Company Policy: 8 Essential Policies Every Small Business Needs

My first employee dispute was about PTO. An employee took a Friday off, assumed it was paid, and was surprised when their paycheck was short. I assumed unpaid time off was the default since I had never said otherwise. We were both operating on assumptions because I had never written a PTO policy. It was a $200 problem that took three hours to resolve and damaged trust that took months to rebuild.

That was at 6 employees. By 12, I had a similar issue with every topic I had not documented: what counts as a sick day, whether personal devices can access company email, what happens if someone is consistently late. Each time, the answer was "we do not have a policy on that," followed by an awkward improvised decision that felt unfair to someone.

Company policies are not bureaucracy. They are answers to questions your employees will definitely ask, written down before the question creates a conflict. This guide covers what a company policy actually is, the 8 policies every small business needs, how to write them without a legal team, how to make sure employees actually read them, and the delivery-and-signature loop that turns a document into a defensible business practice. That loop (write the policy, deliver it during onboarding, collect an e-signature, store it in the employee's file, make it accessible in a portal) is exactly how FirstHR handles policy management for small and growing teams.

What Is a Company Policy?

A company policy is a written document that defines a rule, standard, or expectation for how employees and the organization operate. It answers the question "what is our position on X?" where X is anything from time off to harassment to social media use.

The practical distinction between a policy you need and one you do not: if two reasonable people could interpret a situation differently and reach different conclusions, you need a policy. "Can I work from home on Fridays?" is a policy question. "Is theft allowed?" is not (that is already covered by law). Policies fill the gaps between common sense and the specific expectations of your company.

Why Company Policies Matter for Small Businesses

For small businesses specifically, policies matter more per employee because there is no HR department to mediate disputes. When a conflict arises at a small company, the founder resolves it. A written policy gives the founder a defensible basis for the decision ("our PTO policy states that requests require 5 business days notice") instead of an improvised judgment that may seem unfair.

The cost of getting this wrong lands early. According to SHRM, up to 20% of employee turnover happens within the first 45 days on the job, which is exactly the window where a new hire is still guessing at rules nobody wrote down.

8 Essential Company Policies for Small Businesses

You do not need 40 policies at a small business. You need 8 that cover the situations most likely to create conflict, legal exposure, or confusion. These 8 policies address the gaps where assumptions diverge and disputes emerge.

1. Equal Employment Opportunity (EEO)

States that the company does not discriminate based on race, color, religion, sex, national origin, age, disability, or genetic information. Title VII, the ADA, and GINA reach an employer with 15 or more employees for each working day in each of 20 or more calendar weeks in the current or preceding year, and the ADEA starts at 20.

Do not read those thresholds as permission to wait. The federal Equal Pay Act has no headcount floor at all, so equal pay for equal work applies from your first employee, and a written EEO policy is the cheapest evidence that the standard was in place all along.

2. Anti-Harassment and Anti-Discrimination

Defines what constitutes harassment (including sexual harassment), how to report it, and how reports are investigated. Even where no state mandates it, the policy is what demonstrates that the standard was communicated and a reporting route existed before anything went wrong.

State mandates land at very different sizes. California requires a written policy and interactive training at five or more employees, Connecticut at three, Maine at 15, and Delaware at 50 for training, while New York and Illinois reach every employer at any size.

3. Attendance and PTO

Covers expected working hours, how PTO is earned and used, how to request time off, and what constitutes an unexcused absence. This is the single most common source of employee disputes at small businesses because expectations vary wildly without documentation. Include your PTO accrual rate, the request process, blackout periods (if any), and what happens to unused PTO at termination (varies by state).

4. At-Will Employment

Clarifies that employment is at-will: either party can end the relationship at any time, for any legal reason, with or without notice. This policy is essential in at-will states (49 of 50, Montana being the exception after probationary period) because it prevents implied contract claims. Include it in the offer letter, the employee handbook, and as a standalone signed acknowledgment.

5. Acceptable Use (Technology)

Defines how company devices, email, internet, and software should be used. Covers whether personal use is permitted, whether the company monitors activity, data security expectations, and what happens to access when someone leaves. This policy becomes critical the moment an employee uses a personal device for work or accesses company data from home. Before you write the monitoring section, check the employee monitoring laws in your state, because notice and consent rules vary.

6. Health and Safety

Outlines workplace safety standards, hazard reporting, emergency procedures, and your commitment to OSHA compliance. The general duty clause at Section 5(a)(1) of the OSH Act requires every employer to furnish a place of employment free from recognized hazards that are causing or are likely to cause death or serious physical harm, with no headcount threshold anywhere in it.

Scope follows your operation. For an office-based small business the policy covers ergonomics, fire evacuation, where the first aid kit lives, and how to report an incident. For a business with physical operations it gets longer and more specific to the hazards of the trade.

7. Code of Conduct

Defines expected behavior, ethical standards, and professional conduct. Covers honesty, respect, confidentiality, conflicts of interest, and the consequences of violating the code. This policy sets the cultural baseline: "this is how we behave here." It is broader than specific operational policies and serves as the umbrella under which other policies sit.

8. Social Media

Addresses employee conduct on social media regarding the company, its products, its customers, and its employees. This is the policy most likely to be drafted too broadly and then be unenforceable.

The constraint is federal labor law. Section 7 of the NLRA protects concerted activities for collective bargaining or other mutual aid or protection, with no headcount floor and whether or not a union is involved, so a blanket ban on company-related posts will not hold. What the policy can do is set guidelines for representing the company, protecting confidential information, and separating personal opinion from official position.

Which Policies at Which Company Size

The employee count thresholds are not arbitrary. Federal and state laws activate at specific headcounts: 15 employees triggers Title VII, the ADA, and GINA; 20 triggers COBRA and the ADEA; 50 triggers FMLA and the ACA applicable large employer rules. Each threshold adds compliance obligations that your policies must address.

Crossing 50 changes your handbook directly rather than just your obligations. Under 29 CFR 825.300(a)(3), a covered employer with eligible employees must include the FMLA general notice in its employee handbook or other written guidance on benefits and leave rights, where such written materials exist, or hand a copy to each new employee at hiring.

The HR Policy Development Process

Knowing which policies you need is one thing; building them is another. HR policy development is the process of going from no documented rules to a working set of policies that people have actually read and that hold up when tested. Most small businesses skip straight to drafting, which is why they end up with policies copied from a company ten times their size, never reviewed by anyone, and unsigned by half the team. The seven phases below are the sequence that avoids that.

Two phases carry most of the weight. The needs assessment determines whether you end up with the 8 policies your business actually needs or a 40-policy manual nobody reads; the honest version of this step is simply listing every question an employee has asked that you had to improvise an answer to. And communication with signed acknowledgments is what converts a document into protection, since an unsigned policy proves nothing about what the employee was told. Everything between those two is craft; those two are the difference between a policy program that works and one that exists.

The whole process is a cycle, not a project with an end date. A policy set built once and never revisited drifts out of alignment with the law and with how your company actually operates, usually within two years. Set the annual review date when you finish the first round, and treat headcount thresholds and law changes as triggers that pull the review forward.

The worksheet below is the needs assessment written down: the log of questions you had to improvise an answer to, the headcount thresholds you have crossed, the candidate policies ranked by exposure, and the ones you are deliberately not writing this round.

How to Write a Company Policy

Keep each policy to one page. Two pages maximum. The longer the policy, the less likely employees are to read it. If a topic requires more than two pages, split it into a policy (the rule) and a separate procedure document (the detailed steps).

Policies and Procedures: Where They Split

A company policy states the rule and the procedure states the steps, and a small business needs both written down only where the steps are not obvious. The attendance policy says the day starts at nine. The procedure says how to request a late start, who approves it, and how much notice counts.

At 15 people, most of ours lived in one document with the procedure at the bottom, and that is usually the right shape at this size. Split them apart when the steps change more often than the rule does, or when a manager runs the steps and everyone else only needs to know the rule.

Making Sure Employees Actually Read Your Policies

A policy that sits in a Google Drive folder nobody opens does not protect your business. The policy only matters when employees have received it, read it, and signed an acknowledgment confirming they understood it. That acknowledgment is the document you produce when a dispute arises: "The employee was informed of this policy on their start date and signed an acknowledgment. Here is the signed copy."

Running that loop means knowing, at any moment, which version of which policy each person has signed. The workbook below keeps the register of policies and versions on one tab and the per-employee acknowledgments on another, so the answer to that question is a filter rather than a search through email.

This five-step loop (deliver, sign, store, access, re-sign) is the difference between policies that protect your business and policies that exist on paper but carry no legal weight. It also puts the manager in the loop, which matters: according to Gallup, employees are 3.4 times as likely to call their onboarding successful when the manager takes an active role in it.

Updating Company Policies

Policies are not static documents. Laws change, your company grows, and new situations arise that existing policies do not cover. A structured update process prevents your policies from becoming outdated and legally insufficient.

When you update a policy, the update is meaningless until employees acknowledge the new version. Re-distribute the updated policy, collect new e-signatures, and store the new acknowledgments alongside the original versions. Version history matters: you need to know which version each employee signed and when.

Headcount is the trigger people forget, because it moves without anyone filing paperwork. The EEOC publishes a small business page that walks through which of the laws it enforces apply at which size, and it is worth rereading the January you notice the team has grown.

Common Company Policy Mistakes

The most damaging mistake is inconsistent enforcement. If your attendance policy says unexcused absences result in a written warning, but you only enforce it for some employees, you have created evidence of discriminatory treatment. Every policy you write must be enforced the same way for everyone. If a policy is too strict to enforce consistently, rewrite it to a standard you can actually maintain.

Frequently Asked Questions