Work from home and hybrid policy: eligibility, security and expenses

A designer moves to her parents' home in another city for a month. She works on a personal laptop over a shared home router, and she prints client mock-ups at a neighbourhood shop. Nobody approved any of it, because nobody had said what needed approval. Remote work is easy to allow and hard to govern, which is why it needs a written policy before it becomes a habit.

It defines who can work away from the office, how often, under what conditions, and how the permission can be changed or withdrawn. It also sets the minimum security that makes remote work safe for customers' data. Treat it as two policies sharing one page: an arrangement policy and a protection policy.

• Eligible roles: which jobs can be done remotely and which cannot, such as reception, hardware support or lab work.
• Frequency: fully remote, hybrid with set office days, or occasional.
• Equipment: who supplies the laptop, headset and monitor, and who pays for repairs.
• Approvals: who signs off a standing arrangement and who approves a one-off day.
• Reimbursement: whether you pay a fixed allowance or reimburse actual receipts, and for what.
• Attendance and security rules: how presence is recorded and what protections are compulsory.

Fully remote and hybrid are different commitments. A fully remote hire widens your talent pool but needs stronger onboarding and written availability rules. Hybrid keeps the team together but needs agreed anchor days, or the office is empty when someone needs a colleague. Choose by role, not by person, or you will hear about favouritism.

Cover working hours and availability: the hours when colleagues can reach the person, response time to messages, and attendance in team meetings with the camera expectation stated. Say how the employee marks attendance, per the attendance and working hours policy. Daily status reporting should be light, perhaps a short written update or a task board that the manager reads. Heavy reporting signals distrust and costs time.

Productivity expectations should be about outcomes agreed in advance. Avoid screen-activity tracking as a measure. If monitoring of any kind is used, the IT and internet usage policy must say so openly.

This part protects the company, so be exact. Require a company-managed device for any work with customer data, a VPN or approved secure access, a screen lock, and no work on public Wi-Fi without it. Ban printing of confidential material at home or at a shop. Say who may see the screen. Family members sharing a room is a real exposure, and a privacy screen or a closed door may be worth requiring.

Link the policy to password and access control, including multi-factor sign-in. Customer information should stay in approved systems, not in personal chat apps or personal email. A lost device must be reported the same day, using the route in the incident clause.

Employers have a duty of care at home too, within reason. Ask for a safe workspace with a proper chair, stable power and enough light, and offer an ergonomic checklist. Internet needs a minimum speed that you set as [number] Mbps and a backup, such as a mobile hotspot, for key staff.

On expenses, a fixed monthly allowance is simple, while receipt-based reimbursement is fairer for unusual costs. Name what is covered: broadband, a part of the electricity bill, a chair, a monitor, courier costs. Say what is not covered and the claim deadline. Working from another city or country raises tax, immigration and data-transfer questions, so require advance written approval and treat each case on its merits.

1. 1

   Request

   The employee submits a remote work request stating role, days, location, equipment held and the security checklist, signed off.

2. 2

   Manager reviews

   The manager confirms the role is eligible, the team can cope and the deliverables are measurable, then recommends.

3. 3

   HR and IT check

   HR checks the policy fit; IT checks the device, VPN and access, and issues anything missing.

4. 4

   Approval

   The named approver records the decision, the start date and a review date.

5. 5

   Review

   Every [number] months the manager and employee confirm that the arrangement is working, and the approver extends, changes or ends it.

Plan for the day the office is closed because of floods, strikes or a power failure. Say who declares emergency remote work, what is expected, and that the normal rules apply as far as they can. Permission should also be reviewable. State that it can be changed or withdrawn for business need, performance concerns or a security breach, with notice where practical and a stated reason.

Keep the remote work request, the approval note, the equipment issue slip and the security checklist in the employee file. Keep a register of who works where. Each person signs that they have read, understood and accepted the policy, with date and version, and the policy is reviewed yearly or after any security incident.

1. Title and ID: Work From Home and Hybrid Work Policy, HR-POL-004, version [number]
2. Purpose: to set who may work away from the office and under what conditions.
3. Scope: [roles] approved under this policy; roles listed in annexure A are not eligible.
4. Definitions: remote, hybrid, anchor day, company device, secure access.
5. Policy statements: hybrid staff attend the office [number] days a week; core hours are [times]; company devices only for customer data.
6. Procedure: request, manager review, HR and IT check, approval, periodic review.
7. Roles: employee, manager, HR, IT administrator and approver.
8. Approval authority: [role] for standing arrangements, [role] for other cities or countries.
9. Expenses: [allowance or receipts], claimed within [number] days.
10. Breach: insecure handling of data may end the arrangement and trigger the disciplinary route.
11. Forms: remote work request, equipment issue slip, security checklist.
12. Version, review and acknowledgement: yearly; employee confirms reading and acceptance.

The wider set of rules sits under GullyHR's HR policies and governance service, which covers drafting and review of documents like this one.