A policy sets out the practice’s agreed position, standards and responsibilities. A protocol describes an agreed approach to a defined situation, often including criteria, decisions and escalation. A procedure explains the practical steps needed to complete a task, including who does what and when.
These are useful working distinctions, rather than a rigid naming system used consistently across healthcare. Documents can overlap, and a single document may contain all three elements.
For a Practice Manager, the distinction helps identify what staff actually need. A statement of intent may leave them without usable instructions; a detailed workflow may omit responsibility for checking that it works. Good GP practice policy management connects those elements without creating unnecessary documents or repeating the same information across the library.
-
Policies establish expectations, protocols guide a defined response, and procedures describe execution. The most useful classification reflects the document’s purpose and audience. Its title should help staff understand what they will find inside.
Policy
Main Question it answers - What is the practice’s agreed position, and who is responsible?
Typical Content - Purpose, scope, standards, responsibilities and oversight.
Protocol
Main Question it answers - What approach should be followed in this situation?
Typical content - Conditions for use, decision points, actions, limits and escalation.
Procedure or standard operating procedure (SOP)
Main Question it answers - How is this task carried out?
Typical Content - Ordered steps, responsible roles, systems used, records and checks.
These distinctions are consistent with published NHS document-management approaches. Tees, Esk and Wear Valleys NHS Foundation Trust, for instance, distinguishes policy principles and responsibilities from the ordered actions in a procedure. That is an organisational convention, not a mandatory classification for GP practices.
“Protocol” is particularly variable. It commonly describes focused instructions for a particular situation or treatment, but may contain procedural steps too.
Here, procedure means a written operating instruction. It is separate from the use of the same word to describe a clinical intervention.
-
Choose the document according to the problem it must solve. Use a policy to establish expectations and accountability, a protocol to guide a defined response, and a procedure to make a task reproducible. Where a short document can do all of that clearly, separate files may add little value.
Start by identifying the reader. Partners considering governance responsibilities need different information from a receptionist completing a task during a busy session.
Then identify the missing instruction. Does the practice need to agree its overall approach? Are staff unclear about when to escalate? Or do they need practical directions for carrying out an agreed process?
Test-results management shows how these functions connect. The policy can establish responsibility for safe follow-up. Supporting protocols can address decisions and escalation, while procedures describe the relevant workflow and recording arrangements.
This distinction should help organise the content without creating three competing accounts of the same process. CQC’s test-results guidance explicitly allows practices to develop their own systems and protocols, provided they can demonstrate effectiveness. It also calls for regular audit of the system.
Separate documents are more useful where audiences, approval arrangements or rates of change differ. A system-specific procedure may need updating more frequently than the policy it supports.
-
CQC’s general governance requirements do not impose a universal policy–protocol–procedure hierarchy on GP practices. The relevant issue is whether the documented arrangements support safe services and effective governance. Specific guidance or an application requirement may nevertheless call for a particular document.
In England, Regulation 17 requires effective systems for monitoring quality, managing risks and maintaining appropriate records. Renaming a document does not establish that those systems work. See CQC’s Regulation 17 guidance.
Policy organisation may also support evidence under the published Governance, management and sustainability quality statement, which addresses clear responsibilities and accountability. The connection depends on staff understanding and implementation.
For registration or a specific information request, use the terminology requested and make the relevant content easy to identify. If a combined document contains both policy and procedure, its title and headings should make that clear.
CQC references here apply to England. Practices elsewhere in the UK should check their own regulatory arrangements.
-
A document’s title alone does not establish its legal status or the discretion available to staff. Requirements may arise from legislation, professional standards, contractual terms or approved local arrangements. The document should make those sources and any permitted exceptions clear.
Avoid teaching staff that policies are always mandatory while procedures are optional, or that a protocol automatically removes clinical judgement. None of those distinctions is reliable enough to guide practice.
An approved procedure may contain essential safety checks. A clinical protocol should state its scope, who may use it and when advice or escalation is needed. Where departure is appropriate, the relevant clinician should be able to explain the decision and record the reasoning where required.
The GMC expects its registrants to keep up with relevant law, know and use applicable guidance, and raise concerns where systems or procedures may put patients at risk.
Medicines documentation needs particular care. An ordinary local protocol does not, by its title, provide legal authority to supply or administer medicines. A Patient Group Direction has specific legal requirements, including authorisation, defined professional groups, clinical conditions and validity dates.
-
Every operational document should make its purpose, scope, ownership and current status clear. The detail should then match its function. Staff should be able to identify the action expected of them and where to seek help if the instructions do not cover the situation.
For a policy, prioritise the agreed standards, responsibilities, source requirements and arrangements for checking implementation.
For a protocol, define when it applies, relevant criteria, decision points, limits and escalation. Clinical content needs appropriate clinical review and approval.
For a procedure, set out the task in a usable sequence. Identify the responsible role, any necessary access or preparation, the records to make and what happens if a step cannot be completed. Avoid instructions that depend on unwritten local knowledge.
Across all three, record the version, approval details, effective date and review arrangements. Link to supporting documents rather than reproducing substantial sections in several places.
Format matters too. Short numbered steps may suit a procedure, while a clear flowchart can help with decisions in a protocol. A quick-reference sheet should remain consistent with the full approved instructions and have its own version control.
-
Treat related documents as a connected set, with clear ownership and links between them. When one changes, check whether the others need revision. Staff should not have to resolve contradictions between a policy, a protocol and an SOP themselves.
Keep a register showing each document’s type, scope, owner and related material. Review according to risk, applicable requirements and changes in practice rather than assuming that all protocols or procedures need the same interval.
Several avoidable problems can emerge:
The policy promises a process for which no usable procedure exists.
A procedure introduces responsibilities that the policy does not recognise.
A protocol contains clinical criteria copied from superseded guidance.
The same instructions appear in several documents and are updated differently.
A quick-reference sheet remains in use after the main document changes.
If documents conflict, ask the appropriate lead to resolve the issue promptly and communicate any interim instructions. A general rule that “the policy takes precedence” may not resolve whether the policy itself is outdated.
Keep approval records, a short change history and evidence of relevant communication or training. Acknowledgement confirms that information was received or read; discussion, observation or audit may be needed to establish that an important process is understood.
-
Check whether the library provides clear expectations, workable instructions and appropriate escalation for the practice’s significant activities. Consistent terminology helps, but correcting gaps and contradictions should take priority over relabelling every document. Begin with processes involving several staff groups or organisations.
Purpose: is it clear what the document is intended to achieve?
Audience: can the people expected to use it understand it?
Coverage: are responsibilities, decisions and practical steps all addressed somewhere?
Authority: are legal requirements and local choices distinguished accurately?
Scope: does it identify relevant services, sites, roles and limits?
Connections: do linked policies, protocols, procedures and forms agree?
Control: are ownership, approval, versions and review arrangements clear?
Use: can staff find the instructions and explain what they need to do?
For shared PCN services, confirm which organisation maintains the common document and who checks local arrangements. A shared protocol may still need practice-specific information about contacts, systems and escalation.
When reviewing an inherited library, leave useful documents in place while resolving their status. Reclassification should improve access and clarity without unnecessarily disrupting staff.
-
Choose one significant process and examine all the documents supporting it. Check whether they collectively explain the practice’s expectations, the decisions involved and the actions staff must take.
Identify the purpose of each document and any unnecessary overlap.
Resolve gaps or conflicting instructions with the relevant lead.
Confirm ownership, approval and links between documents.
Ask staff to use the revised material and report anything unclear.
The distinction is useful when it helps people find the right level of guidance and carry out their work consistently.