In addition to specifying the penalties for unacceptable behavior, what else must a policy specify

Depending on what the policy is mandating, the policy must specify the behavior that is expected of the employee, student, recipient etc. The policy in question must state why said policy exists (benefits/legalities/conflict resolutions.) If the policy is to be found on company wide intranet or the internet, there must be links in said policy that leads to further knowledge on the policy matter. The policy should also list any applicable changes that have happened, i.e a history (if one is warranted)