I advocate figuring out your open source strategy before you create an open source policy.
I've helped a number of companies create open source software policies and I've discovered that companies need to know what their open source strategy is before they can effectively implement a policy. If you are using open source software primarily to save money on licensing fees, you will have a different set of policies than if you were using open source software primarily to help create a non-competitive space to develop standards with your partners.
Often when I teach a policy workshop, I find that most of the people in the room (all from the same company) think they know their open source strategy - it's just that they don't all have the same strategy! So knowing and writing down the open source strategy should be every company's first step.