Our policy statements serve two purposes: dealing with the who, waht, where, why etc and as the "training" source document for employees and the board members. This has worked for years. No issues with examiners.

The fact that the policy statements are rather long has become an issue with respect to the board. One suggestion that came up was to provide a one page summary of key points, even in a bullet format and then allowing the board memebers to know that if they want to see the actual policy statement, they can ask for it. The policies would not be included in the booklets.

I can certainly put together the summary page, indicating any substantive changes, if any. This would be a new direction for us.

I was wondering whether or not anyone handles the board presentions that way, that is, very short policy summaries, no more than a page, maybe two at best.

If you do this, how do you deal with board member training expectations?

Thank you for your input.

Are these new policies, or annual renewals?

For renewals, I provide a recap of changes from prior policy, purpose of change, as well as the entire policy.

For new policies, they get the entire policy.

If I was a Board member, I would not want a summary, i'd read each one. The have a duty to do such.

I do exactly the same thing as Happy. I always provide the full policy along with the summary (for the renewals), but I do not do that for new ones - they get the whole thing.

I've been lucky, though, I guess. The chairman of the audit committee of my board reads every single word in everything I give him, he doesn't care for summaries. He takes his duties very seriously and I appreciate that.

Same as the above two folks, here.

For new I always provided the whole policy with a summary that discussed requirements, etc and how this policy addressed the issues, how it would be carried out, etc.

We do the same as above, they get the full policy and if it's a renewal, a memo cover-page summarizing changes.

Ditto to the aboves... always provide the full policy, with a memo summary page giving a high level review of the policy, plus detailing the changes.

For a new policy a summary page on the topic isn't a bad idea. But the policy is the direction the bank is following, per the board. When it sounds like the board doesn't want to be bothered having to look at the document they are responsible for, I am alarmed.

It is likely a problem you can't resolve, but I wouldn't want my examiners to hear this nor quiz that director about that policy. (You'd likely be posting in that thread "Things not to say to a compliance officer.")

So the recap is OK as a reminder of a few hi-lites, but it is not a substitute for knowing the policy.

Full Board would get a summary.
The Audit Committee would get the full report with the minor policy revisions with changes in the "Track" mode. They could see additions and deletions. (This does not work with major changes though.)

Good comments, folks. We revisited this again, here, to clarify practices/expectations. At issue is the length of the board packets as we currently provide them. With some policies, loans stats, etc. they can amount to over 200 pages. We discussed alternatives so that the key docusmnts appear at the beginning of the packets, say my summaries, and the actual policy statements, some loan reports can be at the back, like an appendix.

I guess one question that I have, again, is the length of the policy statements. As ours go into a lot of depth they are more a policy/procedures statement. In your banks, do you have rather succinct policies or are they running anywhere from 2-20 pages long?

For example, as it stands today, how many pages is your BSA Policy Statement (yes, I know margins and font, etc. factor in, but a rough ballpark would help.

Thank you.

Our BSA policy is 11 pages, we do not have a policy statement as a seperate document

HappyG: language usage on our part needs to be explained. Policy=policy statement.Same document.

Do you have separate OFAC, Patriot Act,Know Your Customer policies as well?

Mine is 42 pages, but includes all of that as well.

Really pretty irrelevant though. The contents of your policy will be driven by your risk assessment, and there are simply too many variables based on our bank's sizes, product offerings, geographic locations, risk tolerances, to try to make any sense of what one bank's policy length means to your bank.

We do not include our risk assessment decisions within the body of the policy statement.

I was looking for whether or not banks have rather generic policies, including the points that the regulation requires but then includes key bank "policies/practices" but not go into too much detail.

I remember one business where I worked they had very simple policy statements, key points only, and not very much elaboration. One page at best. I believe ours can be trimmed but I am very curious as to whether or not the trend is "more is better/safer" when it comes to the documents reviewed/approved by the board. the variables are significant from one bank to the next, in certain respects, however, there may be a norm that many follow, esp. community banks that are not multi-state, multi-national or that offer all kinds of "high risk' services.

I signed up for an upcoming webinar on this subject, hoping it will address this issue.

For policy approvals, one thing I used to do was advise the directors a month or two in advance of the presentation. They were given the opportunity to stop in the bank at any time and review them prior to submission. (Certainly e-versions could be made available today.) Then at the board meeting the actual policies were once again made available in complete form. The vote was then based on all the policies listed on page 10 of their packets.

New policies and those with substantive revisions would get some extra dialog but those with minor changes were essentially approved with little or no discussion.

Trees - more is just...more. Doesn't mean that it is better if it is just empty words that provide no benefit. If you can take your BSA policy and cover everything you need in 3 pages, then it is a good policy. If it takes 10 pages, then it takes 10. But, if it covers it in 3 but someone thinks it needs ot be 10 pages long as 3 is too short, then you have another issue. The goal shouldn't be how long a policy is or isn't, but what type of protection it affords the bank. Our wire policy is one of our most critical policies, it is only 6 1/2 pages long, but covers everything that is required to be covered.

We have no "generic" policies, each policy stand on its own.

Good points. as I used my policies to reflect key procedures, they included more info, making them more lengthly. For example, for BSA, I included a number of definitions.

I know there are no generic policies, each has to be tailored to the bank. However, as with SARS, I was wondering if there was some guidance, ie ensure the policy includes, say, what, why, designated responsibilities, a training expextation 9annual BSA, for example), etc. etc.

I am going back to square one on this (after all these years)

On the same topic, I noticed some of you idnciated that policies were reaffirmed with board committees rather than full board.

This may be one solution for us. For example, i can see tone at the top policies, and critical/high risk ones, such as BSA and Info Sec. Program still going to full board. However, we could argue that others, such as record retention policy, could be approved by the exec. or audit board committees.