Rules

by John Bandler

We all have different perspectives on rules and here I break down my thoughts and put it in the context of self, family, groups, government, and law. My perspective comes from experience as a lawyer, in law enforcement, plus life experience.

Some of us may be more rule-abiding, wishing others behave similarly. Some of us may chafe at various rules, and be more rebellious or dismissive of requirements we are subject to. And there's a few who may want rules to apply to others but not themselves. Whatever our viewpoint, we can all agree that some rules (and adherence to them) are required for society, organizations, and families.

The entire field of law is about rules: rules of how people should conduct themselves, and rules about how to resolve a dispute on whether someone has violated a legal code of conduct, whether criminal or civil. I have written about laws, regulations, policies, and procedures, this article puts concepts about rules into a foundational framework.

Rules come from many places, including:Rules infographic

  • Parents and family
  • Ourselves
  • Society
  • Organizations
  • Government.

Let's discuss.

Our first rules as individuals (from parents)

We first experienced rules as children from our parents. Perhaps the first rules we remember are about not eating dessert until we are done with our main meal, and about bedtime. Hundreds of parental rules and teachings become part of our personal rules. Parents and family continue to provide rules and guidance throughout our life.

And as we age we become subject to more rules from different places, including from schools and government and society.

Our personal rules (ourselves)

Based on our upbringing, experiences, and all other things in our life, we develop personal rules that guide our conduct. Sometimes this is known as one's conscience, ethics, integrity, moral compass, values, or personal honor. Some may follow the "Golden Rule" which is to do unto others only as you would wish done to you.

Our personal rules are heavily influenced by external forces and are not fixed in stone, and like any rule, we don't always follow our personal rules.

Societal rules

Ever since humans began living together in communities these groups imposed rules. These rules were helpful to obtain food to eat, shelter, and protection. There might need to be a division of labor regarding who might hunt, gather, farm, cook, build, clean, or fight. Individuals needed to conform to certain rules for the greater good.

Today, "society" is a vague and amorphous term, overlapping with many areas, but clearly is a source of rules.

Government, organizations, and religion has played important roles in societal rules to influence behavior and establish codes of conduct.

Whatever the rules and wherever they come from, people have been breaking rules since the beginning so societies have always needed mechanisms to deter and punish such violations. It is worth a reminder that no society is perfect and not every rule is a good rule, but here we focus on the general principles and the need for good rules.

Organizational rules

People are part of organizations, and those organizations have rules. Organizations include:

  • Work (the organizations that employ us)
  • School (where we go to school)
  • Religious groups (a little duplication perhaps with the above)
  • Other associations we may have.

We return to this in a minute, since part of my work involves building and improving organizational rules, for example policies and procedures for cybersecurity.

Government rules ("laws" and "external rules")Rules infographic - laws outlined

The rules that come from government are what I consider to be "law" or "external rules".

Government rules include constitutions, duly enacted laws, regulations, and court decisions.

In my work as a lawyer with organizations and their cybersecurity, privacy, compliance, policies and procedures, we help develop their internal rules, and in that context it is helpful to think of external rules. An external rule is imposed upon a person or organization from outside, such as from the government. Obvious examples of such external rules are laws and regulations. Criminal laws are important external rules we should comply with. Then there are a myriad number of civil laws, including specific statutes and general legal principles for areas such as negligence and contract.

As organizations think about what their internal rules are (or should be) they must consider all applicable external rules.

Who interprets the rule?

It is worth noting that rules are interpreted by humans. Humans are not perfect, some are unreasonable, and even reasonable people may disagree.

The U.S. Constitution is the highest legal rule in our country, but there is plenty of disagreement about what this rule currently is, and it's interpretation has clearly evolved and even reversed prior interpretations throughout history. Thus, even where the words of this rule have been fixed and unchanging over hundreds of years, it's meaning and interpretation has changed

Looking even further to religious rules, which ostensibly come from the highest of powers, these rules are also interpreted by humans, and unquestionably these rules have changed and varied greatly throughout human history and among different religions and different segments of each religion. For those who follow the Bible, there are vastly different interpretations of its meaning.

Ethical, criminal, and civil rules in context

Rules Ethics Criminal Civil Law

I like a good Venn diagram which demonstrates how concepts overlap and differ. Putting these rules in context, I think of criminal laws as prohibiting the most extreme types of bad conduct, civil law may prohibit many actions already disallowed by criminal law plus more, and then ethics is an even higher standard of conduct encompassing all of the above plus more. (The diagram is not to scale, as only the most extreme of bad conduct is criminalized.)

There are a number of grey areas on how these overlap or differ but we can save that for another time. For example some acts might violate criminal law but not civil law, and one could argue some acts could be ethical even if they violate a law.

Internal rules of an organization

Internal rules are those that individuals, families, or organizations create.

In families, parents create rules about when children can have dessert, bedtime, curfew, and so on. Some parenting styles discuss these rules and the reasons for them with the child, and there may even be child involvement in the rule making process. Sometimes (rarely?) these rules are put in writing.

Organizations create internal rules to govern the organization and tell employees what they can and cannot do. These rules might be informal and cultural, provided directly and verbally, or in written form of policies, procedures, and other documentation.

Growing legal requirements (external rules such as laws and regulations) surrounding cybersecurity and privacy require a degree of written internal rules. Government sometimes takes the position that "unwritten rules" are often not worth the paper they are not printed on. Government often suggests that an early and important step towards compliance is creation and then enforcement of good internal written documentation.

Good management practices also suggest that quality written internal rules are necessary. Some areas are too complex to rely on unwritten understandings, and employees need proper guidance. The right degree of documentation helps the organization and individuals know what to do.

Policies and procedures are the common terms for such internal documentation, but a full list can include:

  • Policies (general rules)
  • Standards (more detailed rules)
  • Procedures (highly detailed steps to accomplish a task)
  • Guidelines (guidance, but not a rule)
  • Charters
  • Plans
  • Handbooks
  • Manuals
  • Employee agreements (codes of conduct, NDAs, confidentiality, etc.)
  • More!

Guidance

Well, guidance is not a rule, it is just a guide that we can follow, adapt to our needs, or disregard. But as organizations create internal rules, they might seek external guidance to develop those rules, and they might provide their employees with guidance (suggestions but not rules).

If we find ourselves debating whether something is a "rule" or a "guide", we should consider that rules generally allow a degree of thought and decision. Rules rarely specify the exact action to be done in response to exact circumstances. Thus I believe a document can be a "rule" while also providing guidance and allowing discretion on how to follow that rule.

Fairness of the rule and fairness of enforcement

Rules can be fair, unfair, or somewhere in between, and there will usually be room for reasonable people to debate that.

The next issue is enforcement of rules, and whether that is fair or not. Rules can be interpreted and enforced fairly, with consequences tailored to the infraction and person. Or they can be enforced unfairly, arbitrarily, or capriciously. Again, reasonable people will debate this as well.

Separating the two issues of:

  1. What is the rule (or what should it be), and
  2. How should the rule be enforced and punished,

can sometimes lead to a more productive debate, whether we are discussing a company's cybersecurity policy, the criminal justice system in general, or other matters. The goal is fair and reasonable rules, interpreted and enforced reasonably.

Action (what we do)

Let's not forget an important third aspect. Government creates and enforces rules for its inhabitants, and organizations create rules for its employees. The third aspect is what people actually do -- their action or practice. Those acts might be in compliance with rules or not, and sometimes it is hard to say either way and fodder for reasonable debate. The general goal is to get people to behave in accordance with external and internal rules.

Again, we are discussing general principles and most rules allow for a reasonable interpretation and enforcement.

Bandler's Three Platforms to Connect for complianceBandlers Three Platforms to Connect simple

My Three Platforms to Connect for organization compliance conceptually aligns three important areas.

First is the external rules imposed on us by government and other legal requirements, then organizations create internal rules (which should align with those external rules) and practice (action -- what is actually done) should be in compliance with both.

This is a rules based concept helpful for compliance, and I expand it to cover organization mission with my Four Platforms concept, and complete it with my Five Components for Policy Work.

Building internal rules

Creating and updating internal organizational rules is an important task and it should be done well.

I have read many organizational internal rules throughout the years, sometimes with writing that is difficult to read and understand, and subject to debate about what it means. This means that even management is confused about what it means, and lower-level employees are even more confused.

Good internal rules are clear and readable. They align with external rules without incorporating or creating indecipherable legalese. They clearly communicate what is expected. They are the right length and level of detail.

Good internal rules also evaluate whether there is helpful external guidance. External guidance is a guide, not a rule that must be followed.

Conclusion

Rules are all around us and come from many sources. Some are important for legal compliance purposes, others for our personal conduct, and we can evaluate the rule (and what the rule should be) and proper enforcement of those rules.

This short article is not tailored to your circumstances and is not legal or consulting advice.

If your organization needs help with improving its internal documentation and compliance with laws and regulations, including regarding cybersecurity and protecting from cybercrime, let me know.

Additional reading

This article is hosted at https://johnbandler.com/rules, copyright John Bandler, all rights reserved.

This article is also available on Medium.com at https://johnbandler.medium.com/rules-9d10f3df2557 (though not kept as up to date).

Originally posted 4/1/2022, updated 6/01/2024.