Semantically, we can define and differentiate these four terms but operationally, in day to day usage, these terms blur. Here is my attempt to distinguish the terms, with the terms laid out in diminishing order of formality.
Policies lay out strong guidelines or mandates for how to handle important circumstances, including those that someone else, possibly outside the legal department, might want to test for compliance. For example, the general counsel publishes a policy regarding how deputy general counsel can respond to calls from journalists, or how the department will refer all subpoenas to the head of litigation, or how the department will henceforth only review contracts above a certain monetary value.
Procedures, as in “Standard Operating Procedures,” are prescribed steps laid out in guidelines and manuals. Procedures are not as formalized as policies; an Inspector General would not audit them for compliance. Procedures codify the proper way to do things. If people follow them, for example, you can assume that things are filed in a way that someone else can find them or that secretaries consistently order ink toner for printers..
Processes are step-by-step repeated activities; some of them spelled out in a procedure, but most un-memorialized; practices are how members of the law department respond to a situation, such as a law firm’s possible conflict of interest. Processes can vary even within a single department; I have devoted many posts to the concept and to examples. (See my post of April 9, 2009 #2: process maps with 6 references; and July 13, 2008: processes pulled together with 26 references.).
Practices are the steps a law department commonly follow to accomplish something. For example, a practice is to forward all subpoenas to a specific paralegal. A practice can be a single step – send all incoming journals to the library – whereas a process has multiple steps. Practices can be even more variable than processes: the real estate lawyers meet for monthly brown bag lunches, but no other group does (See my post of Oct. 10, 2006: “policies” are formalized compared to “practices” that are simply just done.). Far less strategic than a policy, not so important as to justify procedural commemoration, probably more variable than processes, practices are how things get done (See my post of Feb.14, 2009: best practices with 24 references and one metapost; and March 23, 2009: pros and cons of various practices, with 13 references and two metaposts.). Policies are formal statements and are unusual; practices grow up over time, typically, but sometimes are laid out in guidelines and manuals (See my post of April 22, 2009: Cisco’s guidelines for patent prosecution.).