POSH Act Compliance for Employers: IC, Policy & Filing Guide

POSH Act Compliance for Employers: IC, Policy & Filing Guide

POSH Act compliance is one of those obligations that many Indian SMBs discover only when something goes wrong — a complaint arrives, a client's vendor audit asks for the annual report, or a job applicant asks whether an Internal Committee exists. By then, the gaps are expensive to fix. The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — commonly called the POSH Act — applies to virtually every workplace in India, including startups with a handful of employees. This guide walks HR managers, founders, and compliance owners through the full compliance lifecycle: what the law requires, how to constitute an Internal Committee, how to draft a policy that actually works, how to handle a complaint from receipt to closure, and how to stay compliant year after year.

A note before we begin: this article explains the framework in general terms for awareness and planning. Statutory requirements, filing formats, and district-level practices vary and get updated, so always verify current requirements with official government sources or a qualified legal professional before acting.

What the POSH Act Covers and Who It Applies To

The POSH Act was enacted to give effect to the workplace safety principles first laid out in judicial guidelines in the late 1990s. It creates a preventive and redressal framework for sexual harassment of women at the workplace.

Applicability: almost every employer

The Act applies to workplaces across the private sector, public sector, NGOs, and the unorganised sector. Key points employers routinely get wrong:

• There is no minimum employee threshold for the Act to apply. Even a two-person startup is covered. The 10-employee threshold matters only for deciding whether you must set up an Internal Committee or rely on the district-level Local Committee.
• "Workplace" is defined broadly. It includes the office itself, any place visited by an employee arising out of or during employment (client sites, offsites, conferences), employer-provided transport, and — as most practitioners interpret it today — remote and virtual work settings, including harassment over video calls, chat tools, and email.
• "Employee" is also broad. Regular, temporary, ad hoc and daily wage workers, contract staff, probationers, trainees, apprentices, and even persons working without pay (interns, volunteers) are covered.
• The complainant is an "aggrieved woman," who need not be an employee at all — a visitor, customer, or vendor's staff member harassed at your workplace can file a complaint with your Internal Committee. Many companies voluntarily extend their internal policy to complainants of all genders, which is a good practice, though the statutory machinery is specific.

What counts as sexual harassment

The Act describes sexual harassment to include unwelcome physical contact and advances, demands or requests for sexual favours, sexually coloured remarks, showing pornography, and any other unwelcome physical, verbal, or non-verbal conduct of a sexual nature. It also recognises circumstances that aggravate the offence — implied or explicit promises of preferential treatment, threats of detrimental treatment, interference with work, or creating an intimidating, offensive, or hostile work environment.

Two practical implications for HR:

1. "Unwelcome" is judged from the recipient's perspective. Intent does not sanitise impact. Training must make this explicit.
2. A hostile work environment claim does not require a direct proposition. Repeated inappropriate jokes in a team channel can be enough.

The Employer's Core Obligations at a Glance

Before diving deep, here is the compliance checklist in summary form:

Non-compliance can attract monetary penalties, and repeat offences can lead to higher penalties and even cancellation of business licences or registrations. Beyond statutory risk, IC and policy gaps are increasingly checked in enterprise vendor onboarding, due diligence for fundraising, and ESG assessments — so for an SMB, POSH compliance is also a commercial credential.

Constituting the Internal Committee: Step by Step

The Internal Committee (IC) — formerly called the Internal Complaints Committee (ICC) — is the heart of the framework. Getting its composition wrong can invalidate an entire inquiry, so treat this as a precision exercise.

Composition requirements

The IC must have a minimum of four members:

1. Presiding Officer: a woman employed at a senior level at the workplace. If no senior woman is available at that workplace, one can be nominated from another office or unit of the same employer.
2. At least two members from among employees, preferably committed to the cause of women or with experience in social work or legal knowledge.
3. One external member from an NGO or association committed to the cause of women, or a person familiar with issues relating to sexual harassment — often a lawyer or POSH consultant in practice.

Additional rules that trip up employers:

• At least half the members must be women.
• The external member is mandatory — an IC without one is defectively constituted, and its findings can be challenged.
• Tenure is capped at three years from the date of nomination. Track expiry dates; an IC whose members' terms have lapsed is a common audit finding.
• Multiple locations: an IC is required at every workplace or branch with 10 or more employees. Practices vary on whether one IC can cover multiple nearby locations, so structure this carefully and verify for your state.
• Fewer than 10 employees: complaints go to the district-level Local Committee (LC). You still need a policy, notices, and training.

Practical constitution process

1. Identify candidates. Choose people with credibility, discretion, and availability. IC work is sensitive and time-consuming during an inquiry.
2. Obtain written consent from each member, including the external member (record any fees payable to the external member — a reasonable sitting fee is standard practice).
3. Issue a formal constitution order signed by the employer, naming each member, their role, and tenure dates.
4. Publish the IC's details. Names and contact details of IC members must be displayed prominently at the workplace — and for distributed teams, on the intranet or HRMS portal.
5. Train the IC immediately. Members need to understand the inquiry procedure, principles of natural justice, confidentiality obligations, and report-writing before the first complaint arrives, not after.

Common IC constitution mistakes

• Appointing the HR head as Presiding Officer by default even when a more senior woman leader exists, creating perceived conflict of interest.
• Letting the external member be a friend of the founders with no relevant background.
• Forgetting to reconstitute the IC when members resign from the company.
• Not appointing a new IC order after the three-year tenure ends.
• Having no IC at a second office that quietly crossed 10 employees.

Drafting a POSH Policy That Actually Works

A policy downloaded from the internet and never read is a liability. Your policy should be short enough to be read and specific enough to be followed.

Essential contents

• Scope: who is covered (all genders as a matter of internal policy, if you choose), which locations, remote work, offsites, work-related social events, and digital channels.
• Definitions with examples: abstract legal language plus concrete, workplace-realistic examples of verbal, non-verbal, physical, and digital harassment.
• IC details: names, roles, contact information, and how to reach the IC confidentially.
• Complaint procedure: how to file, time limits, what happens next, expected timelines at each stage.
• Interim reliefs available: transfer, leave, or work adjustments during inquiry.
• Confidentiality commitments and the prohibition on retaliation against complainants and witnesses.
• Consequences: the range of disciplinary actions for proven harassment, and the provision for action against malicious complaints (with the important caveat that a complaint that simply cannot be proven is not malicious).
• Employer's commitments: training frequency, annual review of the policy.

Communication and acknowledgement

Policy communication should be provable. Best practice for SMBs:

• Include the policy in onboarding with e-sign acknowledgement through your HRMS.
• Re-circulate annually and after any material amendment.
• Display the statutory notices (penal consequences of sexual harassment and the IC's constitution) at conspicuous places, in English and the regional language.
• Cover contract staff and interns explicitly — share the policy with staffing vendors and require them to communicate it.

The Complaint Process: From Receipt to Closure

When a complaint arrives, the clock starts and precision matters. Here is the lifecycle in broadly accepted terms — verify the current rules for exact timelines in your context.

Stage 1: Filing

• A complaint is generally to be made in writing within three months of the incident (or the last incident in a series). The IC can extend this window for recorded reasons, and must assist a complainant who cannot make a written complaint.
• Complaints can be filed by certain others (e.g., legal heirs or persons authorised in specific situations) where the aggrieved woman is unable to do so.

Stage 2: Conciliation (optional)

• Only at the request of the complainant, the IC may attempt conciliation between the parties before starting an inquiry.
• Monetary settlement cannot be the basis of conciliation.
• If a settlement is reached, it is recorded and no inquiry follows; if its terms are breached, the complainant can return to the IC.

Stage 3: Inquiry

• The IC conducts the inquiry following principles of natural justice: both parties get the opportunity to be heard, to present evidence and witnesses, and to respond to the other side's version. Lawyers generally do not represent parties before the IC.
• A commonly followed sequence: written complaint shared with respondent → respondent files reply with documents and witness list within a set period → IC hears parties and witnesses separately → both parties get to review and rebut → IC deliberates.
• The inquiry is generally expected to be completed within 90 days.
• Quorum matters: IC proceedings typically require a minimum number of members including the Presiding Officer to be present.
• Interim reliefs: during the inquiry, on request, the IC can recommend transferring the complainant or respondent, granting the complainant leave (in addition to her regular entitlement), or restraining the respondent from supervising the complainant's work.

Stage 4: Findings and report

• The IC submits its report — typically within 10 days of completing the inquiry — to the employer, with findings and recommendations.
• If the allegation is proven, recommendations can range from written apology, warning, withholding of promotion or increments, to termination, alongside possible deduction from the respondent's salary as compensation to the complainant. Compensation considerations include mental trauma, loss of career opportunity, medical expenses, and the respondent's income.
• The employer is expected to act on the recommendations within 60 days.
• Both parties receive a copy of the findings and have appeal rights to the designated court or tribunal within the prescribed period (commonly cited as 90 days).

Confidentiality throughout

The Act specifically prohibits publication of the identity of the complainant, respondent, witnesses, and inquiry contents. Breaches attract penalties on the person disclosing — brief your IC, HR team, and IT admins accordingly. Keep inquiry records access-controlled; if you use an HRMS, store POSH case files outside general HR folders with restricted permissions.

Training and Awareness: The Preventive Half

The Act's title begins with "Prevention" for a reason. Employers must organise workshops and awareness programmes at regular intervals and orientation programmes for IC members.

A practical annual training calendar for an SMB:

Tips that improve effectiveness:

• Use scenario-based training rather than legalese; grey-area scenarios generate the discussion that changes behaviour.
• Deliver in the languages your workforce actually speaks.
• Track attendance in your HRMS and chase completions like you would statutory filings — attendance records are your compliance evidence.
• Ensure senior leadership visibly attends. Culture follows what leaders do.

Annual Report and Ongoing Filings

Each calendar year, the IC must prepare an annual report and submit it to the employer and the District Officer (the authority notified for your district). The report typically covers: number of complaints received and disposed of during the year, cases pending beyond 90 days, workshops or awareness programmes conducted, and the nature of action taken by the employer.

Practical notes:

• District-level submission mechanics vary — some districts accept email, others require physical filing; some states have online portals. Identify your District Officer early, not in the last week of the year.
• Companies covered by board-report disclosure requirements must also include a statement on POSH compliance (including complaint statistics and IC constitution) in the relevant filings. Check with your company secretary for what applies to your entity.
• Even a "nil complaints" year requires the report. A nil report with documented training is a strong compliance posture; a missing report is a finding.

A 30-60-90 Day POSH Compliance Plan for SMBs

If you're starting from scratch, here's a realistic sequence:

Days 1–30: Foundation

• Count employees per location; determine IC vs LC applicability.
• Identify and secure consent from IC members, including the external member.
• Issue the IC constitution order; publish member details.
• Adopt a POSH policy; add sexual harassment as misconduct in HR policies.

Days 31–60: Communication and training

• Roll out policy acknowledgement via HRMS to all employees, interns, and contract staff.
• Display statutory notices at all offices in required languages.
• Conduct first all-hands awareness session and dedicated IC training.
• Set up a confidential complaint channel (dedicated email accessible only to the IC).

Days 61–90: Operationalise

• Prepare inquiry templates: complaint acknowledgement, notice to respondent, deposition record, report format.
• Create a POSH case register (even if empty) and a records-retention protocol.
• Calendar the annual report, training refreshers, and IC tenure expiry in your compliance tracker or HRMS.
• Brief leadership on their role and on non-retaliation.

How HR Software Helps POSH Compliance

While no software conducts an inquiry for you, an HRMS reduces the administrative failure points that cause most non-compliance:

• Policy distribution and e-acknowledgement with timestamps, including for new joiners automatically during onboarding.
• Training tracking — assign modules, chase completion, export attendance evidence.
• Compliance calendar — reminders for annual report filing, IC tenure expiry, and training refreshers.
• Headcount monitoring per location — get alerted when a branch crosses 10 employees and needs its own IC.
• Access-controlled document storage for IC records with audit trails.

Handling Difficult Scenarios

Real cases rarely arrive in textbook form. Here is how experienced ICs and HR teams think through the messy situations.

Anonymous complaints

The statutory process requires a written complaint from the aggrieved woman (or an authorised person), so a fully anonymous note generally cannot trigger a formal IC inquiry. But it should never be binned. Treat it as intelligence: the employer can conduct a discreet workplace review, reinforce training in the relevant team, and make it easier for the affected person to come forward safely. Some companies route anonymous inputs to the IC chair for a preliminary sensing exercise. Document what you did — a pattern of ignored anonymous signals looks terrible in hindsight.

The respondent resigns mid-inquiry

Resignation does not automatically end the inquiry. The IC can complete its process and record findings; the employer can reflect the outcome in the exit records and respond accurately to background verification requests from future employers. Stopping an inquiry the moment a respondent resigns creates two risks: the complainant is denied closure and compensation recommendations, and the organisation learns nothing about what its systems missed.

The complainant wants to withdraw

Withdrawals happen — sometimes because the matter is genuinely resolved, sometimes under social pressure. The IC should meet the complainant privately, confirm the withdrawal is voluntary, record it in writing, and remind her that she may re-approach if the behaviour recurs. If the IC has independent reason to believe serious misconduct occurred, the employer can still consider disciplinary action under its general conduct policies, separate from the POSH process.

Complaints involving another organisation's employee

If your employee is harassed by a client's or vendor's staff member at their premises, your role is to support her complaint to the other organisation's IC and provide all assistance — including adjusting reporting lines or project assignments while it proceeds. Conversely, if a vendor's employee complains about your employee, your IC handles it. Build these cross-company scenarios into manager training; they are increasingly common in the era of embedded teams and co-working spaces.

Malicious complaints — handle with extreme care

The framework does allow action against complaints that are proven malicious or where false evidence is produced. But the bar is deliberately high: an inability to substantiate a complaint is expressly not malice. ICs should invoke this provision rarely and only with clear evidence of deliberate falsehood, because even one heavy-handed use will chill genuine reporting for years. When in doubt, close the case without adverse findings on either side.

Interplay with criminal law

Sexual harassment can also constitute a criminal offence. The POSH process is a civil, employment-side remedy; it neither requires nor prevents a police complaint. If the complainant wishes to pursue criminal action, the employer is expected to assist her. The IC inquiry can proceed in parallel with a criminal case — take legal advice on sequencing, but do not use a pending criminal matter as an excuse to freeze the internal process indefinitely.

Budgeting and Resourcing POSH Compliance

For founders wondering what this costs, a realistic annual budget for a 50–200 employee company includes: external member sitting fees (per meeting or per case), an annual training program (external trainer or a good e-learning module), poster printing for each office, and occasional legal consultation for tricky cases. In aggregate this is typically a small five-figure to low six-figure rupee amount per year — trivial compared to the cost of a single mishandled case, which can include tribunal proceedings, senior management time, attrition in the affected team, and reputational damage that shows up in Glassdoor reviews and hiring funnels.

Resourcing tips:

• Nominate a compliance owner (usually the HR lead) whose calendar owns the annual report, training refreshers, and IC tenure tracking.
• Keep a bench: nominate one alternate internal member so the IC survives resignations without emergency reconstitution.
• Negotiate an annual retainer with your external member covering both sitting fees and ad hoc advice; it is usually cheaper than per-case pricing.
• For multi-city SMBs, consider empanelling one external member per region to avoid travel costs for in-person hearings.

Measuring Whether Your Program Actually Works

Compliance artefacts are the floor, not the ceiling. Mature organisations track a few indicators:

• Awareness scores: short quiz results after training; the goal is that every employee can name the IC and describe how to complain.
• Reporting channel health: a workplace with zero complaints for years and low psychological safety scores is more likely under-reporting than harassment-free. Read complaint volume alongside engagement survey data.
• Cycle times: days from complaint to inquiry start, and complaint to closure, against the 90-day expectation.
• Training completion: percentage of active headcount (including contractors) covered in the last 12 months.
• Manager behaviour: whether disclosures made to managers reach the IC promptly — a common breakpoint, fixable with manager training.

Review these with leadership once or twice a year. A ten-minute standing agenda item does more for prevention than a laminated poster ever will.

Frequently Asked Questions

1. We have only 8 employees. Do we need to do anything under the POSH Act? Yes. The Act applies to you; only the IC requirement is linked to the 10-employee threshold. You still need a policy, awareness measures, and notices, and complaints from your workplace go to the district Local Committee. Also remember interns and contract staff count toward headcount in practice — take a conservative view and verify.

2. Can men file complaints under the POSH Act? The statutory framework provides redress to an aggrieved woman. However, many employers adopt gender-neutral internal policies so that complaints from men and non-binary employees are addressed through a parallel internal disciplinary process. This is widely considered good practice.

3. Who can be the external member of the IC, and do we have to pay them? Someone from an NGO or association committed to the cause of women, or a person familiar with sexual harassment issues — commonly an advocate or POSH practitioner. Paying a reasonable fee for attending proceedings is standard. Document the engagement.

4. What if the accused is the founder or CEO? The IC still has jurisdiction if the respondent is an employee of the workplace. This is exactly why a credible external member and a senior woman Presiding Officer matter. Where the respondent's seniority compromises the IC's independence, take legal advice on strengthening the process — but do not ignore the complaint.

5. What happens if we don't file the annual report or never formed an IC? Monetary penalties can follow, and repeated non-compliance can escalate to higher penalties and cancellation or non-renewal of licences or registrations required for the business. Separately, expect it to surface in client audits and due diligence.

6. Is a complaint about conduct at an offsite party covered? Generally yes — "workplace" extends to places visited by the employee arising out of or during the course of employment, which is commonly understood to include work events, travel, and client locations.

7. How long should we retain inquiry records? The law emphasises confidentiality rather than prescribing a single retention period; practitioners commonly retain records for several years given appeal timelines and potential proceedings. Set a written retention policy with restricted access and take advice on the period.

8. Do remote-only companies need an IC? If you employ 10 or more people, constitute an IC even if fully remote — harassment over digital channels during work is within the framework as commonly interpreted. Publish IC details on your intranet or HRMS instead of a physical noticeboard, and additionally at any registered office.

Conclusion

POSH compliance is not a one-time paperwork exercise — it is a small system: a properly constituted IC, a readable policy, provable training, a rehearsed complaint process, and an annual report that goes out every year without drama. For an SMB, the entire system can be stood up in 90 days and maintained in a few hours a month, provided the administrative layer — acknowledgements, training logs, reminders, headcount alerts — runs on autopilot.

That administrative layer is exactly what CozyHR handles well: policy e-sign during onboarding, training and acknowledgement tracking, location-wise headcount alerts, compliance calendars, and access-controlled records. If you're building your POSH compliance system this quarter, try CozyHR and keep the paperwork part effortless — so your attention goes to prevention, where it belongs.

This article is for general information only and is not legal advice. Verify current statutory requirements, formats, and district practices with official sources or a qualified professional.