Forrester says that "enterprises run by policies" (in their report from May of this year, "How the Convergence of Business Rules, BPM and BI Will Drive Business Optimization").  In turn, "policies create processes and rules", which "consume" and "generate" (and validate) data.  (I like it!)

But, what is policy? And, if we know what policies are ... what are rules?

Stanford’s Policy Repository (http://www2.slac.stanford.edu/policy/definitions.asp) defines policy as “A statement of principles and/or values that mandate or constrain the performance of activities used in achieving institutional goals. A policy is general in nature, has broad application and helps to ensure compliance with: applicable laws and regulations; contract requirements; and delegation of authority by the University Board of Trustees. Policies promote operational efficiencies and reduce institutional risk. Policies do not contain requirements. Directives, processes, procedures, work instructions, and the like flow from policies and the requirements are specified in them.“

Well, I don’t think that we can formally define and implement these kinds of policies, but we can capture them (and the instruments where they are defined, such as documents), and then capture the details and artifacts (procedures, rules, work flows, etc.) which “flow from" them.  (Traceability and refinement are very important here, and I will be blogging more about this in coming months.)

As a counterpoint to the Stanford definition, we have the famous/infamous Wikipedia.  http://en.wikipedia.org/wiki/Policy defines policy as “a deliberate plan of action to guide decisions and achieve rational outcome(s)”. Wow! This is very different, and sounds more like a process (whenever people start to talk about "plans of action", I think process and workflow).

I would like to take the position that policy is indeed guiding principles and values - but that we can only analyze and encode more concrete forms of these, i.e. the processes and rules that flow from them. This then highlights the importance of capturing both the processes and rules - in conjunction, not in isolation/separate silos.  Too many tools/diagrams/models and businesses focus on only one of these aspects at a time!

So, what are processes?  Collections of connected activities, events, decision points and data input/output.  Yes, we can make this more complex - but I think that these are the basic concepts.

And, what are rules?  Specific invariants, constraints, directives, validation checks, etc. for the processes and the data. I could even go further to say that rules are only those things that are encoded in software - but I am not willing to take that step.  (Software isn't everything :-) - there are a lot of human processes and human rules.)  

Andrea