Skip to main content
Compare approaches

A customer asked for your policies. What now?

There are four realistic ways to get compliance policies written in a UK SME. Here is what each actually costs, how long it takes, and when it is the wrong answer — including when we are.

No named competitors
Where we lose is on the page
Free to try before deciding

The short answer

Buy a template pack if you need paper today and someone who can edit it properly. Hire a consultant if the environment is complex or you need somebody accountable in the audit. Write them yourself if you have the time and already know what each standard expects. Use Quick Policy if you want documents specific to your business, with the gaps named, without a consultancy engagement — and you are happy to stay accountable for the result yourself.

The four approaches

Buying a policy template pack

A downloadable set of Word documents written for a generic organisation, which you edit to match your own.

Cost
Typically £50–£500, one-off
Time
Minutes to download, then days of editing

Best when: You need something on paper quickly, you have someone who knows what each clause should say, and nobody will look too closely.

Worst when: An assessor or a customer reads it. Generic packs describe controls you do not operate and miss the ones you do, and the gap is obvious to anyone who asks a follow-up question.

Hiring a compliance consultant

An experienced person interviews your team, writes policies specific to you, and usually helps with the audit itself.

Cost
Typically £600–£1,200 a day, often 5–15 days for a first programme
Time
Weeks, constrained by their diary and yours

Best when: The stakes are high, the environment is complex or heavily regulated, or you need someone accountable who will sit in the audit with you. For a genuinely complicated business this is still the best answer.

Worst when: The engagement ends. Policies age, the business changes, and the next review is another engagement — which is why so many organisations have an excellent policy set dated three years ago.

Writing them yourself

Someone internal — often an operations lead or a founder — reads the standard and writes the documents.

Cost
No invoice, but real time: commonly several full days per policy
Time
Months, in practice, because it competes with the day job

Best when: You know your own operations better than anyone and you have the time. Nobody will ever describe how your business works more accurately than you can.

Worst when: You are guessing at what a standard expects. Most of the time cost is not writing — it is working out what a clause is actually asking for, which is the part that does not get easier with effort.

Quick Policy

You answer questions about how your business actually operates, and the platform drafts policies from those answers, shows how they measure against the standards you selected, and keeps them under review.

Cost
Free to draft. £99/month, excl. VAT to publish
Time
A profile in under an hour, drafts the same day, then your review time

Best when: You want documents specific to your business without a consultancy engagement, and you want them to stay current rather than ageing quietly in a folder.

Worst when: You want someone to take accountability for the outcome, you are in a complex regulated environment that needs judgement rather than documentation, or you need certification itself — we produce the documents and show the gaps, and we cannot sit in your audit.

Costs for the first three are the ranges a UK SME typically encounters, not the result of a survey. Consultant day rates in particular vary a great deal by sector and scope.

The six questions worth asking

Four approaches to getting compliance policies written, compared across six criteria
QuestionTemplate packConsultantIn-houseQuick Policy
Is it specific to your business?The first question any assessor asks is about something in the document. A policy that describes a business other than yours fails at that point.No — generic, until you edit itYes — they interview youYes — nobody knows it betterYes — written from your answers
Does it tell you where the gaps are?Knowing a policy is missing something is more useful than a document that looks finished.NoYes, during the engagementOnly if you already knowYes — scored against ISO 27001, SOC 2 and UK GDPR
What happens in six months?Most compliance programmes do not fail at the start. They fail at the first review nobody ran.Nothing — it is a fileA new engagementIt depends on whether anyone remembersReview dates tracked, drafts kept current
Can your team sign it off?A policy nobody acknowledged is a document, not a control. Auditors ask for the record.Not built inUsually a manual process they set upWhatever you buildBuilt in, on a paid plan
Who is accountable for the result?This is the row where we lose, and it is worth being plain about it.YouThey are, contractually — the main reason to hire oneYouYou. We draft and we show the gaps; we do not certify you
What does it cost to start?Most of these require a decision before you can see whether the output is any good.Payment up frontA scoping call, then a proposalYour timeNothing — drafts are free to read before you decide

When Quick Policy is the wrong choice

If you need someone to take contractual accountability for your compliance outcome, hire a consultant. If you are in a complex regulated environment where the hard part is judgement rather than documentation, hire a consultant. If what you actually need is the certificate itself, you need an accredited certification body — we produce the documents and show the gaps, and no software can certify you.

What we are good at is the part in between: turning how your business actually works into documents that say so, showing you where they fall short of the standards you care about, and keeping that current instead of letting it age in a folder.

How the platform worksPricingCompliance glossary

Questions people ask at this point

Is Quick Policy a replacement for a compliance consultant?

Not for everything. A consultant brings judgement and accountability, and in a complex or heavily regulated environment that is worth paying for. Quick Policy replaces the documentation work — the drafting, the gap analysis and keeping it current — which is the part that is repetitive rather than judgement-heavy. Plenty of organisations use both: the platform for the documents, a consultant for the audit.

How is this different from buying a policy template pack?

A template pack gives every buyer the same document. Quick Policy asks about your systems, your people and how you actually operate, then writes from those answers — and where it needs a fact nobody has given it, such as who owns a control, it stops and asks rather than inventing one. You can read the full drafts before paying anything.

Does a generated policy make my organisation compliant?

No. It produces the documentation and shows you where the gaps are. Compliance depends on what you then do — operating the controls, keeping the evidence, and having someone accountable review and approve the policies. A green score against a standard means the policy says the right things, which is the first step and not the last.

What does it cost to find out whether the output is any good?

Nothing. The guided preview drafts your core policies and lets you read them in full, with no card required. Publishing them, exporting PDFs and sending them to your team for sign-off is what starts on a paid plan.

Read the drafts before you decide

Answer questions about how your business operates and Quick Policy drafts 4 core policies you can read in full. No card required — publishing, PDF exports, and team sign-off start on a paid plan.