Patch Managment and Patching Policies

I am looking for resources or advice for writing a patch management policy.

I am wondering what other companies are doing that have mixed environments (Windows, Linux, Solaris and Mac). I know this is a vague question, but I am just trying to get others opinions and other view points on what needs to be included and what to avoid in writing these? Are there any SOXX requirements when it comes to patching that needs to be taken in to account. (We currently are not required to pass SOXX audits, but I want to write it so it will pass the SOXX muster)