Social media is taking the world by storm, and for businesses, this means their employees are using Facebook, Twitter, LinkedIn and a host of other social media services. In addition, for many companies, social media is becoming an important business tool with many potential benefits, the most common example being low-cost marketing, but with a multitude of other creative uses developing rapidly. However, the personal and business uses of social media are attended by substantial risks that are varied, numerous and of potentially great consequence.

Accordingly, it is critical that organizations put in place policies controlling or at least influencing social media use. Although even comprehensive policies that are effectively monitored and enforced cannot ensure protection from every potential risk, this reality does suggest that establishing social media policies is an exercise in futility. Most employees will do their best to make a good-faith effort at compliance, especially when they are reminded of the consequences of noncompliance. Furthermore, in many legal and regulatory contexts, the company’s good-faith policies can minimize the imputation of rogue employee behavior to the company.

Apart from legal guidance, employees need to know the company’s view on how social media is to be used to further the business goals of the organization if they are to effectively help achieve those aims. From a business perspective, as well as from a legal perspective, there are risks and consequences, as well as opportunities. Accordingly, policy needs to broadly outline the company’s social media strategy. Sometimes this means encouraging the use of social media, and sometimes it emphasizes the negative consequences to the employee of unauthorized social media activity.

Different industries, businesses and companies have different needs and should not take these general suggestions as customized requirements for their unique situations. These are merely examples. A complete policy will include many other important subjects and provisions. Expert and experienced guidance in forming corporate social media policies is optimal, and many companies have made their policies publicly available online. These resources can be helpful, but with the caveat that policies suited to one organization may be completely inappropriate for another.

Here are some of the must-haves in a comprehensive corporate social media policy:

1. Introduction and explanation. Not all employees are users of or even familiar with social media. Accordingly, an explanation of the policy subject matter is in order with some context on the social media phenomenon.

2. Statement of rationale. Employees need to understand why the policy exists so they treat it with due respect and understand the company’s strategy in this evolving field. Also, as referenced above, it is important for the company show its good faith if challenged by regulators or litigation adversaries.

3. Authorization. The company must decide when authorization is required to make social media postings about it or on its behalf. Where social media is used as part of corporate business strategy, the company should define the degree of discretion needed to post without first receiving further authorization from a manager.

4. Do not assume common sense is common. It may seem unnecessary to tell employees to exercise good judgment, but doing so in connection with social media activity is important for at least two reasons. First, many people treat social media precisely as if it were a world where normal standards of conduct do not apply—indeed, as if that were the point of the medium. Second, in light of this tendency and the immediacy with which potentially disastrous postings can spread globally through social media, it is helpful for employees to have principled behavior top of mind when using social media. References to other policies governing ethical business conduct are a common feature of corporate social media policies.

5. Address representation of company. Many people don’t consider that when they have identified their employer online, their audience may assume that their postings represent the positions of the company. This is especially true with senior executives; the public may automatically assume that anything they say represents company viewpoint. Many companies require employees to post disclaimers divorcing their personal views from those of the company. On the flip side, employees who are speaking on behalf of the company, even when authorized by the company, should make it clear that they are doing so and not use subterfuge to appear as though their postings are coming from another source (such as a consumer of the company’s products). 6. Emphasize personal and corporate consequences. Remind employees that apart from the risk their social media activities could pose to the company and the internal compliance discipline they could face, they may have personal legal liability for actions that have created liability exposure through social media.

7. Reiterate intellectual property and confidentiality concerns. Early in the history of the Internet, we learned that it has a unique ability to facilitate IP infringement as well as speed the distribution of previously confidential information. Companies should emphasize that the ease of information transfer through social media amplifies this danger.

8. Identify privacy issues. Debate about privacy concerns associated with social media has dominated the subject in the media. Remind employees about privacy sensitivities of co-workers, clients and others. Aside from not disclosing information of a personal nature, it is advisable to stay away from topics such as religion and politics, which are hot buttons that can quickly ignite a firestorm.

9. Third-party communications. Responding to third-party postings about the company should be done in a principled manner. For example, engaging in hostile exchanges with angry customers is ill-advised. Employees should have guiding principles for addressing such incoming commentary.

10. Provide best-practices advice. There are a host of communications practices, many of them applicable broadly beyond social media, that companies should identify to employees authorized to post about it or for it. Examples include using professional language, being polite and honest and correcting mistakes.

11. Media relations. Where media sources contact the company through social media channels or post content relevant to the company, the company should have guidelines directing employees to the personnel within the organization who handle such matters.

Many social media policy subjects may overlap with those covered in more general computer use policies or employee conduct policies. However, the latter policies may be too general to provide specific guidance to employees on social media issues. The potential risks from social media use suggest that specific policy guidelines are well worth considering and documenting.

For more tips from in-house attorneys on crafting social media policies, read: “3 companies discuss social media governance policies.”