Sooner or later, every small business owner asks a version of the same question: “What policies should a small business have?”
Right now you might have a template pack as thick as a phone book, or you might have nothing written down at all, and a nagging feeling that you should.
With so many different laws it can be overwhelming knowing where to begin.
Unfortunately, there is no universal set. A restaurant owner, NDIS provider, and a civil engineer consultancy all have different obligations, and so do two businesses of the same size in different states. What triggers a requirement matters more than how many people you employ.
This article covers the nine documents the law requires in writing once a trigger applies, the seven core areas most employers need to manage, and the eight that can wait.
What are workplace policies?
Workplace policies are a practical way to guide expectations, explain how the business handles specific situations, reinforce workplace values and support legal compliance.
A useful and well-written policy answers three questions:
What is expected here?
Who should someone speak to when they need a decision or something goes wrong?
What will the business do next?
Why are workplace policies important?
In a nutshell, well-written policies help create a clear understanding of an expectation or process, which creates consistency and the ability to work at pace.
Three things policies achieve:
Set clear expectations: Clear policies help staff understand an expectation and process.
Defensible position: It gives managers something solid to stand on during a difficult question or conversation. If something goes wrong, a well-written and consistently applied policy is the difference between “we acted reasonably” and “we made it up as we went.”
If challenged, Fair Work and the courts tend to look at whether the rule existed, whether people knew it, and whether it was applied evenly.Additional time: Common questions get answered once and similar situations get handled consistently, which takes decisions off the owner’s desk.
The useful question underneath every policy isn’t “Do we have a bullying policy?” It’s “How do we want people to treat each other, and what will we do when that doesn’t happen?”
Start there, then check the legal requirements.
A policy only supports compliance if people know about it, understand it and see it applied.
Risks of not having HR policies
The risk of not having workplace policies is not that a regulator turns up and asks to see your folder. It’s when something goes wrong and you have a standard to point to.
Without policies, a business carries some risk:
Claims can become harder to defend. In an unfair dismissal claim, the Fair Work Commission will generally look at whether the person knew what was expected of them, whether they were warned, and whether they had a chance to respond.
There is no set standard. Decisions tend to get made from scratch, usually by the owner and usually under pressure.
Inconsistency can be used against you. People notice when a rule applies to one person and not another, and that difference can be used as evidence.
Disputes can escalate. Without an agreed process, small issues that could be easily resolved can evolve into formal or costly complaints.
Some gaps are a breach on their own. For sexual harassment, the law requires you to take proactive steps to prevent it. Take none and you are exposed already, whether or not anyone has complained.
Having a few well written policies allows you to show that proactive steps were taken, and staff are aware of the expectations.
Are workplace policies mandatory in Australia?
Most employment law regulates what you do, not just what you write. The clearest way to understand this is by separating them into three tiers:
Mandatory documents your business must have
Some workplace laws require specific documents. If the requirement applies to your business, you need to have the right document in place. No exceptions just because you're a small business.
The core policies that protect your business
The law doesn't always tell you which policy to write. But you still have obligations to meet. The right policies and processes help you put those obligations into practice and show what you've done to meet them.
The extras you can build over time
You don't need a policy for every possible situation on day one. Start with what your business needs now, then build as your team grows and new situations arise. Just remember that some obligations kick in when a request or issue comes up.
9 Workplace policies required by law
You don’t need a policy for everything. But there are some workplace documents your business is legally required to have, depending on your circumstances.
The nine categories below cover specific legal requirements and a catch-all for industry-specific obligations. Many small businesses won’t need all of them.
Before you start writing, check whether the requirement applies to your business. This is a screening list, not a complete guide to every requirement across every industry, state and territory.
If a requirement applies, getting the document’s title right isn’t enough. You also need to meet the relevant content requirements and deadlines.
Whistleblower policy
Applies to
Public companies, large proprietary companies (meeting two of: $50m consolidated revenue, $25m consolidated gross assets, 100 or more employees) and corporate trustees of APRA-regulated super funds.
⚠️ The whistleblower protections apply to all companies, whether or not a policy is required.
What it must cover
The protections available, who can receive a disclosure, how disclosures are investigated, how people named in a disclosure are treated fairly, and how staff can access the policy. Failing to have one is a strict liability offence. ASIC guidance.
Privacy policy
Applies to
Businesses covered by the Privacy Act, generally those with over $3 million annual turnover.
Some businesses are covered regardless of turnover: health service providers, businesses that trade in personal information, Commonwealth contractors, businesses related to a covered business, and reporting entities under the AML/CTF Act. Since 1 July 2026, that last group includes lawyers, accountants and real estate professionals providing designated services, so a three-person accounting firm that was exempt last year now needs a privacy policy.
What it must cover
How you collect, use, store and disclose personal information. From 10 December 2026, it must also describe the personal information used in computer programs that make, or substantially contribute to, decisions significantly affecting people. That can include recruitment and screening tools, and the obligation sits with the business using the tool rather than the vendor. OAIC guidance.
Review this policy
⚠️ Using AI in hiring changes what your privacy policy must say
From 10 December 2026, businesses covered by the Privacy Act must describe their use of automated decision-making in their privacy policy. This applies where a computer program uses personal information to make, or to do something substantially and directly related to making, a decision that could significantly affect a person's rights or interests.
Recruitment is the obvious one. Tools that screen, rank, score or shortlist candidates will often fall inside this, and so can systems used for rostering, performance or pay decisions.
Your privacy policy will need to set out:
- the types of personal information used in those programs
- the types of decisions made solely by those programs
- the types of decisions where the program carries out a step substantially and directly related to the decision, even when a person makes the final call
That last point is the one businesses miss. Keeping a human in the loop does not take you outside the requirement if the tool is doing meaningful work on the way to the decision.
What to do: list the tools you use that touch personal information, including anything your recruiter or platform runs on your behalf. The obligation sits with the business using the tool, not the vendor, so you may need to ask your supplier how theirs works. If your business is not covered by the Privacy Act, this does not apply to you yet, but the tools still carry fairness and discrimination risk. OAIC guidance on APP 1.8.
Computer surveillance policy
Applies to
Employers in NSW and the ACT that monitor devices, email or internet use.
What it must cover
What is monitored and how, with staff notified before monitoring starts. Workplace Surveillance Act 2005 (NSW) and Workplace Privacy Act 2011 (ACT).
Return to work program
Applies to
Most employers, under state and territory workers compensation laws. This one catches small businesses, not just large ones. NSW, WA, Tasmania and the ACT expect a written program or injury management system from most employers, whatever your size. Victoria, Queensland and South Australia set thresholds before the formal requirements bite (a standing return to work coordinator in Victoria, for example, only once total remuneration passes roughly $3 million), but all three still expect you to plan an injured worker's return. The NT only requires a written plan when a worker is likely to be off for more than 28 days. The triggers differ by state and several thresholds are indexed annually, so cross-check yours in Safe Work Australia's comparison of return to work program requirements.
What it must cover
How you support an injured worker back to work: who coordinates the return, how suitable duties are identified, and how the worker is consulted.
Emergency plan
Applies to
Every workplace in model WHS states and territories. Victoria covers this through its general OHS duty.
What it must cover
Emergency and evacuation procedures, emergency contacts, and how the plan is tested. Safe Work Australia guidance.
Child safety and wellbeing policy
Applies to
Organisations working with children. Victoria's Child Safe Standards, with equivalents in other states and territories.
What it must cover
Your commitment to child safety, a code of conduct, screening, and complaints handling. Victorian Child Safe Standards.
Gender equality policies or strategies
Applies to
Employers with 100 or more employees report to the Workplace Gender Equality Agency each year against six gender equality indicators.
Employers that directly employ 500 or more must also have a policy or strategy for each indicator.
What it must cover
Each of the six indicators: workforce gender composition, governing body composition, equal remuneration, flexible work and caring responsibilities, consultation with employees on gender equality, and preventing and responding to sexual harassment, sex-based harassment and discrimination.
This does not mean six separate documents. One strategy that clearly covers all six meets the requirement, and is usually the better document. WGEA Gender Equality Standards.
AML/CTF program
Applies to
Reporting entities, including lawyers, accountants and real estate professionals providing designated services since 1 July 2026.
What it must cover
A risk assessment of the money laundering and terrorism financing risks your business faces, plus policies, procedures, systems and controls to manage them. The program must be documented and approved by a senior manager. AUSTRAC guidance.
Sector requirements
Applies to
Listed companies, critical infrastructure, aged care, NDIS, childcare and financial services.
What it must cover
Set by your sector's own rules. Examples include a securities trading policy for listed companies and a risk management program for critical infrastructure.
When was the last time you reviewed your policies?
Contact us to get specialised support to make sure you're compliant.
7 Must-have policies for compliance
Although these seven policies are not universally required by name, they help you meet your legal obligations.
“What it must cover” means the practical essentials, noting that the legal requirements depend on your circumstances.
Each one maps to a duty that applies to every employer, regardless of size.
Respectful workplace policy
Applies to
Every employer and person conducting a business or undertaking. The positive duty applies regardless of business size.
What it must cover
Expected behaviour, with examples of what sexual harassment, sex-based harassment, discrimination, bullying, victimisation and a hostile workplace environment actually look like; reporting routes, including an alternative if the person involved is the manager or the owner; how complaints are handled; what support is available; protection against retaliation.
Critical to get right
Communicate it, train people and put it into practice. A policy alone is not enough to establish a defence to employer liability, and under the positive duty you are expected to act before a complaint is made. AHRC positive duty guidelines.
Review this policy
⚠️ The positive duty changed what is expected of you
Every employer and person conducting a business or undertaking now has a positive duty under the Sex Discrimination Act. The Australian Human Rights Commission has been able to enforce it since 12 December 2023. It applies no matter how small your business is.
The duty requires reasonable and proportionate measures to eliminate, as far as possible:
- sex discrimination in a work context
- sexual harassment connected with work
- sex-based harassment connected with work
- conduct that creates a workplace environment hostile on the ground of sex
- related acts of victimisation
The Commission assesses compliance against seven standards: leadership, culture, knowledge, risk management, support, reporting and response, and monitoring, evaluation and transparency.
What to do: read your respectful workplace policy against those seven standards. A policy written before the end of 2022 is unlikely to cover hostile workplace environments, and unlikely to describe the proactive steps the duty now expects. Responding well to complaints is no longer enough on its own. AHRC guidelines.
Equal employment opportunity policy
Applies to
Recommended for every employer to help meet anti-discrimination duties. It can sit inside the respectful workplace policy rather than standing alone.
What it must cover
Fair, job-related criteria for recruitment, pay, promotion, training and other employment decisions; reasonable adjustments where required; reporting and handling discrimination concerns.
Critical to get right
Apply it to employment decisions, not just workplace behaviour. A separate policy document is not universally required, but the anti-discrimination obligations still apply.
Health and safety policy, including psychosocial risks
Applies to
Every employer, under the applicable safety laws.
What it must cover
Safety responsibilities; identifying and controlling physical and psychosocial hazards; reporting hazards and incidents; worker consultation; emergency arrangements.
Critical to get right
Address risks such as excessive workload, unclear roles, poor support and aggression. Model WHS regulations also require a written emergency plan. Model code of practice on psychosocial hazards.
Consultation process
Applies to
Every employer for safety matters. Additional requirements apply where employees are covered by an award or enterprise agreement.
What it must cover
When consultation is required; who is involved; information to share; how workers give feedback; how that feedback is considered and recorded.
Critical to get right
Follow the timing and process required by the relevant law, award or agreement, including agreed safety consultation procedures. Missing required consultation can mean a redundancy is not genuine.
Raising concerns procedure
Applies to
Recommended for every employer, so workers have a clear way to raise workplace concerns.
What it must cover
Who to contact; an alternative if that person is involved; how concerns are handled; realistic response timeframes; confidentiality and protection against retaliation.
Critical to get right
Cover pay, rosters, safety and unfair treatment, not just harassment. It can sit within the respectful workplace policy, but the alternative reporting route must work in practice.
Performance and conduct process
Applies to
Recommended for every employer. Unfair dismissal protections depend on employee eligibility, and employers with fewer than 15 employees should use the Small Business Fair Dismissal Code.
What it must cover
How concerns are explained; an opportunity to respond; support and warnings where appropriate; support person requests; decisions and records.
Critical to get right
A valid reason does not replace a fair process. Do not unreasonably refuse a requested support person in dismissal discussions. Use a flexible guide rather than promising rigid stages for every situation. Fair Work unfair dismissal guidance.
IT and acceptable use policy
Applies to
Recommended wherever staff use work devices, systems or business information. Specific computer surveillance requirements apply in NSW and the ACT. See computer surveillance policy in Tier 1.
What it must cover
Acceptable use of devices, email and systems; information security; social media expectations; what is monitored and how; reporting security incidents.
Critical to get right
A general IT policy is not automatically enough to authorise surveillance. Meet the applicable policy and advance notice requirements, including the 14 day notice period in NSW and the ACT. Workplace Surveillance Act 2005 (NSW) and Workplace Privacy Act 2011 (ACT).
Also non-negotiable
The paperwork
Alongside the policies above sits the paperwork you cannot skip:
- the Fair Work Information Statement, given to every new employee
- correct payslips
- proper employee records
Add written employment contracts. The law does not strictly require a written contract, but it is your main record of what was agreed, and the first thing anyone asks for when there is a dispute. Fair Work small business guide.
8 Good practice workplace policies
Most of them can wait. Tier 3 documents become useful when a particular situation arises, and do very little before it. They earn their place as the business changes: when you appoint your first manager, when people start working from home regularly, when flexible work requests begin arriving.
⚠️ Having the formal policy can wait. However, the obligation underneath it usually cannot.
For example, a flexible work policy is optional. Responding to an eligible request in writing within 21 days is not.
Code of conduct
Applies to
Useful when you appoint managers or need clearer, consistent workplace standards.
What it should cover
Expected behaviour; conflicts of interest; confidentiality; use of business resources; how concerns and breaches are handled.
Critical to get right
Keep it short and consistent with your respectful workplace policy. Managers need to model the standards, not just ask staff to sign them.
Employee handbook
Applies to
Useful when staff need one place to find your policies and workplace information.
What it should cover
Where to find current policies; key contacts; everyday procedures; how updates are communicated.
Critical to get right
It is a way to organise your documents, not another set of rules. Avoid duplicating contracts or creating conflicting promises.
Working from home policy or checklist
Applies to
Useful when employees work from home regularly.
What it should cover
Agreed arrangements; availability and communication; equipment; workspace safety; information security; how arrangements are reviewed.
Critical to get right
Your safety duties still apply at home. A practical safety checklist matters more than a lengthy policy.
Flexible work procedure
Applies to
Useful when flexible work requests start arriving.
What it should cover
Who handles requests; how they are discussed and assessed; response timeframes; written outcomes; review and dispute options.
Critical to get right
A procedure can wait, but legal obligations cannot. Eligible statutory requests require a written response within 21 days and compliance with the Fair Work Act's process. The right to disconnect sits alongside this, so factor out-of-hours contact into how arrangements are agreed. Fair Work flexible working fact sheet.
Leave policy or procedure
Applies to
Useful when you offer additional leave benefits or need a consistent request process.
What it should cover
How leave is requested and approved; who to contact; any benefits above minimum entitlements.
Critical to get right
Do not rewrite the National Employment Standards or your award as a second rulebook. Refer to current entitlements and explain your process and any extras. Fair Work small business guide.
Recruitment and onboarding procedure
Applies to
Useful when you hire regularly or several managers are involved.
What it should cover
Role approval; selection criteria; interviews and checks; offers; induction; responsibilities; required documents and training.
Critical to get right
Use consistent, job-related criteria. Required information statements and employment records cannot wait until you have a formal procedure.
Drug and alcohol policy
Applies to
Relevant to safety-critical work or an identified workplace risk. Some regulated industries have specific requirements.
What it should cover
Fitness for work; prohibited conduct; reporting concerns; responding to impairment; support; any lawful testing arrangements.
Critical to get right
Do not assume this can always wait. Safety-sensitive aviation work, for example, has specific drug and alcohol management requirements. CASA drug and alcohol management plans.
AI use policy
Applies to
Useful when staff use AI tools, especially with client or employee information.
What it should cover
Approved tools and uses; restricted information; human review; accuracy checks; accountability; reporting problems.
Critical to get right
Set rules before sensitive information is entered into tools. An AI policy does not replace privacy, security or confidentiality controls. See privacy policy in Tier 1 for the automated decision-making changes from 10 December 2026.
Alternatives: What if nobody reads the policy?
Businesses often assume the way to communicate a rule is to write a policy and that is enough. A policy gives people a reference point, but it is not a teaching method on its own.
A short discussion using a real workplace scenario, or a manager walking someone through a task, usually lands better than another document to read.
Ask people what they would do, explain the decision and give them a chance to practice or ask questions.
Other useful options include:
Induction walkthroughs: show a new starter how to raise a concern, report a hazard or request leave.
Team briefings and toolbox talks: discuss one relevant risk or change, rather than reading out the whole policy.
One-page checklists and decision guides: put the steps where the decision happens, such as a hiring checklist or a guide beside the incident reporting form.
Visual guides and signage: a simple diagram where the work happens is read far more often than a document in a folder.
Short demonstrations or videos: show the process, then check understanding rather than recording attendance alone.
Screen savers and intranet prompts: good for keeping one message in front of people, such as who to contact to raise a concern.
Need help with your HR policies?
We can support you with writing policies that are created specifically for your business and industry.
