A Policy is a high level document describing an organisation goal or posture e.g. security policy but a procedure is an imperative or step by step process of achieving a specific outcome. E.g. how to harden a server.