The 30 policies a growing company needs, and the order to write them

The eighth hire joins, and nobody can say what the leave rule, the notice period or the laptop rule is. Each question is settled by whoever happens to be asked, so two people get two answers. Written policies end that. They also take months if attempted all at once, so the sequence counts for more than the count.

This guide groups the thirty policies GullyHR uses as a working set, suggests a writing order, and links to a detailed guide for each. Every guide follows the same path: purpose, definitions, the decisions management must make, the procedure, records and review. Our HR policies and governance service drafts and reviews them.

A policy is a decision written down so that it applies to everyone alike. It is neither a wish list nor a contract. Each one in the set has a number, from HR-POL-001 onward, a named owner, an effective date and a version. Employees acknowledge each one, and each is reviewed on a schedule.

These are the rules every employee meets in the first week.

• code of conduct sets the standard of behaviour and is the anchor for the rest.
• The attendance and working hours policy fixes hours, late-arrival grace and overtime.
• The leave and holiday policy sets leave types, approvals and carry forward.
• The work from home and hybrid policy deals with who may work remotely, secure working and costs.

• recruitment and hiring runs from the approved headcount to the signed offer.
• employee onboarding handles joining papers, induction and the early weeks.
• probation and confirmation decides how a new joiner is reviewed and confirmed.

• salary and payroll governs pay day, error fixes and sign-off.
• performance appraisal covers goal setting, ratings and the appeal route.
• incentive and bonus ties variable pay to targets and says when it can be taken back.
• promotion and salary revision says who moves up and when, within pay bands.
• employee benefits lists what is offered and who is eligible.
• training and development plans learning, funds courses and tracks certificates.

These policies deal with difficult events. Three of them involve confidential cases that need restricted access, not an ordinary request queue.

• disciplinary and grievance sets a fair path for a complaint, an inquiry and a decision.
• POSH policy sets up the committee, complaint route and records, and is handled apart from ordinary grievances.
• whistleblower policy gives a safe route to report serious wrongdoing.
• resignation and exit covers the notice period, handover, clearances and final dues.

• confidentiality and non-disclosure sorts information by sensitivity and limits sharing.
• IT and internet usage governs devices, software, monitoring and AI tools at work.
• data privacy and security deals with who sees personal data, retention, vendors and breaches.
• password and access control covers account creation, multi-factor sign-in, review and removal.
• asset and laptop usage follows a laptop from issue to return.
• social media separates official accounts from personal posts.

• conflict of interest asks staff to declare outside interests and step back where needed.
• anti-bribery and anti-fraud puts controls on payments and gifts and sets how suspicions are examined.
• procurement and vendor sets who approves purchases and how suppliers are compared and checked.
• travel and expense reimbursement sets claim limits and approval levels.
• customer communication sets how fast customers hear back and when problems escalate.
• project management controls scope, status reports, change requests and sign-off.
• health and workplace safety deals with hazards, drills and accident reports.

You do not need all thirty before the next hire. Work through the steps below. Give each one an owner and a finish date.

1. 1

   Start with the first-week set

   Write the code of conduct, attendance and leave policies, and the confidentiality rules. Joiners need them in week one, and they take the least time to draft.

2. 2

   Add hiring and probation

   Recruitment, onboarding and probation policies stop offers, documents and confirmations being handled differently by each manager.

3. 3

   Fix pay and people processes

   Salary and payroll, benefits, disciplinary and grievance, and resignation and exit come next. Errors here cost trust fastest.

4. 4

   Put the risk set in place

   Data privacy, password and access control, IT usage, asset use and the POSH policy protect the company and its people. Do not leave these for a later quarter.

5. 5

   Complete the growth and integrity set

   Appraisal, promotion, incentive, training, conflict of interest, anti-bribery, whistleblower and the business policies follow as the company scales.

6. 6

   Review the full set once a year

   Check versions, acknowledgements and owners, and retire anything that no longer matches practice.

Policy no: HR-POL-[number]
Title: [policy name]
Owner: [role]
Approved by: [role]
Effective date: [date]
Version: [number]
Next review: [month and year]
Acknowledged by: [count of staff, tracked in a sheet]

Many policies touch each other. Leave interacts with attendance, appraisal with promotion, data privacy with passwords. Draft them with a shared glossary so that a term such as working day or confirmed employee means the same thing everywhere. Version numbers should move together at each yearly review.

To have a draft reviewed, describe your needs on the requirements form. More reading is on the GullyHR blog.