A draft workplace policy tends to arrive the same way as most legal documents: uninvited. A template from an HR subscription, a document your accountant forwarded with a note to "just make sure it looks right", or a first attempt from a manager who has seen a better one elsewhere. However it lands on your desk, you are now deciding whether to adopt it and what to change. That decision deserves more thought than it usually gets, because the document does two jobs at once. It tells your team the standards you expect, and it becomes the evidence you will point to if a regulator, a court, or the Fair Work Commission ever asks what steps you took to prevent a problem.
A workplace policy does not replace your employment contracts. It sits alongside them. The contracts set the terms of the relationship: duties, pay, leave entitlements, notice. The policy explains how those terms operate in practice and records the standards and procedures that keep the business lawful. No single Australian law requires you to have written policies, but several obligations are hard to meet without them. The work health and safety duty to consult workers, the positive duty to eliminate sexual harassment, and the anti-bullying jurisdiction of the Fair Work Commission all reward a documented, communicated and enforced approach.
The essential clauses of a workplace policy
The clauses below cover what most Australian employers need. They run in the order a policy reads: from statement of purpose through to the procedures that give it teeth. Not every business needs every clause, but the core ones repay the effort, and each carries a drafting choice or a trap worth knowing about.
Purpose and scope
Open with a short statement of what the policy is for and who it covers. Spell out whether it applies to employees only, or also to contractors, volunteers and agency staff, and whether it reaches multiple sites, client premises and remote work. This is not administrative detail. The Fair Work Commission's anti-bullying scheme protects workers, a category the law defines more broadly than employees, and the work health and safety duties run to anyone whose work the business influences or directs. If the policy says it applies to employees but the complaint process only accepts employee complaints, a bullied contractor falls through the gap.
Definitions
Define the terms the rest of the policy relies on: confidential information, personal information, manager, workplace, serious misconduct, health and safety incident. Where a term has a statutory meaning, use that meaning. Personal information should carry the definition it has in the Privacy Act 1988 (Cth), so that staff handling customer data are operating under the same concept the law uses. Workplace should not be read down to the office when work happens at client sites, work events or at home. A definition that quietly narrows the policy's reach is a trap; the conduct it fails to cover still happens.
Standards of conduct
The conduct clause sets out values and turns them into concrete rules: conflicts of interest, gifts and benefits, use of company property, confidentiality, and dealings with customers and suppliers. The drafting choice that matters here is the distinction between "will" and "may". Use "will" for the non-negotiables ("you will not accept gifts worth more than $100") and "may" where you want discretion ("management may ask you to declare outside employment"). A values-only clause ("we treat each other with respect") gives a manager nothing to act on when an issue arises. The rule needs to be specific enough to enforce and general enough to survive changes in how the business operates.
Bullying, harassment and discrimination
Prohibit discrimination, harassment, sexual harassment and bullying in plain language, and give examples of what each looks like. Keep the definition of bullying consistent with s 789FD of the Fair Work Act 2009 (Cth): repeated unreasonable behaviour towards a worker that creates a risk to health and safety. Then make the carve-out explicit: reasonable management action carried out in a reasonable manner is not bullying. That sentence does real work. Without it, managers read the policy as a ban on performance management and stop addressing underperformance, which creates a different set of problems.
The clause also carries a compliance load that has grown recently. Under s 47C of the Sex Discrimination Act 1984 (Cth), employers and persons conducting a business or undertaking must take reasonable and proportionate measures to eliminate sex discrimination, sexual harassment, hostile workplace environments and victimisation. A written policy that is trained, enforced and reviewed is one of the measures the Australian Human Rights Commission will look for. The Fair Work Act 2009 (Cth) separately lets workers apply for stop sexual harassment orders. In practice the clause should cover:
- Prohibited conduct: the categories above, defined in plain terms.
- Examples: what bullying, harassment and discrimination look like in your workplace.
- Reporting: where to go, including options outside the direct reporting line.
- No victimisation: a statement that anyone who raises a concern in good faith will not be penalised for it.
Complaints and investigation procedure
The procedure clause is where a policy earns its keep, because it is the part a regulator or the Commission actually reads when something goes wrong. Set out how a concern is raised, informally and formally, what happens next, who manages the matter, and the timeframes the business will work to. Provide an option to report to someone other than the direct manager, since the direct manager is often the subject of the complaint. State how each side will be supported and that victimisation will not be tolerated.
The drafting choice is to use "may" for the steps you want discretion over, such as whether an investigation is warranted or who conducts it, and "will" for the protections you cannot compromise. Two traps recur. The first is promising absolute confidentiality, which an investigation cannot always deliver; better to say that information will be shared only with those who need to know. The second is promising fixed timeframes a small business cannot meet. Both promises become enforceable commitments if the policy is later found to form part of the employment contract.
Leave and attendance
The leave clause should state the categories of leave available, the notice and evidence you require, how requests are made, and how flexible work arrangements are handled. The floor beneath all of this is the National Employment Standards (the NES) in the Fair Work Act 2009 (Cth): annual leave, personal and carer's leave, parental leave, and notice of termination are minimums a policy cannot undercut. The modern award covering your industry may add requirements on top, including consultation before significant change. The trap runs the other way too: promising more than the minimums, such as uncapped annual leave, creates entitlements and administration you did not plan for. State the evidence requirements plainly, because disputes about personal leave often turn on what evidence was requested and when.
Technology, communications and surveillance
Set out acceptable use of email, internet, devices and social media, and state what the business monitors and why. The monitoring part is legally sensitive. In New South Wales, the Workplace Surveillance Act 2005 (NSW) prohibits camera, computer and tracking surveillance of an employee without at least 14 days' prior written notice. The notice must say what kind of surveillance is involved, how it will be carried out, when it starts, whether it is continuous or intermittent, and whether it is for a limited period or ongoing. Cameras must be visible and signs posted at entrances, and tracking devices on vehicles must carry a visible notice. The Act also restricts an employer from blocking emails or internet access except in accordance with a policy that has been notified in advance. Other states have their own surveillance and recording laws, so check what applies where your people work.
The drafting point: if you intend to monitor, the policy is not just a courtesy, it is part of the legal basis for the monitoring. Write the clause to describe what is monitored and the notice you will give, and keep the promises modest. A clause that promises "no monitoring" while the business monitors is a credibility problem in any dispute.
Work health and safety
WHS is where a policy translates a statutory duty into a workable system. Under the Work Health and Safety Act 2011 (NSW), and the equivalent laws in other states and territories, a person conducting a business or undertaking (a PCBU) must ensure, so far as is reasonably practicable, the health and safety of workers and others. Risks must be eliminated, or minimised if elimination is not reasonably practicable. There is also a specific duty to consult workers who are likely to be directly affected by a WHS matter; in NSW that duty carries a maximum penalty of 1,214 penalty units for a body corporate. The policy should:
- Assign roles: who is responsible for hazard identification, risk controls, incident response and return to work.
- Set the reporting path: how hazards and near misses are reported, and how notifiable incidents reach the regulator.
- Cover everywhere work happens: client sites, vehicles and home offices, not just the office.
WHS is also the natural home for the mental health side of the business, which is where the anti-bullying and sexual harassment obligations meet safety law. A WHS clause that only talks about physical hazards is missing most of the modern risk profile.
Privacy and data handling
If the business handles personal information, the clause should cover how it is collected, used, stored and accessed, what staff may do with customer and employee data, and how a suspected data breach is reported internally. The Privacy Act 1988 (Cth) applies in full to most businesses with an annual turnover above $3 million; smaller businesses are generally exempt unless an exception applies. Where the Act applies, an entity that has reasonable grounds to believe an eligible data breach has occurred must prepare a statement and give it to the Office of the Australian Information Commissioner as soon as practicable, and notify affected individuals. The trap here is silence. Staff who do not know that a lost laptop or a misdirected email must be reported will not report it, and the business loses the chance to respond within the statutory timeframes.
Review, version control and acknowledgement
Name an owner for the policy, set a review date (at least annually, and after any significant law change), and add a version table so nobody relies on an outdated copy. Ask employees to confirm in writing that they have read and understood the policy, and keep the acknowledgements on file. They are the evidence of reasonable steps that regulators and courts ask about. Version control matters for a subtler reason. If a policy is later found to form part of an employment contract, an uncommunicated change to the policy may not bind anyone, so the record of what version applied when becomes legally significant.
Optional clauses that earn their place
The clauses above are the core. Add the ones below when a trigger applies to your business:
- Whistleblowing: public companies and large proprietary companies must maintain a whistleblower policy under Part 9.4AAA of the Corporations Act 2001 (Cth), covering who can make a protected disclosure and the protections that attach. Even if you are not captured, a short clause naming where concerns can be raised is cheap insurance.
- AI use: if your team uses generative AI, set out the permitted tools, what must not be entered (confidential or personal information), and the human review required before outputs are relied on.
- Remote and flexible work: location, hours, availability, equipment and safety at home. The WHS duty follows the worker to the home office, so the clause should say how home-based risks are reported and managed.
- Social media: external posts can harass colleagues or damage the business. A clause tying social media use back to the conduct standards closes a gap that workplace-only wording leaves open.
- Fitness for work: drug, alcohol and fatigue rules matter in safety-critical industries and less elsewhere. Add them only if your risk profile justifies it.
How an Artificer Legal employment lawyer reviews a workplace policy
A lawyer's value here is not longer sentences; it is mapping the obligations that actually apply to your business. That means identifying the modern award or enterprise agreement that covers your employees, what the NES requires on top, whether the Privacy Act applies at your turnover, which WHS law covers your state, and what surveillance rules apply to your monitoring plans. We then check the drafting choices that cause problems downstream: whether the policy is expressed to form part of the contract, whether the definitions track statutory meanings, whether the complaints procedure would satisfy the positive duty and the anti-bullying scheme, and whether the acknowledgement and version control loop will hold up as evidence. We also draft the clauses that are easiest to get wrong, such as the contractual status statement and the monitoring clause, so the policy does what you intend and no more. That last part matters: a policy that promises too much is a liability, and a policy that promises too little is a wasted document.
Whether your policy becomes part of the employment contract
The drafting choice that makes the difference between a policy that works and one that backfires is the sentence about its contractual status. Most templates get this wrong by silence, and silence is a risk. In Riverwood International Australia Pty Ltd v McCormick [2000] FCA 889, the Federal Court held that a human resources manual incorporated by reference into an offer letter made the redundancy terms in the manual contractually binding, entitling the employee to a payment the employer had not intended to give. The lesson is not to avoid policies; it is to decide deliberately what the document promises. An express statement that the policy does not form part of the employment contract and may be updated from time to time reduces the risk, but it is not a guarantee. A policy that is consistently applied and relied on can still be treated as part of the arrangement. Write only what you will enforce, enforce what you write, and review both regularly.
A policy that works, in short, has a clear purpose and scope, definitions that match the law, concrete conduct standards, a bullying and harassment clause that tracks s 789FD of the Fair Work Act 2009 (Cth) and the positive duty, a complaints procedure that protects everyone involved, and supporting clauses for leave, technology, WHS, privacy and records. Add the optional clauses your industry needs, get the contractual status statement right, and keep signed acknowledgements on file. Drafted that way, the policy protects the business. Left in a drawer, or written to promise more than you will deliver, it becomes a liability.