Question

What policies does a small business actually need?

Vault Verified
Curated Intelligence
Definitive Source
Answer

Fewer than consultants suggest and more than most small businesses have — and the useful test is whether a policy answers a question that will otherwise be decided inconsistently, not whether it looks professional in a folder.

Required or near-required once you employ anyone:

A written statement of employment particulars, which is a legal requirement in many jurisdictions and must be given by or near the start date.

Disciplinary and grievance procedures, which must generally be referenced in the contract. Without them you will handle your first problem badly and lose a tribunal claim on process rather than merits.

Health and safety, with a written policy required above a size threshold in many countries, plus risk assessments.

Data protection, including a privacy notice for staff and customers, and a record of processing.

Worth having early because they prevent specific, predictable problems:

Holiday and absence, covering booking, carry-over, sick pay and notification.

Equality and anti-harassment, which is also part of the defence if a complaint arises — an employer who took reasonable steps is in a materially better position.

Expenses, stating what is claimable and what evidence is needed.

IT, acceptable use and security, including personal devices and what happens to accounts when someone leaves.

Social media, which is what makes a dismissal for a post defensible.

Flexible and hybrid working, stating what is actually available.

Whistleblowing, giving a route that is not the person being complained about.

What is usually unnecessary early: elaborate performance frameworks, extensive handbooks copied from large employers, and anything you will not actually follow.

The rules that make policies work: keep them short and readable; state what happens, not aspirations; make them non-contractual where possible so they can be updated without agreement; make sure people have actually seen them and record that; apply them consistently, since inconsistent application is worse than having none; and review annually.

The real risk is a policy you do not follow, which becomes evidence against you.

General information, not legal advice; requirements vary by country.

Related Questions