Policy framework

A policy framework organises internal rules by binding force. Policies set principles, standards set mandatory requirements, procedures describe how work is done, and guidelines give recommendations. Each document has an owner, an approving body, a scope, a version and a next review date. In Switzerland, the board of directors is responsible for issuing the regulations required for an appropriate organisation, and more detailed rules are typically issued as directives (Weisungen).

For the board, the framework is how strategy and risk appetite become binding behaviour, and supervisors and auditors use it as the yardstick against which conduct is assessed. In Germany, MaRisk requires business to be conducted on the basis of documented organisational rules that are made known to staff and adapted promptly when activities or processes change.

Pitfalls include overlapping documents with conflicting requirements, policies past their review date, no clear distinction between material and editorial changes, and requirements that cannot be traced to the regulation they implement or to the control that enforces them.

In practice

1. 01
   Keeps all internal rules in one register with stable identifiers, owner, approval level, scope, version and next review date.
2. 02
   Defines which body approves which document type, in line with the bank’s competence regulations.
3. 03
   Routes material changes through full approval and treats editorial changes as minor versions with a change log.
4. 04
   Maps each requirement to its regulatory source and to the processes and controls that implement it.
5. 05
   Tracks overdue reviews and open exceptions as management indicators.

Sources

• FINMA Circular 2017/1, Corporate governance (banks), consolidated version, last amended 4 November 2020 →
• BaFin Circular 06/2026 (BA), Mindestanforderungen an das Risikomanagement (MaRisk), 30 June 2026 →