We were informed by our third party auditor we needed to have a policy for this. One was created a couple years ago and I am not sure if what we currently have is what we need. Looking for suggestions for where I can look to see what this policy needs to cover.