Authority Document vs Policy

[DMH]

We are debating whether to setup our internal Quality Manual (which contains our basic IT general controls) as a Authority Document or a Policy.  Is there a reason why we couldn't\shouldn't setup as an Authority Document?  Appreciate any suggestions.

[Uncle Rob · Accepted solution]

Not a compliance expert, but it seems to me that Authority Documents are externally sourced and agreed upon as authoritative by multiple external parties:  ie. SOX, PCI, GDPR, etc.

Policies are things your company decides to do.  So if you have an internal quality manual there's a good argument that putting them in authority docs is just more work, when you can just as easily put them in policies instead.

[Adam Horwitz]

Robert is 100% correct. Nothing you create goes in Authority Documents. Your document is a policy and belongs in Policies.

[Community Alums]

Authority Document are external policies and Policy will be your internal ones. Robert and Adam are 100% correct! Authority Document is everything that has been published such as ISO, COBIT, SOX, etc. You should look to Policy, that's where internal policies should be hosted.

[Scott Ferguson]

If you internal quality manual is based on a framework or best practice, I suggest you import the official external document into the Authority document construct.  Your internal company interpretations of the best practice is in the policy hierarchy.   You basic IT controls are the control objectives, that link back to both the internal policy and the external regulation (as reference).