StaffGeneratorHR policies every small business needs before your 10th hire
Somewhere around the fifth or sixth hire, a founder usually says some version of the same thing: “we should probably have that written down.” By the tenth hire, “probably” has turned into “we really needed this three hires ago.” A handful of HR policies, written before you need them rather than after an incident forces the issue, is one of the cheapest insurance policies a small company can take out.
The mistake most small teams make is not having no policies. It is either having none at all, or overcorrecting into a 40-page handbook copied from a company ten times their size, most of which nobody reads and none of which gets enforced. Neither extreme works. Here is the essential starter set, what to genuinely leave out for now, and how to roll it out without it feeling like bureaucracy landed overnight.
Why “we don’t have policies yet” becomes a problem faster than you think
Under ten people, most disputes get resolved informally: someone asks the founder, the founder makes a judgment call, everyone moves on. That works right up until a judgment call needs to be consistent across two situations that happened six months apart, with two different managers involved, and nobody can remember exactly what was decided the first time. Inconsistent, undocumented decisions are where informal HR quietly turns into legal and reputational risk: an employee treated differently from a peer in a similar situation, with nothing in writing to explain why, is exactly the kind of thing that escalates.
A written policy does not eliminate judgment calls. It gives every judgment call a consistent starting point, and it gives you something concrete to point to when someone asks “why was this handled this way.”
The essential starter set
You do not need a full handbook to be covered. Four policies do most of the real work for a team under fifteen people.
Code of conduct
The baseline standard of behaviour you expect, including an explicit anti-harassment and anti-discrimination statement and a clear, named way to report a concern. This is the single most important document to have in writing before you need it: after an incident is the worst possible time to be improvising your standard for the first time, in front of the people involved.
Leave and time-off policy
How much paid time off employees get, how to request it, how sick leave and public holidays are handled, and what happens to unused leave. Ambiguity here is one of the most common sources of quiet resentment on small teams: one person feels comfortable taking time off and another does not, purely because nobody ever said out loud what was actually allowed.
Remote and hybrid work policy
If any part of your team works outside a single office, even occasionally, put the expectations in writing: which days or arrangements are the default, how availability and response times work, what equipment the company provides, and who decides on exceptions. Skipping this is fine right up until two employees have two different unwritten understandings of the same arrangement.
Data handling and confidentiality
A short policy on how customer and company data is handled, what counts as confidential, and what employees can and cannot share externally, including on their own social media. Even a very small company usually holds customer data that a data-protection regulator would expect to see a policy for, and new hires benefit from an explicit, un-ambiguous line rather than having to infer where it is.
What to genuinely leave out at this stage
Over-engineering your policy set is its own failure mode: a stack of documents nobody reads is barely better than having none, and it makes the four that actually matter harder to find. At under fifteen people, you can safely defer a formal performance-improvement-plan process (handle it case by case with documentation for now), a detailed expense and travel policy (a one-line “ask before you spend over X” rule is enough), and a full compensation-bands document (you likely do not have enough roles yet for bands to mean anything). Write these when the team’s size actually creates the problem they solve, not before.
How to keep a policy enforceable, not just written
A policy that exists only as a file nobody has read is not really a policy, it is a liability with extra steps: it can be used against you (“you had a rule and didn’t apply it”) without giving you any of the protection a genuinely known and followed policy provides. Three things make the difference between a document and a real policy:
- An explicit acknowledgement. Every employee reads and confirms each policy, in writing, as part of onboarding, not buried in a contract they skimmed once.
- A named owner. One person is responsible for keeping each policy current and knowing it exists, even if that person is the founder wearing an HR hat.
- A visible version and date. Anyone can see at a glance whether they are looking at the current version, and what changed since the last one.
For a policy that has real legal weight, like the code of conduct, it is worth going one step further once it is finalised: keep a tamper-evident, timestamped record of the exact version every employee acknowledged. A service like XSeal seals a finalised file and gives you a certificate proving which version was in effect on a given date, which is exactly the kind of evidence that matters if a policy is ever challenged months or years later.
A simple rollout plan for a 5-to-15-person team
Rolling out policies for the first time does not need a project plan. A workable sequence:
- Draft the four essential policies above, in plain language, one page each where possible.
- Have one person (founder, ops lead, or whoever owns people matters) review all four for consistency.
- Share them with the whole team at once, in a short meeting or a written announcement, not a silent file drop.
- Collect a written acknowledgement from every current employee, then make it part of onboarding for every new hire.
- Put a six-month review reminder on the calendar so the policies stay current as the team grows.
Write your starter set instead of starting from a blank page
Writing four policies from scratch, in a consistent tone and format, is exactly the kind of detail-heavy work that is easy to do inconsistently under deadline pressure, which is how a document meant to reduce risk ends up creating it instead. StaffGenerator generates a real, ready-to-adapt HR policy draft alongside every job description and onboarding checklist, tailored to the role and industry you enter, so you are editing a solid starting point rather than staring at an empty page. It is free to generate; see the pricing page for what a free account adds on top (saving, editing, and exporting every policy you generate).