I am amazed at how many organizations have not updated or reviewed their post orders in years.
Every organization, despite the size, should have security policies and procedures. We all know that a policy is a statement from the organization addressing an issue. Procedures are the methods desired to achieve and support the policy.
Smaller companies might have policies regarding key control and issuance, parking, opening and closing times, electronic security system requirements, etc. The people responsible for these functions are typically employees that perform other duties.