How to Write HR Policies for a Startup
- 13 Oct 2026
- 8 mins
A couple of years ago, I advised a consulting firm with less than 50 employees that offered unlimited PTO, yet their approval process turned down roughly 27% of time-off requests.
Employees had to request time off at least 3 weeks ahead of time, or the system automatically rejected it. Every request also needed a manager's approval, even if that manager was away. To make matters worse, the company set blackout dates during peak vacation weeks.
Many requests missed the 3-week cutoff because people cannot always plan that far ahead. Other requests sat there with no decision because absent managers missed their notifications.
When I revamped the policy, all requests were approved automatically. As a result, average annual time off increased from 18 to 20 days.
The solution came down to 2 simple questions I now ask about every policy:
- How high are the stakes?
- How much does each situation vary?
The answers show whether you need a strict rule, a general principle, or no policy at all.
Rules vs Principles: What's the Difference?
A rule is something people have to follow to the letter, with no deviation at all. In contrast, a principle clarifies the overall goal, but gives people freedom in how they reach it. Most companies treat every policy as a strict rule, but principles belong in the employee handbook with the exact same authority.
Early in my HR career, I thought every policy had to be a detailed, step-by-step process, or it was no good. That's what HR looked like when I started, and I'm someone who loves structure.
Working with startups changed my mind. I kept seeing rigid processes in areas that weren't critical to the business, and they wasted time without moving the needle. Turning everything into a 15-page policy treats a business full of adults like a daycare. It's the same problem I see when startups copy enterprise HR processes.
The 2 Questions That Sort Every Startup HR Policy
To write HR policies for a startup, ask 2 simple questions about each one. First, are the stakes high or low? Second, does each case look the same every time (low variance), or is every situation different (high variance)?
High stakes means compliance, regulation, security, or anything else with a significant impact on the company's ability to do business. Anything the law requires you to have, such as an anti-harassment policy or a leave policy, is high stakes.
Once you answer these questions, each policy will fall into one of the following quadrants:
- High stakes, low variance: Write a strict rule with a set process. For example, job offers must be handled the same way every time.
- High stakes, high variance: Write a rule with a set process. For example, discrimination complaints vary, but the legal risk requires a clear procedure every time.
- Low stakes, high variance: Write a general principle. For example, day-to-day expenses vary widely, from a quick coffee to a new computer.
- Low stakes, low variance: Skip the formal policy. For example, booking a meeting room only needs a shared calendar or team habit.
When the stakes are high, always create a rule. Variance only matters for low-stakes situations.
The right quadrant for a policy also depends on your business. For example, expenses are low stakes for most companies, but at a small nonprofit running on tight grants, they can be high stakes.
What Changed When the PTO Process Became a Principle
At the consulting firm, PTO was a low-stakes, high-variance policy that was being run as a high-stakes rule. I replaced it with the following principle:
Take the time you need, as long as you give your team visibility and no commitments fall through the cracks while you're out.
We added that we expect everyone to take at least 20 days of vacation a year, and we removed the blackout dates.
That was the whole policy. Employees entered their time off in the HR system, and every request was approved automatically, with no manager sign-off. If someone disappeared without telling their team or a deliverable was missed, that person was held accountable.
Besides taking a little more time off, people started spreading their vacation across the year instead of squeezing it into the weeks between blackout dates. That made an impact because several people on the team were the only ones who could do their jobs. Spreading their time off made coverage easier for everyone who was working. 6 months later, managers and staff also confirmed that they hadn't felt any negative impact on the work.
What Happened When a High-Stakes Process Stayed Loose
Right after COVID, I worked with an online clothing retailer whose termination and offboarding process was barely defined. The tasks and the paperwork changed every time someone left.
The gap showed up in an internal audit while the company was working toward its ISO 9001 quality management certification. Because the warehouse had high turnover, about 200 offboarding records had to be rebuilt. The company's 3 HR generalists spent about 2 months filling in the gaps and reconstructing the personnel records, on top of their regular jobs.
Some former employees still had company devices, and 3 of them even had access to their old email accounts. Fortunately, none of them used that access, and the company only found out about it because of the audit.
Offboarding is a high-stakes, low-variance process, so it should have been a rule from the start. This company had around 500 employees, and the same process would have been just as high stakes at a headcount of 50. After the audit, the company rewrote it as a detailed process that people had to follow to the letter.
Setting Limits Inside a Principle
The most common worry about a principle-based policy is that people will abuse it, especially if we’re talking about expense management.
Let’s take the example of an expense policy and how we can apply a principle to it.
A principle can include a limit. For example, "Spend company money as if it were your own" sets the baseline. Adding a requirement for manager approval on purchases over $1,000 gives people a clear cap while trusting them with the details. It avoids overly rigid rules or complex approval steps for everyday items.
At the consulting firm I mentioned earlier, one employee kept taking time off without logging it in advance, and then entered it several days after his return. He received a warning after 2 occurrences, and when it happened again, he was fired immediately. We didn't just change the policy because of one outlier.
I did the same thing at my own company. When I ran Dynamic Recruit, a recruitment and executive search firm I started in 2011, my 3 recruiters had company phones for calls and interviews. The only instruction I gave them was “use the phone responsibly as if you were paying the bill.”
Soon after, one recruiter ran up a $700 bill. When I pulled the detailed invoice, I found out that more than $500 of it was personal calls, many of them international. She denied it until I showed her the bill, and I fired her on the spot. The other 2 recruiters understood that I trusted them, and that I'd hold them accountable if they broke that trust. I ran that business for 4 years and I only dealt with this situation once.
If you build rules around every exception, you end up with a slow company. I worked closely with a luxury fashion brand of around 85 employees where buying a light bulb needed sign-off from an accountant, then the CFO, then the CEO! Approval took 3 to 4 business days, because that's how often accounting sent the stack of paper purchase orders around for signatures.
Principles hold up at any size when you hire people you can trust to use good judgment. Netflix is a large enterprise, and its published expense policy is 5 words long: "Act in Netflix's best interests."
How to Get Leadership to Agree to Looser Policies
You'll almost always get pushback when you recommend loosening a policy, because leaders worry the company will turn into a free-for-all. Compare the time you spend enforcing a policy with the impact of people breaking it. Since you should only loosen low-stakes policies, that impact is usually small and easy to fix.
Then, show leadership what the company could do with the time it spends enforcing a low-stakes policy. That argument wins in most cases. If you need to put numbers on it, build it the way you would any HR business case.
If leadership still says no, start with a pilot. Loosen one low-stakes policy for a subset of the organization, such as a single team, and share what happened with leadership after an agreed period. A pilot gives skeptical leaders proof of concept from inside their own company before you roll the change out to everyone.
How to Write HR Policies for a Startup
Sort every policy by stakes and variance using the matrix above, then write a rule with a fixed process for anything high stakes, a principle for anything low stakes and high variance, and nothing at all for the rest. At most startups, you can review your written policies in a couple of days and make your decisions within a week. Here is the step-by-step process for doing this:
- Start with the written policies: List every policy and process you have on paper, and put each one through the 2 stakes and variance questions.
- Turn the high-stakes ones into rules: Make sure every high-stakes policy is a rule with a fixed process that people follow the same way every time.
- Rewrite the low-stakes ones as principles: State the purpose and the outcome you expect, and add a spending limit or sign-off only where the money or the risk justifies one.
- Write down the unwritten rules: List the processes people follow by habit, and sort them the same way, because informal processes stop working as a company grows.
- Bring in the right people: Involve whoever approves spending for expenses, whoever runs marketing for social media, your employment counsel for employee relations, and whoever manages IT for equipment and system access.
- Explain the change: Tell people why each rule or principle exists, what happens to the business if it's ignored, and what the consequences are. Train people on what acceptable behavior looks like, but expect and plan for people to keep following the old process for 1 to 2 months.
- Hold people accountable: When someone misuses a principle, warn them the first time and follow your normal discipline process if it happens again. Leave the policy in place.
The Leading with Strategy and Elevating HR module in The Startup HR Operating System walks you through how to design flexible policies that give your team clear limits without slowing decisions down. It includes practical examples of rigid policies rewritten as principles, for expenses, PTO, learning budgets, and more.
