This checklist is for owners, ops leads and people leads at small UK companies who are building a policy set from scratch, or auditing the one they've got. Maybe it's a mix of old documents, half of them borrowed from somewhere else.
Using it is simple. Go down the list and tick off what you already have. For each policy, fill in an owner and a review date, and note where staff can actually find it. That last bit matters more than people think. A policy nobody can find is just a file.
Now, what does the law actually require in writing? Less than you'd guess. Staff must get a written statement of employment particulars. The principal statement comes on day one, and a wider statement follows "within 2 months of the start of employment", which must include "disciplinary and grievance procedures". Sick pay and procedures, other paid leave and notice also have to be covered on day one. "If you have five or more employees, you must write your policy down" for health and safety. And the ICO is blunt about privacy: "You must tell your workers" what you do with their personal information.
That's most of it. Part 1 below lists those, plus the notices and the one legal duty (sexual harassment) where a policy is the usual evidence. Everything in Part 2 is good practice: worth having, but not a legal box to tick. The reasoning and the sources for each row are in the guide, HR policies for UK small businesses: which ones the law actually requires. Filling this in doesn't make you compliant on its own; it shows you where the gaps are.
The template
Policy checklist
[Company name]
| Detail | Entry |
|---|---|
| Completed by | [Name] |
| Date completed | [DD/MM/YYYY] |
| Number of employees | [Number] |
| Where staff find policies | [Location, for example intranet link or shared drive path] |
| Next full review of this checklist | [DD/MM/YYYY] |
Part 1: required by law
| Policy | Required by law? | Source | Owner | Review date |
|---|---|---|---|---|
| Written statement (principal statement) | Yes. Given on day one; includes holiday entitlement | GOV.UK: written statement | [Name] | [DD/MM/YYYY] |
| Sick pay and procedures, other paid leave, notice periods | Yes. Information due on day one; can be a separate document staff have reasonable access to | GOV.UK: written statement | [Name] | [DD/MM/YYYY] |
| Disciplinary rules and procedure | Yes. Part of the wider written statement, within 2 months of starting; Acas Code says in writing, specific and clear | GOV.UK: written statement, Acas Code | [Name] | [DD/MM/YYYY] |
| Grievance procedure | Yes. Part of the wider written statement, within 2 months of starting; Acas Code applies | GOV.UK: written statement, Acas Code | [Name] | [DD/MM/YYYY] |
| Health and safety policy | Yes. Every business needs one; written down at 5 or more employees; share it and any changes | HSE: health and safety policy | [Name] | [DD/MM/YYYY] |
| Risk assessment record | Yes, at 5 or more employees. Record your significant findings | HSE: managing risk | [Name] | [DD/MM/YYYY] |
| Staff privacy notice | Yes. Tell workers your purposes, lawful basis, retention, sharing and their rights, at the time you collect their information | ICO: employment records | [Name] | [DD/MM/YYYY] |
| Appropriate policy document | Yes, only if you keep special category records (for example health) relying on the employment law condition | ICO: employment records | [Name] | [DD/MM/YYYY] |
| Monitoring information | Yes, if you monitor staff. Tell workers about any monitoring; clearly set out any policy the monitoring enforces | ICO: monitoring workers | [Name] | [DD/MM/YYYY] |
| Employers' liability certificate on display | Yes. Where employees can access it: workplace, website or intranet | GOV.UK: employers' liability insurance | [Name] | [DD/MM/YYYY] |
| Health and safety law poster or leaflet | Yes. Display the HSE-approved poster or give each worker the leaflet | HSE: law poster | [Name] | [DD/MM/YYYY] |
| Sexual harassment prevention | Legal duty to take reasonable steps ("all reasonable steps" from 30 October 2026). A written policy is a choice, but it is the usual way to show the steps | Acas: preventing sexual harassment | [Name] | [DD/MM/YYYY] |
Part 2: good practice
| Policy | Required by law? | Source | Owner | Review date |
|---|---|---|---|---|
| Code of conduct (standards of behaviour) | Good practice. Acas says put the standards of behaviour expected in writing | Acas: what must be written | [Name] | [DD/MM/YYYY] |
| Whistleblowing | Good practice. Not legally required | GOV.UK: whistleblowing | [Name] | [DD/MM/YYYY] |
| Equality, diversity and inclusion | Good practice. Acas has a free template | Acas: EDI policy template | [Name] | [DD/MM/YYYY] |
| Bullying, discrimination and harassment | Good practice. Can include your sexual harassment wording | Acas: preventing discrimination | [Name] | [DD/MM/YYYY] |
| Flexible working | Good practice. The Acas Code must be followed for statutory requests; a policy is optional | Acas Code on flexible working | [Name] | [DD/MM/YYYY] |
| Absence and leave (booking holiday, reporting absence, keeping in touch) | Good practice. Sick pay information itself is required, see Part 1 | Acas: absence policies | [Name] | [DD/MM/YYYY] |
| Expenses | Good practice. Acas says have one where you expect to pay expenses | Acas: expenses | [Name] | [DD/MM/YYYY] |
| AI use | Good practice. Acas says develop clear policies and consult staff | Acas: AI at work | [Name] | [DD/MM/YYYY] |
| Data retention schedule | Good practice. ICO says set one up | ICO: employment records | [Name] | [DD/MM/YYYY] |
| IT and acceptable use | Good practice. Must be clearly set out if your monitoring enforces it, see Part 1 | ICO: monitoring workers | [Name] | [DD/MM/YYYY] |
| Social media | Good practice | None | [Name] | [DD/MM/YYYY] |
| Homeworking and hybrid working | Good practice | None | [Name] | [DD/MM/YYYY] |
| [Your own policy] | Good practice | [Source, if any] | [Name] | [DD/MM/YYYY] |
Part 3: writing and running each policy
Copy this block for each policy.
| Detail | Entry |
|---|---|
| Policy name | [Policy name] |
| Owner (a named person, not a team) | [Name] |
| Approved by | [Name] |
| Version and date | [Version number], [DD/MM/YYYY] |
| Review date | [DD/MM/YYYY] |
| Where staff find it | [Location, for example intranet link] |
| Contractual or non-contractual | [Contractual / Non-contractual] |
| Referred to in the written statement? | [Yes / No] |
| How changes are announced | [For example all-staff email and team meeting] |
| Where the record of who has seen this version is kept | [Location] |
- One named owner, shown at the top of the policy
- Review date shown at the top of the policy
- One current version, in one place staff can find
- If the written statement relies on it, the statement says what it is and where to find it
- Labelled contractual or non-contractual
- Checked that it does not discriminate against anyone
- Staff told when it changes (changes to the written statement notified within one month)
- Record kept of who has seen the current version
Sign-off
| Detail | Entry |
|---|---|
| Checklist reviewed by | [Name] |
| Role | [Role] |
| Date | [DD/MM/YYYY] |
| Next review | [DD/MM/YYYY] |
Questions people ask
Do I need a whistleblowing policy?
No, the law doesn't require one. But GOV.UK says it is a good idea, so workers know how to raise concerns and managers know how to respond.
Is a sexual harassment policy legally required?
Having a policy is a choice. Taking action isn't: all employers must take reasonable steps to prevent sexual harassment, and from 30 October 2026 that becomes "all reasonable steps". A written policy is one of the clearer ways to show you're doing the work.
Do disciplinary and grievance rules have to be written down?
Yes. Disciplinary and grievance procedures are part of the wider written statement, due within 2 months of someone starting. The Acas Code also says they "should be set down in writing, be specific and clear", and tribunals can adjust awards by up to 25 per cent where it wasn't followed.
How often should I review company policies?
The law doesn't give most policies a fixed timetable. Health and safety law says revise your policy statement "as often as may be appropriate", and the ICO says you must regularly review your privacy information. Beyond that, review a policy when the law changes or when your business does, for example when you take on more staff or change how people work. The review date column is there so that's a decision you make on purpose, not one that drifts.
Are company policies part of the employment contract?
They can be. GOV.UK says an employer should make clear which parts of a contract are legally binding, so label which of your policies are contractual and which aren't. Staff shouldn't have to work it out for themselves.
Sources
The pages this template quotes and links, checked on 29 September 2026.
- gov.uk/employment-contracts-and-conditions/written-statement-of-employment-particulars
- hse.gov.uk/simple-health-safety/policy/index.htm
- ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/employment-practices-and-data-protection-keeping-employment-records/collecting-and-keeping-employment-records
- acas.org.uk/acas-code-of-practice-on-disciplinary-and-grievance-procedures/html
- hse.gov.uk/simple-health-safety/risk/steps-needed-to-manage-risk.htm
- ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/data-protection-and-monitoring-workers
- gov.uk/employers-liability-insurance
- hse.gov.uk/pubns/books/lawposter.htm
- acas.org.uk/sexual-harassment/steps-for-employers-to-prevent-sexual-harassment
- acas.org.uk/what-must-be-written-in-an-employment-contract/what-the-written-statement-must-include
- gov.uk/guidance/whistleblowing-guidance-for-employers
- acas.org.uk/equality-policy-template
- acas.org.uk/what-an-employer-can-do-to-prevent-discrimination
- acas.org.uk/acas-code-of-practice-on-flexible-working-requests/html
- acas.org.uk/creating-absence-policies
- acas.org.uk/expenses
- acas.org.uk/one-third-of-employers-think-ai-will-increase-productivity