For us, the policy is very broad and essentially says we will do what the reg requires us to do. The program is more specific and includes each area required to be addressed by the reg (e.g., develop a program, train, report to board, record retention, etc.). The actual procedures are much more granular and those are in each department. So, the program might say a particular department is responsible for training and then that department's procedures would say how the training is done, etc.
I know that's probably not clear, but I hope it helps.
_________________________
Opinions expressed are mine and not necessarily those of my employer.