Managers, Who Apply It
The policy operates through managers and almost none has been told how. The variation between them is the actual policy.
Management responsibility
Never enforced
As written
Managers are responsible for ensuring compliance with this policy within their teams.
What happens
Assigned and never explained. No manager has been told what ensuring compliance consists of.
Each invents an approach, which produces as many policies as there are managers.
The operative rule varies by team, and staff moving between teams notice immediately.
A policy is applied by managers having conversations. They have had no guidance, no examples and no idea what their colleagues do.
The maintenance work in “Managers, Who Apply It” matters after software selection as much as before it. For teams assessing this workforce software resource in relation to employee monitoring at tech companies, rollout should include manager guidance, employee notice, a review date and a simple route for reporting inaccurate data or a setting that no longer matches the written rule.
What they are actually being asked to do
Notice something. Decide whether it matters. Have a conversation or escalate. Record something, or not.
For a separate benchmark relevant to “Managers, Who Apply It”, consult the ENISA threat-landscape resources. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
Four judgements, none of which the document describes, all of which vary enormously between people.
The variation that results
One manager mentions things immediately and nothing becomes formal. Another notices nothing until it is serious. A third escalates everything because they are uncomfortable deciding.
Staff experience three different policies, correctly identify that the rule depends on who they report to, and conclude that the organisation does not have a position.
What managers need
The five live rules, same as the induction, so they know what they are enforcing.
The range of responses, which the proportionality note sets out and which is not written anywhere. Managers use the two they know about because nobody listed the others.
When to escalate, with examples rather than criteria.
And permission to resolve things themselves, explicitly, because the default assumption is that anything involving a policy belongs to somebody else.
One page, ten minutes in a managers' meeting, annually.
The example that does most of the work
Two or three short anonymised cases: this happened, here is what was done, here is why.
Abstract guidance produces no calibration. A worked example produces a lot, and the log from the consistency note supplies them.
The manager who is the problem
Occasionally the manager is the one sharing logins, or using the data for something, or telling the team a rule does not apply.
That settles the question for their whole team more decisively than any document, and it is a management matter rather than a policy one — which is to say it will not be fixed by reissuing anything.
What to ask them
What have you actually raised with somebody in the last year, and what happened?
The answers describe the operative policy better than any document, and collecting them annually is how the policy owner finds out what the organisation is really doing.
The worked example
Two or three short anonymised cases: this happened, this was done, here is why. Abstract guidance produces no calibration and a worked example produces a lot — and the outcome log supplies them.
The question to ask managers annually
What have you actually raised with somebody this year, and what happened? The answers describe the operative policy better than any document.
The example that does the work
Two or three anonymised cases: this happened, this was done, here is why. Abstract guidance produces no calibration and the outcome log supplies the examples.
What to ask managers annually
What have you actually raised with somebody this year, and what happened. Ten minutes in a managers' meeting, and the answers describe the operative policy more accurately than any document review.
Collecting them is also how the owner finds out which clauses are usable in a conversation, which is information available nowhere else and is the thing the annual review is otherwise missing.