Small Business Policy Templates: The Policies a Small Team Needs

Which policies does a small team actually need?

Start from the questions people ask, not from a list of every policy a large company has. This table is a starting point. What's required by law depends on where you are and how many people you employ, so check official guidance for each one before you mark it as required.

If you're not sure where to start, the policy causing the most mixed answers is usually the right first one. The picker further down helps.

A one-page policy format (copy this)

Every policy uses the same seven parts, so staff know where to look and managers give the same answer. Copy this into Word, Google Docs or wherever your policies live.

POLICY: [Name, e.g. Expenses]
ID and version: [POL-01 v1.0]      Replaces: [Old version, or "new"]
Approved by: [Name, role]          Date: [Date]

1. PURPOSE
   [One or two sentences: why this policy exists, in plain words]

2. WHO IT COVERS
   [Who it applies to, and who it doesn't, e.g. "All employees. Not freelancers."]

3. THE RULES
   1. [One rule per line, with a number wherever someone would ask how much,
      how long or how far ahead]
   2.
   3.
   [Name any other document that holds a rule, e.g. "Office days are set in
   the operations manual." Don't copy it here.]

4. IF YOU'RE UNSURE
   [Who to ask first, and who next]

5. IF IT'S BROKEN
   [What happens, e.g. "Handled under the disciplinary policy (POL-03)."]

6. POLICY OWNER
   [One named person and role]

7. REVIEW DATE
   [Date, or sooner if the law, your tools or the way you work changes]

Six checks before it goes out:

1. The five-minute test. Someone who hasn't seen it reads it and answers three questions it covers, in five minutes or less.
2. One page. If it won't fit, it's two policies, or it's carrying steps that belong in an SOP. Our guide to policy vs procedure shows where each one goes.
3. A number wherever it matters. Replace "reasonable", "normally" and "where possible" with a figure or a named person who decides.
4. Point, don't copy. Any rule held somewhere else is named, never retyped.
5. Contract terms flagged. Any rule about pay, hours, place of work or duties is marked for advice before it's approved.
6. Read aloud. Someone other than the writer reads it out. Rewrite wherever they stumble.

Which policy should you write first?

Pick the closest match to what's been happening.

Acceptable use policy template

An acceptable use policy covers how people use the business's devices, accounts and systems. Here's a starting point for the rules section. Adapt every line to how your team actually works.

THE RULES (acceptable use of IT)
1. Work devices and accounts are for work. Light personal use is fine if it
   doesn't affect your work or break any other rule here.
2. Never share your password or log in as someone else. Logins are managed in
   [password manager or system].
3. Turn on the screen lock on every work device, and lock it when you step away.
4. Only install software or connect a new tool after [named person] agrees.
5. Report a lost or stolen device to [named person] within [time], so access
   can be removed.
6. Client and staff information stays in [approved systems]. Don't move it to
   personal accounts or devices.
7. When you leave, return every device on your last day, and your access will
   be removed the same day.

Remote work policy template

A remote or hybrid working policy says where people can work and what's expected while they're away from the office. A starting point:

THE RULES (remote and hybrid working)
1. Office days are set in [document]. This policy covers working from home on
   other days.
2. Ask your line manager at least [number] working days ahead for an extra
   day at home, up to [number] a month.
3. Never on a day a client visit or team meeting is booked in the office.
4. Be reachable during core hours, [times], on [channel].
5. Work only on a secure connection, and keep screens and papers out of view
   of others.
6. Equipment: [what the business provides and who to ask].
7. This policy doesn't change anyone's contract. To change your working
   pattern for good, make a flexible working request instead.

That last line matters in the UK, where all employees have the legal right to request flexible working. A remote working policy sits alongside that process, so requests to change a working pattern for good still go through it.

Expenses policy template

An expenses policy stops the "can I claim this?" question being answered differently each time. A starting point:

THE RULES (expenses)
1. Ask [named person] before spending more than [amount] on the business.
2. You can claim: [list, e.g. travel to client sites, agreed training,
   equipment approved in advance].
3. You can't claim: [list, e.g. travel between home and your usual workplace].
4. Mileage: [rate, and where it's counted from].
5. Every claim needs a receipt and a line saying what it was for.
6. Submit claims by [day] each month. They're paid [when].
7. Claims are checked by [named person], who can ask for more detail.

Tax treatment of expenses and benefits varies, so check the rules before you set yours. In the UK, GOV.UK's expenses and benefits A to Z covers each type.

AI policy template

An AI use policy is the newest of the four, and the one most small teams don't have yet. Keep it to a page, and make the data rules easy to remember. Three colours work well.

THE RULES (AI use)
1. Approved tools: [list]. Ask [named person] before using any other.
2. Green: public information, and your own drafts with no client or staff
   details. Fine to use with approved tools.
3. Amber: internal information with no names or personal details. Approved
   tools only, with [settings, e.g. training on your data switched off].
4. Red: client information, staff information, passwords, financial details
   and anything under a confidentiality agreement. Never goes into an AI tool.
5. A person checks every AI output before it's used, and the person who uses
   it is responsible for it.
6. Anything going to a client is checked by [role] first.
7. New tools and changes to these rules are decided by [named person].

Keep a short list of approved tools alongside it: tool, owner, cost, and which colours of data may go in. Before writing the rules, ask the team what they already use. You'll get a more honest answer if nobody's in trouble for it.

Keep every policy in a register

Once you've got more than three or four policies, you need one list of them all. A policy register gives each policy one row: the policy, why it exists (required by law, expected or your choice), the owner, where it lives, the version, who approved it and when, the next review date, and whether staff have confirmed they've read it.

The register is what keeps your employee handbook current. The handbook lists the policies, and the register says which version is live and when each one is due for review. That post includes a register layout you can copy.

When a policy changes, follow the same order every time: update the policy, record who approved it, update the register, tell the people it covers, and keep the old version marked as replaced.

Before you publish a policy

Policies sit close to the law, especially anything about employment, data or safety. What's required differs by country, by sector and sometimes by the number of people you employ. Use official guidance where you are, have a qualified adviser check anything that touches contracts or legal duties, and write down who checked it and when. Nothing here is legal advice.

A policy written down still needs someone who owns it and a date it's next looked at, or it'll drift like any other document. That's the difference between a process and a system. The editable Policy Register, Policy Drafting Sheet and Policy Sign-Off Sheet come with the Communication, Governance and Visibility Vault, as done-for-you templates in Word and PDF with a filled-in example and a guide.