Digging Deeper

Why a policy can become a legal risk

Most workplace policies and procedures fail for the same few reasons. The good news is that all of them are avoidable once you know them.

The first error is letting a policy become part of the employment contract. In late 2024, the High Court found an employer liable after it failed to follow its own disciplinary policy. Because the contract required compliance with that policy, the breach became a breach of contract. The damages even extended to psychiatric injury.

The lesson is not to abandon policies. It is to word the contract and the policy with care. Most employers now state clearly that their policies are lawful and reasonable directions, not terms of the contract. That single distinction changes your exposure.

The second error is promising more than the law requires. Aspirational, vague wording reads well, but it can create obligations you never intended. Courts give effect to clear promises. Write what you will actually do, not what sounds impressive.

The third error is contradicting the law. A policy cannot undercut an award, the National Employment Standards, or legislation. If it does, the law prevails and your policy is worse than useless. It signals that you did not understand your own obligations.

The fourth error is writing a policy you do not follow. This is the most common and the most dangerous. If your policy sets a process, a court, a regulator or the Fair Work Commission expects you to have followed it. A policy ignored becomes evidence against you.

In short, workplace policies and procedures create risk when they over-promise, contradict the law, or go unfollowed. Avoid those three, and the risk largely disappears.

The method: how to write workplace policies and procedures that hold

Strong workplace policies and procedures share a simple discipline. Find the point, phrase it for the reader, then trim it. Applied to policy, that method looks like this:

• Start with the law. Identify what actually applies to your business, sector and size.
• Describe how you really work, then improve it. A policy must match reality.
• Write one idea per sentence, in plain English, in the active voice.
• Set out the steps. A procedure tells people exactly what to do, and who does it.
• Keep it short. If your team cannot read it, they cannot follow it.
• Date it, assign an owner, and set a review cycle.

Length is not strength. Regulators have said as much. The Australian Human Rights Commission has warned employers against long, complex harassment policies. Well-drafted workplace policies and procedures are short enough to read and specific enough to follow.

What a legally sound policy contains

Sound workplace policies and procedures follow a predictable shape. Include these parts, in this order:

• Why the policy exists, in a sentence or two.
• Who and what it covers.
• Plain meanings for any terms that matter.
• Policy statement. Your position and your rules.
• The steps, in order, with roles named.
• Who owns, approves and follows the policy.
• Related documents. Links to forms, records and other policies.
• Version and review. A date, a version number, and the next review.

That last part matters more than it looks. Version control and review dates are how you prove a policy was current and active. Consistent structure also makes your workplace policies and procedures easier to use and easier to defend.

The rules shaping your policies right now

Australian obligations have shifted quickly, and your workplace policies and procedures need to keep pace. Four areas drive most of the change.

Work health and safety now covers psychosocial hazards in every state and territory. You must manage risks like bullying, excessive workload and poor role clarity, and show an active, documented system. Training alone is not a defence.

Sexual harassment now carries a positive duty. Employers must take reasonable and proportionate steps to prevent it, not merely respond. The Australian Human Rights Commission can investigate without a complaint, and 2025 was its first full year of active enforcement.

Privacy has teeth. Since June 2025, individuals can sue directly for serious invasions of privacy. If you hold personal or health information, your data and privacy policies are a genuine control, not a formality.

Fair Work keeps moving too. Criminal wage-underpayment laws, the right to disconnect and casual conversion rules all touch your policies. Keep your workplace policies and procedures under active review, and these changes become manageable rather than dangerous.