Workplace policy procedure for employee publications: what each section must decide

This is a workplace policies policy template with the blanks filled in. It is a procedure, not a conduct policy, and it answers one question: when something an employee publishes becomes a workplace matter, what happens, in what order, decided by whom, and on what evidence.

Every section below carries a decision you can adopt, adapt, or reject. Have counsel review the finished text in every jurisdiction where you employ people, and bring any works council or union in at draft stage.

Point the procedure at your existing disciplinary process instead of building a second one. Two inconsistent processes are a liability on their own.

What to take away

The procedure, section by section

1. Purpose and scope. This procedure covers conduct published on personal and work accounts, on public platforms and internal channels, by employees, contractors, agency staff and volunteers. The mechanism binding each group differs, so list them separately.

Employees are bound by the handbook and the disciplinary procedure, contractors by the services agreement and the supplier code, agency staff through the agency's own terms. This document governs process only; the standards themselves sit in the conduct policy.

2. Intake. Reports go to the HR business partner for the reporter's department, by email to a single monitored address, or through the anonymous form. Organizations that want an outside channel can buy one: NAVEX sells EthicsPoint, a hotline and case management service, and AllVoices and Whispli sell anonymous reporting platforms. Pricing is quote-based.

The receiver logs the report within one working day and routes it within two. The receiver records what was reported, who reported it, the date received, and the next action taken. The receiver does not assess the substance.

Where the EU Whistleblower Directive applies, acknowledgment is due within seven days and feedback within three months. It reaches employers with 50 or more staff in most member states.

3. Immediate triage. Four categories leave this procedure at once, each with a named destination. Risk of harm to a person goes to the duty safety lead and, where there is an immediate risk, to emergency services.

Anything involving a minor goes to the designated safeguarding lead. Any legal demand, including a takedown notice or a letter before action, goes to the general counsel's office.

Any matter where the reporter or receiver has a personal stake goes to the head of people. Each destination is a named role, not a general instruction to escalate.

4. Preservation. The platform or IT lead captures full items with surrounding context and timestamps, not cropped screenshots. For public posts, that means a Wayback Machine capture at web.archive.org, which is free and timestamped, plus a local copy, since the archive honors exclusion requests.

Google Vault covers Workspace mail and chat. Microsoft Purview eDiscovery covers Microsoft 365 on E3 and E5, and Slack's compliance export covers Enterprise Grid.

The capture log records the item, the person who captured it, the date, the method, and a SHA-256 hash of each file. Nobody involved in the matter edits or deletes material while it is open, and that applies to the organization as much as to the individual.

5. Which version applies. A person is assessed against the rule in force on the date of the conduct. The HR systems owner keeps a dated archive of every policy version in one place, and the matter file cites the version and its effective date. Without that archive you cannot show which rule applied.

6. Who decides. The deciding panel is the head of people and one senior manager from outside the reporter's reporting line. Nobody decides a matter in which they are a participant, a reporter, or the line manager of a reporter with a stake in the outcome. The named substitute for each panel seat is recorded before any matter opens.

7. The standard applied. The panel applies the balance of probabilities: whether it is more likely than not that the conduct occurred, and whether it breached a named provision of the conduct policy. The provision is cited in the record.

An allegation is made out, not assumed. The general concept is set out in an explanation of burden of proof, which describes a legal setting rather than an internal one and is useful for the underlying idea rather than as a standard to import.

Within five working days of triage, the person receives the allegation in writing, the evidence relied on, the timescale for their response, and notice of whether they may be accompanied.

The allegation is specific enough to answer. A general concern cannot be responded to, and a process that never states the allegation produces an outcome that cannot be defended.

In the UK, the right to be accompanied at a disciplinary or grievance hearing comes from section 10 of the Employment Relations Act 1999, and the ACAS Code of Practice on disciplinary and grievance procedures sets the steps. In the US, union-represented employees have Weingarten rights, from NLRB v. J. Weingarten (1975).

8. The meeting and the response. The decision meeting is held within ten working days of the response deadline. The person may bring a colleague or a union representative where local law gives that right.

The minutes record who attended, what was put to the panel, and what the panel asked for. The panel decides on the record it holds at that meeting.

9. Outcomes. The range runs from no action with a note to no action with the record deleted. It also includes guidance, a written warning, and the steps in your disciplinary procedure. It can also lead to a change in the conduct policy where the case revealed a gap. Name all of them. The last two are the ones people forget.

10. Proportionality. The panel weighs what was published and its reach. It also weighs whether anyone was identified and whether it was corrected. It weighs whether the person reported it themselves and any prior matters. Self-reporting is treated differently from concealment, and practice has to match that statement.

11. Appeal. The appeal is heard by a director outside the original panel, within ten working days of the outcome letter. The basis is a review of the decision on the record, not a fresh hearing, unless the appellant shows new evidence that was not reasonably available at the time.

Say which one applies. Review and rehearing are different, and everyone assumes the other.

12. Records. The matter file holds the report, the capture log, the policy version cited, the decision, and the appeal outcome. Access is limited to the panel, the appeal hearer, and the records owner.

Retention follows your records schedule and counsel's advice, which varies by jurisdiction. Keep the policy versions themselves as records, since section 5 depends on them.

A dated archive of policy versions is also what a policy news timeline depends on when a rule changes.

13. Review. The head of people owns this procedure and reviews it every twelve months. Triggers for an earlier review: a contested outcome, a new platform, a new monitoring tool, a new market, or a matter that revealed a gap in the conduct policy.

The three decisions that carry the most risk

Triage, section 3. Left blank, everything enters the ordinary process, including the matters that must not. This section costs the most when it is missing and takes the least time to write.

The appeal basis, section 11. Review or rehearing. Unstated, the appeal becomes whatever the appeal hearer assumes, and the person appealing prepares for the other one.

The standard, section 7. Organizations resist writing down what has to be established, because it feels like importing a courtroom. The alternative is that each decider invents a standard, which is how comparable matters get different answers.

What sits around this

The conduct standards belong in a separate document, and the failure modes of drafting them are in what goes wrong with these policies.

The readable, staff-facing version of the expectations belongs somewhere else again, described in what guidelines are for.

Governance of the accounts, including ownership and access, has its own skeleton in a structure for the governing policy.

Any action a service has taken against the account is a separate process, unconnected to this one. Its outcome proves nothing here. What it can and cannot do is in the limits of an appeal to a service.

Before you adopt it

Common questions

Is this not too formal for a small organization?

The sections shrink; the structure does not. Even at ten people, somebody has to receive a report, somebody else has to decide, and a third person has to be available for an appeal. Working that out during an incident is what produces the bad outcome.

Can the same person handle intake and decision if we are very small?

Preferably not, and if it is unavoidable, say so in the document and name an external or board-level route for anything serious. A procedure that quietly relies on one person is one absence away from failing.

What if the conduct happened years ago?

Record when it occurred, which policy version applied, and how the matter came to light now. Delay is a relevant fact and it needs to be visible in the file rather than argued about later.

Do the timescales in sections 2, 8 and 11 need to be identical everywhere?

No. They are working defaults, and the lawful minimum or maximum in a given jurisdiction is set by that jurisdiction's employment authority, not by this document. Set each one against local advice and record the reason for any change.