On this page
Key takeaways
Who should write company policies? Advisers or an outsourced team can draft them, but leaders must decide what each policy says, approve it and enforce it. A policy is a decision about how the business behaves. Some are required by law, such as a written health and safety policy once you employ five or more people. Each policy needs a named owner.
- Advisers draft; leaders decide, approve and enforce.
- Give every policy a named owner and review date.
- A written health and safety policy is required at 5+ employees.
- A policy nobody follows is worse than none.
Want your policy register and reviews managed for you? Message us on WhatsApp.
Chat on WhatsApp →Why must leaders own policies?
Because a policy commits the business to behaving in a certain way, and you will be judged on whether you follow it. A downloaded policy that does not match how you work can be used against you in a tribunal or by a regulator. Leaders must make sure it reflects real practice.
Which policies do small businesses need?
The list depends on size and sector, but most need these.
- Health and safety (written at 5+ employees).
- Disciplinary and grievance procedures.
- Data protection and privacy notices.
- Absence and holiday.
- Equality, bullying and harassment.
- Information security and acceptable use.
What can be outsourced?
Drafting from templates, checking against current law, formatting, keeping a policy register, scheduling reviews, sending policies to staff and recording acknowledgements. This keeps policies current without leaders writing them from scratch.
How often should policies be reviewed?
At least once a year, and when the law, the business or the way you work changes. The owner reads it, confirms it still matches practice, and approves any changes.
What does this look like in practice?
A pattern we see: a handbook bought online promises procedures the business never follows. Rewriting policies to match real practice, with an owner for each, makes them useful and defensible.
Policy ownership checklist
- List every policy in a register.
- Name an owner and review date for each.
- Check each matches real practice.
- Record staff acknowledgements.
- Review yearly and after changes.
Next step
Pick one policy and ask a manager whether the business actually does what it says. The answer tells you how much work your register needs.
Message us on WhatsApp, or book a 30-minute consultation.
Chat on WhatsApp →Sources and further reading
- Health and safety basics for your business · Health and Safety Executive
- Discipline and grievance · Acas
Frequently asked questions
Who should write company policies in a small business?
An HR adviser, solicitor or outsourced team can draft them, but the owners or managers responsible must decide what each policy says, approve it and make sure it is followed. Each policy should have a named owner and review date.
What policies are legally required for a small business?
Requirements depend on size and sector. Employers with five or more employees must have a written health and safety policy, and employers must provide written disciplinary and grievance procedures as part of employment terms. Data protection law requires privacy information for individuals.
How often should company policies be reviewed?
At least once a year, and whenever the law changes, the business changes or a policy proves not to work in practice. Record each review, any changes and who approved them.
Written by
Global Bridge Labs (GBL) is a UK–Sri Lanka partner for social media, websites and BPO. Everything here comes from client delivery, not theory.
