Corporate Policy Development & Review
Drafting and review of corporate policies covering conduct, fraud, privacy, related parties, CSR and compliance, with implementation guidance.
- Estimate Cost
- ₹10,000 – ₹50,000
- Typical duration
- 10 days
Service overview
A governance service focused on written internal rules that employees, management and boards can actually follow. The service connects legal requirements with how the company really operates.
Who needs it? / When is it needed?
Companies introducing new compliance processes or updating outdated policies.
Policy work is most useful before a policy change takes effect or a regulatory disclosure is due, rather than after the deadline has passed.
What to expect from the WCP Professionals
WCP professionals would first understand the company's actual operations, identify legal obligations and gaps and write a policy that reflects how the business works in practice.
How the work would proceed:
- WCP professionals would review the company's existing policy, reporting channels and real operating practices before drafting changes
- They would distinguish mandatory provisions from internal choices, assign responsibilities for approvals and escalation, and make sure the policy can actually be followed by employees and managers
- The final draft should be accompanied by an implementation note covering approvals, communication, training and periodic review
Key deliverables
- Policy document
- Implementation checklist
- Approval draft
- Reporting mechanism
- Periodic review note
Standard turnaround time
5–10 working days for a standard policy. Complex policies may take 2–3 weeks.
Timing depends on receiving accurate information on actual practices and on any missing approvals or regulator requirements.
Government fees, timelines & key outcomes
No government fee for drafting or reviewing a policy.
Some policies carry their own statutory step — for example, a CSR policy must be approved by the board and displayed on the company website, and listed entities must disclose specified policies on their website and in the annual report.
Key outcomes: board-approved policies that match how the company actually operates, with clear owners, reporting channels and review dates.
Forms & filings involved
Normally none for an internal policy unless the policy has a connected statutory filing or disclosure.
For listed entities, the applicable SEBI regulations and current circulars should be checked alongside company-law requirements.
Documents required
- Existing policy
- Organisational chart
- Applicable contracts
- Compliance history
- Relevant regulator requirements
What we need from you
Information on your actual internal practices rather than only the desired policy language.
Management should identify the approving authority and provide the business rationale for the policy.
Important conditions
A policy should not create obligations the company has no realistic mechanism to implement.
The service should not be treated as complete until the required approvals and any connected filings have been confirmed.
Additional information
Statutory anchors differ by policy:
- Vigil mechanism (whistleblower) — Section 177 of the Companies Act, 2013 and SEBI LODR
- Related-party transactions — Section 188 and SEBI LODR Regulation 23
- Insider trading code of conduct — SEBI (Prohibition of Insider Trading) Regulations, 2015
- CSR policy — Section 135 and the CSR Rules, 2014
- Privacy — the Digital Personal Data Protection Act, 2023 and its Rules
The policy areas covered include conduct, fraud, privacy, related parties, CSR and compliance.
The estimated cost covers indicative professional fees only. Government fees, stamp duty and taxes are payable at actuals.
How it works
- 1. Raise a service enquiry describing your requirement.
- 2. A Relationship Manager reviews it and opens it for bidding.
- 3. Pay into escrow and assign the professional you select.
- 4. Track progress to completion, then accept and release payment.
Frequently asked questions
Which companies must have a whistleblower (vigil) mechanism?
Listed companies, companies accepting public deposits and companies with borrowings from banks or public financial institutions above ₹50 crore, under Section 177 of the Companies Act, 2013.
Is a related-party transaction policy mandatory?
For listed entities, yes — SEBI LODR Regulation 23 requires a board-approved policy on materiality and dealing with related-party transactions.
Do companies need a privacy policy?
Any business processing personal data in India must meet the Digital Personal Data Protection Act, 2023, which includes giving clear notice of how data is used.
How often should corporate policies be reviewed?
At least annually, and whenever the law, the business model or the company's risk profile changes.