Anatomy of a workplace policy document

You have a draft workplace policy in front of you — maybe a code of conduct an outgoing HR consultant left behind, maybe a template a friend's bookkeeper sent you, maybe the first version your operations lead pulled together over a weekend. You can tell it's roughly the right shape, but you cannot tell whether it would survive contact with an actual incident, a Fair Work complaint, or a manager who reads it differently to you.

A workplace policy is an internal rules document. It sits below the employment contract (which sets the deal between you and the worker) and below any modern award or enterprise agreement that applies (which sets the floor on pay and conditions). The policy is where the day-to-day expectations live: how leave is requested, what counts as misconduct, how an incident gets reported, who decides. Done well, it supplements the contract without contradicting it, and it gives a decision-maker something concrete to point to when something goes wrong. Done badly, it either says nothing enforceable or it promises things you cannot deliver.

The clauses below are the structural pieces every workplace policy should contain, regardless of whether the topic is WHS, IT use, leave, or harassment. The order matters less than the discipline of including all of them.

What the policy is for

The opening clause states the purpose in one or two sentences. Why does this policy exist — safety, legal compliance, protecting confidential information, setting a behavioural standard? A reader who never gets past the first paragraph should still know what the policy is trying to achieve.

The drafting choice that matters here: keep the purpose narrow. A code of conduct that claims to "set the standard for all aspects of working life" is too broad to enforce. A code of conduct that exists to "set out expected standards of behaviour towards colleagues, clients, and company property" can be tested against any given incident.

Avoid aspirational language that reads like a values statement. Save that for the staff handbook introduction.
Do not claim the policy creates a contractual right. Most policies are written as directions, not promises, and you want them to stay that way.

Who and what it covers

The scope clause tells the reader who is bound and where the rules apply. Get this wrong and you end up with a social media policy that does not cover contractors, an IT policy that does not cover personal devices used for work, or a WHS policy that goes silent on subcontracted sites.

A workable scope clause names the categories of person (employees, contractors, labour-hire workers, volunteers, board members) and the categories of place or asset (company devices, personal devices used for work, client sites, work-related social media accounts, off-duty conduct where it affects the business). Be explicit. "All staff" is not a category — Fair Work, your insurer, and a tribunal will all read it differently.

The trap: a scope clause that conflicts with the contract. If a contractor's services agreement says they are not subject to internal policies, the policy cannot bind them by saying it does. Fix the contract first.
The variant worth including: a sentence on off-duty conduct, narrowly framed to conduct that has a clear connection to the workplace (reputation, harassment of colleagues, disclosure of confidential information). Anything broader will not hold up.

Defined terms

Definitions are the clause most often skipped and most often regretted later. Words like "confidential information", "bullying", "serious misconduct", "reasonable", "immediate family" all carry baggage from case law and legislation. If the policy uses them without saying what they mean, the meaning gets supplied by whichever side reads the policy most aggressively.

Keep the definitions short, plain, and aligned with the source they come from. Where a term has a statutory definition you intend to rely on — "bullying" under the Fair Work Act 2009 (Cth), or "personal information" under the Privacy Act 1988 (Cth) — say so, and use the statutory wording. Where you are defining something internally, say that too.

Who is responsible for what

A policy without allocated responsibility is a wish list. The responsibilities clause maps each obligation in the policy to a role: who approves leave, who investigates complaints, who keeps the records, who decides the consequence.

Use roles, not names. "The People & Culture Manager" survives turnover; "Jane" does not.
Match responsibility to authority. Do not give the WHS officer responsibility for stopping unsafe work without also giving them authority to do it.
Cover the gap. Who acts when the named role is on leave or unfilled? A one-line escalation rule prevents a stalled process becoming a defence in a later claim.

The rules themselves

This is the clause people skip to. The drafting choice here is between rules that are specific enough to enforce and rules that are general enough to apply to situations you have not thought of yet. Get the balance wrong on the strict side and a manager has to either ignore the policy or apply it to absurd cases. Get it wrong on the loose side and the policy cannot support a disciplinary decision.

Two practical disciplines help. First, write rules as conduct statements, not as aspirations: "Employees must not access another employee's email account without authorisation" rather than "Employees should respect each other's privacy". Second, where the rule turns on a judgement call ("reasonable use", "appropriate dress"), give one or two examples either way. Examples are not exhaustive, but they anchor the reader's interpretation to yours.

How the procedure runs

The procedure clause is where most policies fail. A rule without a procedure is unenforceable — if the policy says "report bullying promptly" but does not say to whom, on what form, within what time, the reporting requirement is decorative.

Every procedure should answer:

What triggers it (an incident, a request, a deadline).
Who initiates it and how (a form, an email address, a conversation with a named role).
The timeframe (within 24 hours, within five business days, before the next pay cycle).
What happens at each step, including what the worker is told and when.
What the output is — a written warning, an approved leave entry, an updated risk register, a closed file.

A complaint procedure that does not say how the complainant will be told the outcome is the single most common cause of a workplace complaint escalating into an external claim.

Consequences of breach

A consequences clause without ranges is unenforceable; a consequences clause with rigid penalties ties your hands. The drafting goal is a proportionate range — informal counselling, formal warning, performance improvement plan, termination — tied to factors the decision-maker is allowed to weigh (severity, intent, prior conduct, whether the conduct was a one-off).

Two traps to watch:

Promising progressive discipline as a sequence. If the policy says "employees will receive a verbal warning, then a written warning, then a final warning before termination", you have just created a contractual procedure you must follow even where the conduct is serious enough to justify summary dismissal.
Treating the policy as the sole source of the consequence. The consequence usually comes from the contract or the Fair Work Act 2009 (Cth) — the policy should reference, not replace, those sources.

How the policy fits the rest of the system

A workplace policy never operates alone. The policy needs to cross-reference: the employment contract, any modern award or enterprise agreement that applies, the 11 National Employment Standards under the Fair Work Act, the relevant state or territory WHS legislation, the Privacy Act 1988 (Cth) for anything involving personal information, and your public-facing privacy policy.

The clause does not need to recite the content of those other documents. It needs to say which one prevails if there is a conflict — and the answer, almost always, is that the legislation and contract prevail over the policy.

Approval, version control, and review

The last clause is the one nobody reads until something goes wrong. It records who approved the current version, the version number or date, and when it is next due for review. A policy with no version stamp cannot be defended in a dispute because there is no way to prove which version was in force when the conduct occurred.

Annual review is the sensible default; six-monthly for high-change areas (privacy, AI use).
Trigger an off-cycle review whenever the underlying law changes, a system is replaced, or an incident shows the policy did not work as drafted.
Keep superseded versions on file. A current policy proves nothing about what the rules were when the relevant event occurred.

Optional and situational clauses

Some clauses are not universal. Include them where they earn their place:

Whistleblower clause: mandatory for public companies, large proprietary companies, and corporate trustees of registrable superannuation entities under ASIC's whistleblower policy regime. For smaller companies, optional but worth including if you receive disclosures.
AI and generative tool use: worth a dedicated clause where staff are using third-party AI tools that touch client data, internal IP, or decisions about people.
Personal device (BYOD) clause: worth including where staff use personal phones or laptops for work, especially if you need a remote-wipe right or an obligation to surrender the device for an investigation.
Restraint of out-of-hours conduct: narrow, tied to genuine business interests. Broad lifestyle restrictions are unenforceable.
Drug and alcohol testing: only where the safety profile of the work genuinely warrants it, and only with a procedure that complies with the relevant Australian Standard for testing.

Where Artificer Legal helps with workplace policies

The cost of getting a workplace policy wrong is rarely visible until you try to rely on it — a dismissal that gets unwound at the Fair Work Commission, a privacy breach where the policy is the only thing standing between you and the regulator's view of "reasonable steps", a harassment claim where the procedure was never followed because it was never workable.

When we draft or review a workplace policy at Artificer Legal, we work from the contract outward. We check that the policy says it is directional rather than contractual, that scope and definitions hold up against the actual workforce mix, that procedures have named roles and real timeframes, and that consequences are flexible enough to apply proportionately without locking you into a procedural sequence you cannot deviate from. For policies that touch regulated obligations — WHS, privacy, whistleblower, anti-discrimination — we line them up against the current legislation and the way regulators are reading it now, not the way the template was drafted three years ago.

The procedure clause is what makes a policy enforceable

The procedure clause is the one that decides whether a policy works. A rule that cannot be enforced is a rule that does not exist, and rules become unenforceable the moment the procedure for invoking them is vague, missing, or contradicted by what actually happens in the workplace. Write the procedure first, in concrete terms, and the rest of the policy tends to fall into place around it.

A workable workplace policy has a narrow purpose, a scope that matches the people it is meant to bind, defined terms drawn from the statutes the policy relies on, responsibilities tied to roles rather than names, rules written as conduct standards with worked examples, procedures with named owners and timeframes, proportionate consequences expressed as a range, and a version-controlled review cycle. The optional clauses — whistleblower, AI use, BYOD, restraint, drug and alcohol — earn their place when the business genuinely needs them. The policy sits below the contract, below the award, and below the legislation, and it works best when it knows it does.