A startup guide to policy and procedure

As your startup grows, things that once worked informally start breaking down.

Different people start handling the same situations in different ways. What used to be a quick Slack message turns into a bottleneck. Decisions that once made sense get questioned because there’s no clear precedent.

Suddenly, small inefficiencies become big problems. That’s when you know it’s time to introduce policies and procedures to help eliminate friction.

But you don’t need to create a rulebook overnight. You can start with what matters most, keep it simple, and adapt when you need to.

Here’s how to put strong policies and procedures in place at your startup to help you scale your company.

What are policies and procedures?

People often use "policies" and "procedures" interchangeably, but they’re not the same.

Policies are high-level rules that guide decision-making. They define an organisation’s values, set expectations, and provide a framework for consistency. When you create policies, they should be:

• Be broad and strategic
• Explain what should be done and why
• Apply across the entire organisation
• Rarely change unless there’s a major shift

For example, a Leave Policy states that employees are entitled to annual leave, sick leave, and parental leave, following company policy and legal requirements. But it doesn’t detail how to request leave. That’s where you need procedures.

Procedures are step-by-step instructions that show exactly how to follow a policy. They help maintain consistency, efficiency, and compliance. Good procedures should:

• Be detailed and practical
• Explain how to complete a task
• Can vary from department to department
• Change frequently as tools and processes evolve

For instance, a Leave Application Procedure might cover how employees should submit leave requests through the HR portal at least two weeks in advance, with manager approval before confirmation.

Policies set the direction, and procedures make sure things run smoothly. Without policies, decisions are inconsistent. Without procedures, work becomes chaotic. Startups need both, to give structure and support to the team when growing.

Step 1: Identify the need for policy or procedure

A good policy solves a recurring problem. It should help your team from wasting time figuring out the same things over and over again.

Instead of handling issues case by case, a policy gives people a clear, fair, and repeatable way to make decisions. Done right, it removes ambiguity and speeds things up.

The best way to know if you need a policy is to ask: what problem are we solving?

Maybe it’s expense reports being submitted late, causing cash flow headaches. Maybe sensitive data isn’t being stored securely, which puts the company at risk. Maybe hiring decisions are inconsistent, leading to missed opportunities or unfair outcomes.

If the same issue keeps surfacing – or if inconsistency is causing confusion – it’s time to standardise how things are done.

Start by looking at key areas like HR, finance, security, and operations.

• Are there legal requirements to meet?
• Industry standards to follow?
• Internal expectations to clarify?

If something is slowing down decision-making, increasing risk, or making it harder for the team to do great work, a policy could be the answer.

But not every issue needs a policy. If something happens once, or if a simple conversation can fix it, there’s no need to write rules. Policies should focus on problems that come up often enough to create inefficiency.

They should also be realistic, rules that aren’t followed don’t help anyone. A great policy is one people actually use.

Step 2: Draft the policy

A policy is best when you need a high-level rule that guides behaviour without micromanaging how it’s done.

If you’ve determined a policy is needed, it should be clear, useful, and easy to follow. Here’s how to build one.

a) Gather information

Before writing anything, it’s best for you to understand the context of the problem your startup is trying to tackle. To do this, you can start by asking:

• What do industry best practices say? Learn from companies that have already solved this problem.
• How do other companies handle this? If there’s a standard approach in your industry, it might make sense to follow it.
• What does the law require? Some policies, especially in finance, HR, and security, aren’t optional. Make sure you’re compliant with any legal obligations.
• What are the pain points? Talk to the people who will be affected – leaders, HR, legal, department heads, and any key team members. They’ll know where to start to find the real issues.

If there are existing policies, review them. Are they still relevant? Do they have gaps? Are they being ignored because they don’t make sense anymore? Sometimes updating an old policy is better than creating a new one from scratch.

b) Draft the policy

Once you understand the problem, keep the policy simple and clear.

If people need to read it multiple times to understand what it means, it’s too complicated. A great policy answers four key questions:

• Purpose: Why does this policy exist? What problem does it solve?
• Scope: Who and what does it apply to? Does it cover the whole company or just certain teams?
• Rules: What are the key do’s and don’ts?
• Responsibilities: Who enforces it, and what happens if it’s ignored?

Employees should be able to read them once and know exactly what’s expected.

A common mistake is making policies too rigid. The goal isn’t to create a rule for every possible scenario. The best policies provide principles and guardrails, not micromanagement.

So rather than saying, “expense reports must be submitted on the 3rd working day of every month at precisely 9:00 AM,” a more effective policy might be: “Employees should submit expense reports within 5 days of incurring an expense for quicker reimbursement.”

This way, the policy provides structure, and highlights the benefit (quicker reimbursement) without being overly prescriptive or hard to follow.

c) Consult and refine your policy

Before finalising, get feedback. A policy that sounds great in a document might not work in practice.

Share the draft with the people who will use or enforce it and ask:

• Is it clear?
• Is it realistic?
• Does it align with company goals and culture?

Listen to the feedback and make revisions based on what you hear. A policy should be firm but flexible, it needs to provide direction while allowing for practical use.

Step 3: Draft procedure

A policy explains what should happen. A procedure explains how to do it.

Not every policy needs a procedure. If the action is simple and self-explanatory, a policy alone is enough.

But when following a policy requires multiple steps, approvals, or specific tools, a procedure removes guesswork and speeds up execution.

The goal of a procedure is to make sure anyone – new hire or seasoned employee – can follow the process. If employees have to ask for further clarification, the procedure isn’t detailed enough.

a) Gather information

Before writing, map out the process. A procedure should reflect how things actually work, not how you think they should work. So if you’re going to update a process, do it before writing the procedure.

As part of gathering information, ask the following:

• What are the exact steps employees need to follow? Break down the process from start to finish.
• Who is responsible for each step? Define roles clearly. If multiple people are involved, specify handoff points.
• What tools, platforms, or approvals are involved? If employees need to submit a form, use specific software, or get manager approval, include that information.

The best way to get accurate details is to talk to the people who follow the process daily. They’ll know where the current friction points are and what could be simplified.

b) Develop the procedure

Keep it simple. The best procedures are clear and direct.

Use bullet points or numbered steps instead of long paragraphs. Employees should be able to scan the procedure and quickly understand what to do. A good structure includes:

• Step-by-step instructions – Outline what to do, in order.
• Tools or platforms – Mention any software, forms, or documents involved.
• Common edge cases – Explain what to do if something unusual happens.

For example, if the procedure is about submitting expense reports, don’t just say, "Submit your expense report." Instead, break it down:

• 1. Log into the expense management system at [URL].
• 1. Upload receipts for all expenses over $50.
• 1. Categorise expenses as ‘Travel’, ‘Meals’, or ‘Office Supplies’.
• 1. Submit the report to your manager for approval by the 5th of each month.
• 1. If your report is late, email finance@company.com for approval.

Now, there’s no room for misinterpretation. Anyone reading this knows exactly what to do.

But you should also account for exceptions. Real-world processes aren’t always straightforward. If something unexpected happens, employees need to know how to handle it.

If approval is required, what happens if the approver is on leave? If a tool is unavailable, what’s the backup plan?

A simple way to handle exceptions is by adding a “What if?” section at the end of the procedure. For example:

• What if my expense report is rejected? → Correct the error highlighted in red and resubmit.
• What if I don’t have a receipt? → Submit a written explanation to your manager for approval.

This makes your team more likely to follow the procedure when things aren’t running perfectly.

c) Consult and refine your procedure

Once the procedure is drafted, test it. A procedure might look perfect on paper but fail in reality.

The best way to know if it works is to ask a small group of employees to walk through it. If they struggle, that’s a sign it needs to be clearer. Before rolling it out company-wide:

• Watch how they use it – Are they skipping steps? Misinterpreting instructions?
• Ask for feedback – Are any steps unnecessary? Is something missing?
• Simplify where possible – If a step doesn’t add value, remove it.

A great procedure should make people’s jobs easier, not harder. If employees find workarounds because the procedure is too slow or impractical, that’s a sign it needs revision before you push ahead.

Step 4: Implement the policy and procedure

A policy only works if people know about it, understand it, and actually follow it.

Writing it down isn’t enough, it needs to be communicated, accessible, and reinforced. Otherwise, even the best policies will be ignored.

a) Communicate your policy and procedure

When introducing a new policy, don’t just send an email with an attachment and expect people to read it.

Explain why it exists and how it helps. A policy that feels like an unnecessary rule will be met with resistance, but if people see how it makes their jobs easier, or makes things more fair, they’re more likely to adopt it.

Good communication options include:

• Announcing the policy in a meeting and answering questions.
• Sending an email summarising the key points.
• Holding a short training session if the policy is complex.

Instead of saying, “Here’s the new policy,” say, “We’ve introduced this policy to solve [problem] and make [process] more efficient.”

If employees understand the purpose, they’re more likely to follow it.

b) Make it easy to find your policy and procedure

A policy that’s buried in an email chain or hidden in a rarely used folder might as well not exist. Store policies in a central, accessible location, such as:

• A shared Notion or Confluence page.
• A Google Drive folder.
• An HR or company portal.

Wherever it’s stored, make sure people know where to find it when they need it. So many startups have a central storage point for policy, but never remind their teams that the documents are stored there. Don’t be one of them.

c) Train your team

If the policy is complex or involves a procedure, employees might need more than just written instructions.

• Provide real-world examples to show what compliance looks like.
• Walk employees through the steps if it involves a procedure.
• Make training part of onboarding so new hires follow it from day one.

This makes your policy and procedure far more likely to be used and followed.

d) Hold everyone accountable

If managers ignore the policy, employees will too. Leadership must reinforce it, not just with words, but through actions. Compliance starts at the top.

Someone also needs to be responsible for making sure it’s followed. This doesn’t mean strict penalties, it could mean:

• Reminding employees.
• Improving processes to make compliance easier.
• Training new hires properly.

Policies are tools for making work smoother. Implementing them well makes them actually do what they were designed to do.

Step 5: Monitor, review and revise

A policy isn’t a set-and-forget document. Businesses evolve, regulations change, and what worked in a small team might fall apart at scale.

A great policy works because it makes sense. If employees aren’t following it, there’s usually a reason. Either it’s unclear, impractical, or simply no longer relevant.

The best companies treat policies as living documents, adapting them as needed to keep things working. Here’s what you need to do.

a) Monitor compliance with policy and procedure

The first step is checking whether people are actually following the policy. If they aren’t, don’t jump to enforcement, find out why.

• Are employees unaware of the policy? – If so, communication needs improvement.
• Are they ignoring it because it’s inconvenient? – A policy that slows work down might need adjusting.
• Is it difficult to follow? – If employees constantly have to ask for clarification, it’s not written clearly enough.

People usually don’t break policies to be difficult, they do it because something isn’t working. When a policy adds unnecessary friction, it’s better to fix the policy than try to force compliance.

b) Gather feedback on how they’re working

Policies should be designed for the people who use them, so ask employees what’s working and what isn’t.

• What challenges do they face in following the policy?
• Are there common exceptions that aren’t accounted for?
• Does it align with how they actually work?

The best policies are shaped by real-world experience, not just theory. If employees regularly find workarounds, that’s a sign the policy needs revision.

You shouldn’t be creating policies just for their own sake. They should be useful for your team, and help make their work more efficient and fair.

c) Review on a regular schedule

Every policy should have a built-in review cycle to test how it’s going. Here’s some strategies to approach this:

• Schedule a review every 6–12 months – This is necessary to check if the policy is still useful.
• Update immediately if laws change – You should be especially vigilant for HR, finance, and security policies.
• Look at patterns – If the same issues keep coming up, the policy might need tweaking.

Think of it like product development. Just as software gets updated to fix bugs and improve usability, policies should be iterated based on feedback.

d) Revise when needed

If employees aren’t following the policy, don’t just blame them, fix it.

When something isn’t working, simplify it, clarify it, or rethink the approach. Here’s some things to consider when you revise your policies and procedures:

• Does every employee understand the expected behaviour?
• Are key terms and requirements explicitly defined?
• Is there a better way to achieve the same outcome?

A well-written policy leaves no doubt about what’s expected, when, and by whom. And it should work because it makes sense, and makes doing the right thing the easiest option, not just because it’s enforced.

Final thoughts

You don’t need a 50-page manual to run a great company. But you do need clarity. Start small. Focus on the areas that create the most friction, usually hiring, security, finance, and product development.

Keep policies and procedures practical. If they’re too rigid, people will ignore them. If they’re too vague, they won’t be useful. The best ones strike a balance between structure and flexibility.

And remember: these aren’t static documents. As your startup evolves, so should your processes. Review them, refine them, and most importantly, make sure they help your team work better. Otherwise what’s the point of having them.