Thousands of hours of evidence of trauma, pain and culpability presented to the current Royal Commission into Institutional Responses to Child Sexual Abuse have left no doubt that organisations have always been and continue to be responsible for enacting a culture that ensures that their own staff and volunteers do not harm, abuse or exploit children who are involved directly or indirectly with the activities or services provided by the organisation. In the past 6 years, through its Safeguarding Children Accreditation Program, the Australian Childhood Foundation has worked with more than 100 organisations nationally and internationally to strengthen their capacity to protect children and young people. Our experience has highlighted that substantial confusion exists about how to construct a child protection policy that frames the expectations and responsibilities of individuals who work, volunteer or use the services/activities of an organisation. In this paper, the authors offer a blueprint for considering the critical elements of a child protection policy that organisations can use to evaluate and possibly reconfigure or formulate their own. The paper outlines the function of the child protection policy in an organisation; the principles for constructing the policy; and an example of content for a child protection policy. The authors conclude that, if constructed with heart and sensitivity, a child protection policy can shape and define the very narrative about what the organisation stands for in relation to the safety of children and the responsibilities of adults to fulfilling the rights of children and young people more broadly.