How often should you review company policies?

It’s common to create an informal set of company policies covering the basics and then let them collect digital dust in an online doc somewhere.

If you don’t assess a policy for months or years, it might describe a version of the company, and indeed the law, that’s no longer relevant.

Your policies directly feed into how you handle certain areas of compliance, such as pay, and while you might rely on an accountant or other third party, the buck stops with you.

Here, we'll outline the many risks of outdated policies, plus a full breakdown of which policies need reviewing and how often.

Why outdated policies are a risk

Policies describe your company’s position, principles, and adherence to the law and best practice. They document processes you expect to follow and outline how you will follow them.

When they no longer match your company’s actions or keep up with the law, they stop protecting you. The consequences vary, but can include:

• Compliance gaps: Statutory duties around data protection, health and safety, harassment prevention and anti-bribery, among others, all assume you’ve documented your procedures. Outdated or missing documentation weakens your position if those duties are ever tested.

• Internal confusion: When your policies lag behind your company, your team has to ask or guess when a scenario isn’t adequately covered.

• Tribunal exposure: If an employee takes you to tribunal over a disciplinary or grievance matter, the tribunal will compare what you did against the ACAS Code of Practice. If your procedures don't reflect the current Code, compensation can be increased by up to 25%.

• Disputes without a paper trail: When directors or shareholders disagree, written records can help settle any disputes.

• Due diligence red flags: Up-to-date policies signal good governance if anyone requests them as part of due diligence.

Your policies should be dynamic and updated as your company’s principles, operations, or the law change.

The main policy areas and how to cover them

Employment and HR policies usually receive the most attention, but the full breadth covers everything from financial controls and IT and data security to health and safety, anti-bribery, data protection, and business continuity.

Not every policy below will apply to every business; it depends on your size, sector and how you operate.

Employment and HR

One of the fastest-changing policy areas and source of legal exposure for growing businesses. It covers everything from disciplinary procedures and terms of employment through to leave entitlements, pay, harassment prevention and redundancy.

Employment law changed considerably under the Employment Rights Act 2025, with further reforms due through 2027. It’s updated regularly, with no margin for error for employers.

Data protection and IT

IT policies do double duty for data protection and cybersecurity. They cover security, company device policies, access controls, data sharing and processing, and more.

UK GDPR is the main data protection framework you’ll need to consider, but other rules may apply depending on your sector, region and how you use data and technology.

Health and safety

A written policy is legally required for any business with five or more employees, and risk assessments are required regardless of size.

Health and safety policy is highly sensitive to business size and activities, and legal exposure is serious in cases of genuine neglect or negligence. The HSE recommends regular reviews and reassessments.

Financial governance

Anti-bribery is an important one here. Under the Bribery Act 2010, the statutory defence is that you had "adequate procedures" in place, and the guidance encourages risk assessment, due diligence, training and ongoing monitoring.

Documented expenses and financial approval policies help avoid the informal financial management system smaller businesses can default to.

Corporate governance

The bigger you get, you’ll find your policies expanding exponentially. It’s just a fact of business.

Business continuity plans, cybersecurity documentation, intellectual property, modern slavery statements, and environmental policies are all increasingly expected. Some are legally required (modern slavery statements above £36m turnover, for instance).

Others aren't legally mandated but are strongly encouraged. Rules and thresholds aren’t a barrier to you creating policies relevant to your business.

Five questions to test your employment policies

Employment policies are vital to nail down before expanding your team. If you’re wondering when to update your HR policies, use these five questions to decide where to start.

1. When did you last review your employment policies?

If the answer is “when we wrote them” or “I’m not sure”, start there and prioritise the most out-of-date or neglected areas, whether pay and remuneration, leave, absences, or something else.

2. Have you updated them for changes already in force?

Employment law changes regularly, so policies that were accurate a few years ago may no longer reflect the current rules.

Review your policies periodically to make sure they still cover the latest rules on family leave, sick pay, holiday entitlement, and record-keeping. The Employment Act 2025 is the big one, but rules can change every year.

3. Are you ready for the next round of changes?

You don’t need to rewrite your policies every time a proposal is announced, but you should know what’s on the horizon and be ready to update your handbooks. Bear in mind that proposed changes can be delayed, amended or dropped altogether.

4. Do your policies match the workplace?

Policies only work if they’re functional in your company. If managers handle sickness, expenses, flexible working, or grievances one way while the handbook says another, that’s a red flag.

Make sure you have a plan to hold the business accountable for following its policies so they don’t become a box-ticking exercise.

5. Are the policies clear to your employees?

Read your policies from the other side. Are the rules clear, current, consistent, and easy to understand? This is especially important as you add new team members and working patterns that fall through the cracks of current policies.

If two or three answers make you hesitate, it’s probably time for a staff handbook review.

What triggers a policy review outside the normal cycle

Every business should routinely review its policies according to a predefined cycle (always annually, often quarterly, sometimes monthly). But there are occasions you’ll need to trigger a policy review outside of that cycle.

Changes in the law

Changes to the law are the big trigger. Keep an eye on the Spring Statement and Autumn Budget, as this is when the bulk of fiscal policies are announced.

Other laws can realistically be announced at any time and come into force in stages, though some are modified, postponed, or cancelled.

ACAS is a useful source for tracking employment law. For tax, data protection and sector-specific rules, you’ll need to follow announcements or work with an accountant or advisor to ensure your policies and processes are updated.

Changes in your business

Other policy review triggers are internal, for example:

• Headcount or expansion milestones: Some obligations only apply once your business reaches a particular size or takes a particular action.

• New roles or structures: Adding new roles, structures, or locations often means ensuring your policies adequately cover them.

• New technology or tools: Includes IT policies like company device rules as well as anything more specific such as an AI usage policy.

• After an incident: If a disciplinary, grievance, or health and safety incident exposes a gap between your policy and your practice, you must fix it and follow the proper protocol.

• Entering new markets or sectors: Different sectors present their own rules and regulations that prompt policy creation or review.

A warning on contractual policies

Some handbook provisions can become part of an employee’s contract, such as pay, hours, benefits and notice periods.

If you change contractual terms, you’ll usually need to consult the affected employees and secure their agreement, then confirm changes to their main terms in writing. ACAS explains how incorporated terms work.

You may also need formal approval from other directors or shareholders before making certain changes. So don’t treat the policy document as freely editable without following the necessary policy for updating the policy!

Policy review at a glance

The table below covers the core policies that apply to most growing UK businesses. Use it to identify gaps and create a living, breathing policy document that covers all the main areas.

Share scheme governance

If you're running an EMI scheme, CSOP, growth shares or unapproved options, the terms governing them are documented in option agreements and scheme rules.

These are governance documents with their own amendment constraints – they're contractual and, in the case of EMI and CSOP, tax-advantaged, so changes need handling carefully to avoid triggering a disqualifying event.

That said, they do need periodic review. A new funding round may require a fresh valuation for new grants. For tax-advantaged options, exercise prices are set at grant and changing fundamental terms can affect their tax treatment.

If your company has grown past the previous EMI thresholds, you may now qualify for a scheme you couldn't use before – and the eligibility tests are applied at the point of grant, not retrospectively.

Good leaver and bad leaver provisions should also be reviewed periodically for consistency, since inconsistency here is a common source of disputes.

Vestd takes the heavy lifting out of compliance and equity admin, but the governance decisions themselves are still yours to make, and worth reviewing alongside your wider company policies.

How Vestd supports good governance and growth

Policy review is part of a much broader governance question: is your business set up to scale, or is it still operating on the assumptions you made with a smaller team?

When it comes to equity, we handle scheme setup, grant management, vesting schedules, HMRC reporting, and Companies House filings to keep your scheme documentation up to date. Take control of your cap table, shareholder register, resolutions and statutory filings from one handy dashboard.

Book a free call with our friendly team.