Summary. A remote work policy does two jobs: it sets expectations about how people work, which is a management question, and it controls where they work, which is a legal one — because physical work location determines the applicable employment law, the payroll registrations, the workers' compensation coverage, and frequently the company's tax nexus. Most policies do the first and skip the second. This checklist covers both: eligibility and approval, the approved locations list and the reporting obligation that makes it enforceable, hours and timekeeping, expenses and equipment, home workspace safety and workers' compensation, security and monitoring, international restrictions, and the maintenance that keeps it current.

What this checklist is for. Drafting or auditing a remote work policy. For the underlying compliance framework, see Managing a Multistate Remote Workforce.

Phase 1 — Scope, eligibility, and approval

  • Define what the policy covers — fully remote, hybrid, and occasional remote work, which raise different questions.
  • Define eligibility: which roles are remote-eligible and why, with the criteria stated so the decision does not appear arbitrary. Confirm the criteria do not have a disparate impact on a protected group.
  • State that remote work is a business arrangement, not an entitlement, and that approval may be modified or withdrawn on notice, with the notice period stated.
  • Define the approval process — who approves, what is considered, and how long it takes.
  • Address reasonable accommodation: remote work may be an accommodation under the ADA or a state analogue, and a request framed as an accommodation must go through the interactive process rather than the ordinary policy.
  • Address religious accommodation requests similarly.

Phase 2 — Where work may be performed

This is the section most policies omit and the one that carries the legal weight.

  • Publish an approved work locations list — the states (and, if applicable, localities) where the company is registered and prepared to employ people.
  • Require employees to report their primary work location and to obtain approval before changing it, with a stated lead time sufficient to complete registrations — 30 to 60 days is realistic.
  • State plainly why the constraint exists: registration, tax, insurance, and employment law obligations attach to the state where work is performed. An explained constraint is followed; an unexplained one reads as distrust.
  • Address temporary work from another location — a stated day threshold beyond which approval is required, because several states impose withholding obligations after a small number of days.
  • Reserve the right to decline a location where the compliance cost is disproportionate, and to require an employee who relocates without approval to return or to accept a change in terms.
  • Require work from a fixed, appropriate location, not from a moving vehicle or a public space where confidentiality cannot be maintained.
  • Prohibit international work without written approval, and explain that immigration, host-country employment law, payroll and social insurance, permanent establishment tax exposure, data protection, and export control issues all apply.
  • Build the relocation checklist the approval triggers: registrations, workers' compensation confirmation, payroll setup, state notices, postings, handbook addendum, benefits network check, restrictive covenant review, and compensation band adjustment if the company uses geographic pay.

Phase 3 — Hours, timekeeping, and pay

  • State core hours or availability expectations, and distinguish them from a requirement to be online continuously.
  • For non-exempt employees, state clearly: all time worked must be recorded, working outside scheduled hours requires advance approval, and all recorded time will be paid whether or not approved.
  • Provide the timekeeping mechanism and require daily entry.
  • Address meal and rest breaks, including scheduling and a certification process in states requiring them with premium pay.
  • Prohibit off-the-clock work explicitly, and train supervisors that permitting or encouraging it is a violation regardless of who initiated it.
  • Address after-hours communication expectations, and note that several jurisdictions have adopted or are considering right-to-disconnect rules.
  • Confirm the policy does not undermine the exempt status of exempt employees through improper deductions or scheduling.
  • State whether compensation is adjusted by geographic location, and if so how bands are determined — recognizing pay transparency and pay equity obligations.

Phase 4 — Equipment, expenses, and workspace

  • State what equipment the company provides, who owns it, how it is returned, and what happens if it is damaged or lost.
  • Address personal device use, and if permitted, the security requirements and the company's right to manage, wipe, or access the device — with any consent required by state law obtained.
  • State the expense reimbursement approach. Several states require indemnification of necessary business expenses, including a reasonable portion of home internet and mobile phone. A documented monthly stipend applied in those states (and frequently company-wide for simplicity and morale) is the workable answer; state the categories the stipend is intended to cover.
  • Address home office setup costs and whether the company contributes.
  • Address travel to the office — whether it is compensable time for non-exempt employees, whether the expense is reimbursed, and how frequently attendance is required.
  • Set home workspace requirements: a safe, ergonomic, distraction-appropriate space; adequate connectivity; and a private area for confidential work.
  • Include an ergonomic self-assessment and confirm employees have completed it.
  • Address workers' compensation: injuries arising out of and in the course of employment are covered even at home, and employees must report any work-related injury immediately through the normal process.
  • Reserve a right of inspection of the workspace, exercised with notice — noting that most employers do not exercise it and that the reservation still helps.
  • Prohibit dependent care as a substitute for arrangements during working hours, in a manner that is realistic rather than punitive.

Phase 5 — Security, confidentiality, and monitoring

  • Require use of company-approved systems and networks, and prohibit storing company data on personal accounts or unmanaged devices.
  • Require multifactor authentication, current operating systems and patches, endpoint protection, and encrypted storage.
  • Address home network requirements — a changed default router password, WPA2 or better, and no work on public Wi-Fi without the VPN.
  • Address physical security — locked storage for documents and devices, screens not visible to others, and no confidential calls where they can be overheard, including by household members.
  • Address printing and disposal of physical documents, including secure destruction.
  • Address video and voice meetings: recording only with the consent the applicable state requires (several require all-party consent), backgrounds that do not disclose confidential information, and the treatment of transcripts.
  • Provide monitoring notice where the company monitors systems, and obtain any consent or acknowledgment state law requires — one state requires prior written notice with acknowledgment, and several regulate electronic monitoring.
  • Reference the confidentiality and invention assignment obligations, and the acceptable use policy.
  • Address incident reporting — what to do and whom to contact if a device is lost or a system is compromised, within a stated time.
  • Confirm the policy is consistent with the company's information security program and with any client or regulatory requirement that applies to the work.

Phase 6 — Management, maintenance, and acknowledgment

  • Address performance management — expectations, measurement, and the fact that performance standards are the same for remote and on-site employees.
  • Address communication norms, meeting practices, and inclusion, so remote employees are not disadvantaged in assignments and advancement — which is both a management issue and a discrimination risk.
  • Address training and development access.
  • State the process for modifying or ending a remote arrangement, and any return-to-office requirement, with notice.
  • Cross-reference the state-specific handbook addenda, and confirm the addendum for each approved state addresses that state's sick leave, break, expense, notice, and posting requirements.
  • Deliver required postings electronically in a manner employees are affirmatively directed to.
  • Collect a signed or auditable acknowledgment of the policy, and a new one on any material revision.
  • Assign an owner for the policy, with a review calendar — quarterly for legislative changes in the approved states and annually for the whole document.
  • Confirm the HRIS work location field is required, populated, and audited, because the policy is unenforceable without it.

Common mistakes

  • No approved locations list and no reporting obligation, so the company learns where people work from a tax notice.
  • A policy that addresses productivity and ignores jurisdiction.
  • No timekeeping discipline for remote non-exempt employees, where the work is invisible and the exposure is not.
  • Ignoring expense reimbursement in the states that require it, which is a class-actionable, uniform exposure.
  • Monitoring without the notice or consent state law requires.
  • Recording meetings without all-party consent in states that require it.
  • Treating remote work as an entitlement, which makes withdrawing it a dispute rather than a decision.
  • Handling an accommodation request through the ordinary policy instead of the interactive process.
  • Permitting international work without an immigration, tax, and data protection analysis.
  • Never updating the policy, so it describes a set of approved states the company left two years ago.

Primary authority

  • Federal: the FLSA, 29 U.S.C. §§ 201–219, and 29 C.F.R. Parts 785 (hours worked) and 516 (recordkeeping); the ADA, 42 U.S.C. § 12101 et seq., and the interactive process; Title VII, 42 U.S.C. § 2000e et seq.; the NLRA, 29 U.S.C. § 151 et seq., which constrains overbroad confidentiality and communication rules; the Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq.; OSHA's general duty clause, 29 U.S.C. § 654.
  • State: wage payment and expense reimbursement statutes; daily overtime and meal and rest break requirements; paid sick leave ordinances; electronic monitoring notice statutes; all-party consent recording statutes; workers' compensation acts and their extraterritorial provisions; and state registration, withholding, and unemployment insurance requirements.

Related

This checklist is educational and not legal advice. Employment, expense reimbursement, monitoring, and recording requirements vary substantially by state and change frequently. Consult qualified employment counsel before adopting or revising a remote work policy.