Picture a rule about customers' private details. Parliament writes a law: a company must keep people's details safe. That is one sentence for every company in the country. It says nothing about which cupboard, which password, which person. A law is written far from the desk where the work happens.
Parliamentthe law
↓→
The watcherthe rules
↓→
The companythe policy
↓→
The deskthe procedure
So the law is handed down a ladder. A watcher is a body set up by the law to look after one trade, and it writes the detailed rules. The company reads those and writes a policy: what we do here. A manager turns the policy into a procedure: the steps for this desk. Four rungs, one law.
Put the four rungs in the order a rule travels down them.
Tap them in the order they happen, first to last. Each tap gets a number.
The law→The rules→The policy→The procedure
Right. Law, rules, policy, procedure. Each rung is written by someone closer to the desk, and each one is more exact than the last.
Keep details secure→Control who can see them→Only the approved system→Lock your screen when you stand
Here is a real law going down a made-up company. The law says: keep personal data secure. The watcher's guidance says: control who can see it. The company's policy says: customer records live only in the approved system, and only your team can open them. The desk's procedure says: lock your screen when you stand up.
The law
↓→
The rules
↓→
The policy
↓→
The procedure
A new cashier reads: lock your screen when you stand up. Which rung is that?
The watcher's rule.
Not yet. The watcher writes for every company in the trade: control who can see it. Which button locks which screen is the company's and the manager's to say.
The procedure. It is the steps for this desk.
Right. It names one act, at one desk, that one person can do. Nothing higher up the ladder is that exact, because nothing higher up knows which desk.
The law. Parliament wrote it.
Not yet. Parliament wrote one sentence for every company in the country. It does not know this desk has a screen. The screen is three rewrites down.
The desksomething went wrong
↓→
The companyshow me the policy
↓→
The watcherasks
The ladder runs the other way too. When something goes wrong at the desk, the watcher asks the company: show me your policy, show me the procedure, show me the training. If the company had none, the watcher does not blame the cashier. It blames the company for leaving the law up the ladder.
A customer's details leak because a laptop with no password was left on a train. Tap the rung the watcher will fine.
Tap the part of the picture that answers it.
Parliament
++
The watcher
++
The company
++
The desk
The company
Right. The fine lands on the organisation that holds the details. It should have had a policy that laptops carry passwords, and a procedure that says so at the desk. The worker may be in trouble inside the company; the watcher's bill goes to the company.
Parliament
Not yet. Parliament wrote the law. It is not fined under it. The law exists to be handed down, and the fine lands on whoever failed to hand it down far enough.
The watcher
Not yet. The watcher is the one asking the questions and sending the bill. It wrote the rules; it did not hold the details.
The desk
Not yet. The worker left the laptop, and the company may discipline them. But the watcher's fine is for a missing rule and missing training, and those belong to the company.
Picture 100 cashiers. Move how far down the ladder the rule has been written and see how many lock their screens. Made up to show the shape.
Lock their screens20 of 100, made up
Cashiers100 of 100, made up
How far down the rule is written: Only the law
Only the law: 20 of 100. A sentence in Parliament, and a few careful people.
Lock their screens35 of 100, made up
Cashiers100 of 100, made up
How far down the rule is written: The law and the watcher's guidance
The watcher's guidance as well: 35. The company has read it; the cashiers have not.
Lock their screens60 of 100, made up
Cashiers100 of 100, made up
How far down the rule is written: A company policy as well
A company policy as well: 60. Now it is in the handbook every cashier was given.
Lock their screens90 of 100, made up
Cashiers100 of 100, made up
How far down the rule is written: A procedure on the desk as well
A procedure on the desk as well: 90. Lock your screen when you stand. A hand can do that.
Where does the biggest jump happen?
When the policy becomes a procedure on the desk: words a hand can act on.
Right. Thirty more cashiers between the policy and the procedure. The rule did not get stricter on that rung. It got close enough to the desk that a hand could do it.
At the watcher's guidance, because the watcher can fine.
Not yet. The watcher writes to the company, not to the cashier. Its guidance lifted the number by fifteen, and it is still written for the company, not the cashier.
At the law. A law is the strongest thing there is.
Not yet. A law is the strongest rule, and a cashier never reads it. It lands nowhere until somebody rewrites it for a desk.
Move the control.
The lawevery food business
↓→
The chainits policy
↓→
The till?
A new rule says every café must tell customers which dishes contain nuts. Picture a café chain. Which of these is the procedure?
The law that every food business must give allergy information.
Not yet. That is the top of the ladder: one sentence for every café, pub and factory in the country. It does not know which till.
The chain's policy that every menu will carry allergy symbols.
Not yet. The policy is rung three: what we do here, for all our cafés. It still has to become a card on this till and words in this server's mouth.
The laminated card by the till listing each dish, and the words the server says when asked.
Right. One card, one till, one sentence to say. That is the rule rewritten for the hand that serves the food.
Lesson complete
A law is written once, far from the desk. It reaches a hand only after three rewrites.