet to access the work network and notify management immediately of any unusual events on the system.

If personal devices are used, precautions by remote staff can include:

• keeping their operating system up-to-date
• using a strong password and multi-factor authentication
• uploading documents they save locally to the network
• running and updating their antivirus software regularly.

Incident planning and responses

Your policies and procedures should guide staff when responding to a cybersecurity issue, in particular:

• who they should notify if concerned
• who will manage recovery from the incident
• who should be told (eg Privacy Commissioner from 1 December for serious privacy breaches)
• how to use data backups and resume operating
• steps to mitigate and prevent a recurrence of the incident.

Become cyber-brave

Even though it may feel like a minefield, grow your awareness and become cyber-brave.

The Martians may or may not be coming. But either way, it’s best to be prepared.

If you’re wanting your policies and procedures reviewed and updated, contact us. We aim to protect social service, childcare, health and tertiary education agencies from risks of non-compliance with regulations and standards.

We want to help you become cyber brave!