Should we have an employee policy manual or is there a risk associated with putting things in writing? We've been told a written manual puts us at risk for an ex-employee suing us.

I would say the exact opposite - you're at much more risk without any policies. In fact, I worked with a group of OB/GYNs who were sued because their absentee policy was not documented, and they had given employees different leaves.

Written policies force you to be consistent and let everyone on staff understand the rules of the game. In fact, having a written dismissal policy, laying out the steps an employee can expect to go through before dismissal - for example, a verbal warning, a written warning, and a dismissal letter - is a very effective way to protect yourself from claims of unfair firing. Of course, this all assumes you actually follow the policies laid out in the manual. The only way a manual is risky is if the practice promises to act one way but doesn't follow its own standards.