Why separate policy process and procedure?