Australian businesses need eleven core human resource policies, of which work health and safety, sexual harassment prevention and psychosocial hazard management flow from legal duties rather than choice. Employment Star (employmentstar.com.au) builds and loads your policy set into Employment Hero with acknowledgement tracking, from $2,340 ex-GST, live in 14 business days.
Most policy problems don’t show up as policy problems. They show up as a dispute — a termination that can’t be defended, a bullying complaint with no process behind it, a flexible work request answered too slowly.
At that point the question is never “did you have a policy?” It’s “can you show the employee received it, understood it, and that you applied it consistently?” A folder nobody has opened since 2021 fails that test.
Here’s the practical run-through: which human resource policies an Australian employer needs, which are effectively compulsory, what each must contain, and how to keep them current.
Required, effectively required, or recommended?
Australian law rarely says “you must have a written policy called X”. It imposes duties, and a written, communicated policy is how you demonstrate you’ve discharged them. Sort your policies into three groups.
Flowing from a legal duty. WHS legislation requires you to identify and control risks, including psychosocial hazards. The Sex Discrimination Act imposes a positive duty to take reasonable and proportionate measures to eliminate sexual harassment and sex discrimination — you cannot wait for a complaint. If you’re covered by the Privacy Act, you need a privacy policy. You cannot meet these duties without documented policy and training.
Effectively required in a dispute. No statute compels a code of conduct or a performance management policy. But dismiss someone for conduct or performance without being able to produce the standard they breached or the process you followed, and the Fair Work Commission has very little to work with in your favour.
Genuinely optional, but sensible. Social media, drug and alcohol, and remote work policies. Not mandatory — just the difference between being able to act on a problem and having to tolerate it.
Two documents aren’t policies but are legally required: every new employee must receive the Fair Work Information Statement, and every casual the Casual Employment Information Statement, the latter also at set intervals afterwards that differ by employer size.
The HR policy checklist for Australian businesses
| Policy | Required or recommended | What triggers the need | Review frequency |
|---|---|---|---|
| Code of conduct | Effectively required | Your first employee | Every 2 years, or after any conduct dispute |
| Work health and safety | Required (WHS legislation) | Your first worker, including contractors | Annually, plus after any incident or change to the work |
| Psychosocial hazards | Required (WHS regulations) | Your first worker | Annually, plus on any change to workload, rostering or structure |
| Bullying, harassment and discrimination | Required (positive duty, Sex Discrimination Act) | Your first employee | Annually |
| Leave | Effectively required | Your first employee | Annually, and on any NES or award change |
| Flexible work and the right to disconnect | Effectively required | Your first employee | Every 2 years, or on any Fair Work Act change |
| Performance management | Effectively required | Your first employee, and before any performance conversation | Every 2 years |
| Termination and disciplinary process | Effectively required | Before your first dismissal, not after | Every 2 years |
| Privacy and employee records | Required if a Privacy Act entity | Collecting personal information; handling health or biometric data | Annually |
| Social media and acceptable use | Recommended | Employees identifiable as connected to your business online | Every 2 years |
| Drug and alcohol | Recommended (required in practice for safety-critical work) | Machinery, vehicles, heights, or a licence condition | Every 2 years |
The trigger column matters more than the frequency column. Most policy gaps come not from a missed review date but from a business changing shape — first shift worker, first remote employee, first manager — without anyone updating the documents.
What each policy has to contain
Code of conduct
The behavioural standard everything else references. State expected conduct, unacceptable conduct with examples rather than abstractions, how conflicts of interest are declared, what applies at work-connected events outside hours, and the consequences of breach. Keep it readable — a code nobody finishes has no evidentiary value.
Work health and safety, and psychosocial hazards
The physical WHS policy covers hazard identification, incident reporting, first aid, emergency procedures and consultation. Most Australian businesses have this in some form.
Psychosocial hazards are the gap. WHS regulations across most jurisdictions now expressly require employers to identify and control psychosocial risks — excessive workload, low job control, poor support, role ambiguity, bullying, exposure to traumatic content, and remote or isolated work. Safe Work Australia’s model Code of Practice sets out what a compliant approach looks like.
Your policy needs to name the hazards present in your specific operation, set out how they’re assessed, list the controls applied, and describe how workers raise concerns. Regulators have been clear that a generic wellbeing statement is not a control. Adoption of the model regulations varies, so check your state or territory regulator.
Bullying, harassment and discrimination
Under the positive duty, prevention is the obligation — not just response. Define bullying, sexual harassment, sex-based harassment, discrimination and victimisation; give multiple reporting channels including one that bypasses the direct manager; commit to a timeframe for acknowledging a complaint; explain how confidentiality is handled and its limits. Pair it with training and keep the attendance records.
Leave
How each NES entitlement is requested, approved and evidenced — annual, personal/carer’s, compassionate, parental, long service (state legislation, not the NES), community service, and the 10 days of paid family and domestic violence leave available to all employees including casuals. Include notice and medical certificate requirements, plus award-specific rules such as leave loading or directed shutdowns.
Flexible work and the right to disconnect
Both obligations have moved recently. Eligible employees can request a flexible working arrangement, and you must discuss it and respond in writing within 21 days, refusing only on reasonable business grounds after genuinely trying to reach agreement.
The right to disconnect lets employees refuse to monitor or respond to contact outside working hours unless that refusal is unreasonable. It applied to non-small-business employers from 26 August 2024 and small business employers from 26 August 2025, so it now covers everyone. Set out normal contact expectations, what counts as genuine urgency, and how on-call works if you have it.
Performance management and termination
Two sides of the same document set. Performance management covers how expectations are set, the cadence of feedback, what a formal improvement process looks like, and what gets recorded. Termination covers grounds, warnings, the right to a support person, notice periods and final pay.
Under 15 employees you’re a small business employer: a longer minimum employment period before an unfair dismissal claim, and the Small Business Fair Dismissal Code applies. Crossing 15 changes your exposure, and your policy should reflect which side of that line you’re on.
Privacy, social media and drug and alcohol
Privacy: what personal information you collect, why, where it’s stored, who can access it and how long you keep it. The employee records exemption is narrower than most employers assume and does not cover job applicants or contractors.
Social media: what employees may say about the business, what confidential information must never appear online, and how out-of-hours conduct can still be work-connected. Discipline for an out-of-hours post is far harder to sustain without a policy on the record.
Drug and alcohol: if you intend to test, the policy is what makes testing enforceable. Specify the method, the circumstances triggering a test, the process on a positive result, and the support pathway.
Policies written but never acknowledged?
That’s the most common gap we find. We’re a certified Employment Hero implementation partner — we’ll review your current policy set, tell you what’s missing and what’s out of date, and show you how acknowledgement tracking works. No charge, no obligation.
Acknowledgement and version control — the part that fails in a dispute
A policy you can’t prove the employee received is close to worthless when it counts. You need to answer four questions on the spot:
- Which version was in force on the date of the incident?
- Did this employee receive that version?
- When did they acknowledge it?
- What changed since, and were staff notified?
Email attachments and a shared drive can’t answer those reliably. Anyone can amend a Word document, and nobody can prove an email was opened.
That’s the strongest argument for holding policies inside your HR platform rather than beside it. Employment Hero distributes policies to the employee record, captures a timestamped acknowledgement, retains superseded versions, and shows who hasn’t acknowledged yet so you can chase them. When a claim arrives eighteen months later, that audit trail is the evidence.
The habits that go with it: version-number every policy, date it, name an owner, and re-issue for acknowledgement whenever a material clause changes — not just at onboarding. New managers should acknowledge the manager-facing procedures separately.
How we help
We’re a certified Employment Hero implementation partner working with small and medium businesses across Australia. On the policy side:
- Policy audit. We check what you have against your award, headcount and current obligations, and give you a gap list ranked by exposure rather than effort.
- Drafting and updating. Australian-law policies written for your operation, not a template pack with your logo on top.
- Loading and acknowledgement. Policies deployed into Employment Hero with acknowledgement tracking, version history and reporting on who’s outstanding.
- Manager training. A policy is only as good as the manager applying it. Our HR consulting and training covers running a performance conversation, handling a complaint, and documenting both.
Standing up the whole people system at once? Our our Employment Hero setup service is a fixed $2,340 ex-GST, live in 14 business days, with the policy library included. If you’d rather hand the ongoing work over, that’s what our outsourced HR services are for.
Frequently asked questions
Which human resource policies are legally required in Australia?
There’s no single statutory list. WHS, psychosocial hazard management, sexual harassment prevention under the positive duty, and privacy all flow from legal duties you can’t meet without documented policy. Others — code of conduct, performance, termination — aren’t compelled by statute but are effectively required to defend a decision.
How many HR policies does a small business actually need?
Around eleven covers most Australian small businesses: code of conduct, WHS, psychosocial hazards, bullying and harassment, leave, flexible work and right to disconnect, performance management, termination, privacy, social media, and drug and alcohol. Add industry-specific ones where your award or licence requires them.
How often should HR policies be reviewed?
Annually for anything tied to WHS, safety or legislation, and every two years for the rest. Triggers matter more than the calendar — a Fair Work Act change, a new award, your first shift worker, first remote employee, first manager, or crossing 15 employees should all prompt a check.
Do employees have to sign HR policies?
There’s no general requirement to obtain a signature, but you need to prove the employee received and understood the policy for it to carry weight. A timestamped digital acknowledgement does this far better than a signed page in a folder, because it also captures which version they saw.
What happens if we don't have a psychosocial hazards policy?
WHS regulators can issue improvement or prohibition notices and prosecute for failure to manage psychosocial risk, whether or not anyone has been harmed. It also weakens your position in a bullying, stop-bullying or workers compensation claim. Requirements vary by state — check your local regulator.
Can we just use a template policy pack?
Templates are a reasonable starting point and a poor finishing point. They won’t reflect your award, rostering, safety-critical roles or headcount thresholds. The risk is a policy that says something you don’t actually do, which is worse in a dispute than having no policy at all.
Want to know where your policy set is exposed?
We’re a certified Employment Hero implementation partner. Send us what you’ve got and we’ll come back with a gap list ranked by risk, plus what it would take to close it.
+61 466 614 475 · info@employmentstar.com.au
This article is general information only and does not constitute legal, tax or financial advice. Obligations vary by business, industry, jurisdiction and applicable modern award. Check your circumstances with the Fair Work Ombudsman, your state or territory WHS regulator, or a qualified adviser.
About Employment Star — We’re a certified Employment Hero implementation partner based in Parramatta, NSW, working with small and medium businesses across Australia. We handle Employment Hero setup, modern award configuration, data migration, STP Phase 2 and Payday Super — fixed price from $2,340 ex-GST, live in 14 business days.
Published 24 May 2026 · Last updated 3 August 2026