POSH Act Compliance: Building an Effective Internal Committee

POSH Act Compliance: Building an Effective Internal Committee

Sexual harassment complaints are among the most sensitive matters an HR team will ever handle, and they are also among the most heavily regulated. The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — universally known as the POSH Act — places a clear, non-negotiable set of obligations on every employer in India, regardless of size or sector. Yet a surprising number of small and mid-sized businesses still treat POSH compliance as a box-ticking exercise: a policy buried in an onboarding folder and a committee that exists only on paper.

That approach is risky. POSH non-compliance carries financial penalties, reputational damage, and in repeat cases, cancellation of business licenses. More importantly, a poorly implemented POSH framework fails the people it exists to protect. This guide walks HR managers, founders, and compliance teams through what the law actually requires, how to build an Internal Committee (IC) that works in practice and not just on paper, and how to run the complaint process fairly and confidentially from the first report to the final action.

This is a general guide for awareness and planning purposes. POSH matters involve legal rights and obligations, so always consult a labour law professional for case-specific advice and verify current requirements with the Ministry of Women and Child Development and your state's rules before finalizing your policy.

Why POSH Compliance Deserves Real Attention in 2026

A few forces are pushing POSH compliance higher up the HR agenda this year.

First, workforce composition keeps shifting. As more women join the formal workforce — including in traditionally male-dominated sectors like manufacturing, logistics, and field sales — the base of employees the Act protects grows every year. The Act itself is not limited to female employees only in terms of coverage of complainants (it protects women specifically, but organizations increasingly extend equivalent grievance mechanisms to all employees as good practice).

Second, hybrid and remote work has blurred the definition of "workplace." The Act's definition already extends beyond the office to any place visited during employment, including client sites and off-site events, and increasingly this is interpreted to include the digital workplace — video calls, chat platforms, and virtual events, where harassment can and does occur.

Third, funding due diligence and vendor onboarding increasingly ask for POSH compliance evidence upfront. Investors, larger clients, and government tenders often require proof of an active Internal Committee, annual filings, and training records before a deal proceeds. Startups that treat this as an afterthought find it slows down fundraising and enterprise sales cycles.

Fourth, courts and appellate authorities have shown limited patience for organizations that maintain a POSH policy in name only. An Internal Committee that has never met, was never trained, or lacks a valid external member does not satisfy the law even if a policy document exists.

Who the POSH Act Applies To

The Act applies to virtually every workplace in India:

• Private companies, LLPs, and partnerships of any size — there is no employee-count threshold for the obligation to have a policy and a redressal mechanism.
• Government bodies, PSUs, and statutory organizations.
• NGOs and societies.
• Hospitals, nursing homes, and educational institutions.
• Sports institutes, stadiums, and any place used for training, sports, or competitions.
• The unorganized sector, through Local Committees constituted at the district level (relevant for very small establishments with fewer than 10 employees).

A common misconception is that only companies above a certain headcount need to comply. That threshold — 10 or more employees — determines whether an organization must constitute its own Internal Committee, not whether the Act applies at all. Establishments with fewer than 10 employees are still covered by the Act, but complaints there are handled by the district-level Local Committee (LC) instead of an internal one. Every employer, regardless of size, must display the POSH policy, ensure a safe workplace, and cooperate with inquiries.

The Three Pillars of POSH Compliance

Employers are legally required to deliver on three fronts.

1. A Written POSH Policy

The policy should define what constitutes sexual harassment under the Act (verbal, physical, and visual conduct; quid pro quo; and hostile work environment), state the organization's zero-tolerance stance, describe the complaint and inquiry process end-to-end, list Internal Committee members and how to reach them, specify timelines for each stage of the process, and detail interim relief measures, confidentiality obligations, and consequences of false or malicious complaints.

2. An Internal Committee (IC)

Every office or branch with 10 or more employees must constitute an IC. If an organization has multiple locations, each location that meets the threshold needs its own IC, or the organization can designate a Regional Officer coordination model where permitted, though in practice most Indian companies constitute a separate IC per office and issue a consistent policy centrally.

3. Awareness, Training, and Annual Reporting

Employers must conduct regular workshops and awareness programs for employees and IC members, and must file an Annual Report with the District Officer summarizing the number of complaints received, resolved, and pending, by 31 January or as per your state's specified deadline. This report is also generally expected to be referenced in the company's Board report or annual filings, depending on applicable corporate law thresholds.

Building an Internal Committee That Actually Works

The composition of the IC is the most legally scrutinized part of the entire compliance framework, because a defect here can invalidate an inquiry outcome even if everything else was handled correctly.

Mandatory Composition

The IC must have a minimum of four members:

The external member requirement is frequently overlooked or filled incorrectly. The external member cannot be a consultant retained for unrelated work, a board advisor, or a friend of the founder appointed informally. They should have genuine, demonstrable experience in gender issues, women's rights, or related legal matters, and the appointment should be documented with a formal letter and, ideally, a small honorarium or engagement agreement.

At least half of the IC's members should be women. In practice, most compliant ICs aim for a majority-women composition given the Presiding Officer and at least one internal member requirement already skew that way.

Selecting the Presiding Officer

This person carries significant responsibility, so choose someone who is senior enough to be taken seriously by employees at every level, has demonstrated discretion and sound judgment in sensitive situations, is not so senior that employees feel intimidated raising a complaint against a peer of theirs, and has the time and organizational support to actually run inquiries, which can take weeks.

Term and Rotation

IC members typically serve a term of up to three years. Building in staggered terms — so the entire committee doesn't turn over at once — preserves institutional knowledge and consistency in how cases are handled.

Documentation to Prepare When Constituting an IC

• Formal appointment letters for each member, referencing the specific section of the Act.
• The external member's engagement letter and a short bio confirming relevant experience.
• A committee charter outlining meeting cadence, quorum requirements, and record-keeping practices.
• A designated, confidential channel for complaints (a dedicated email address, a locked physical drop box, or a case management tool).

The Complaint and Inquiry Process, Step by Step

A defensible POSH process follows a structured timeline. Deviating from these timelines — even with good intentions — can expose the organization to challenge later.

Step 1: Receiving the Complaint

A complainant can file a written complaint within three months of the incident (extendable by another three months at the IC's discretion for sufficient reason). If the complainant is unable to file in writing due to disability or other reasons, any IC member should assist in writing the complaint on her behalf.

Step 2: Conciliation (Optional, at the Complainant's Request)

Before an inquiry begins, the complainant may request conciliation to settle the matter without a full inquiry — but this cannot involve any monetary settlement, and if conciliation is chosen, the IC records the terms and forwards them to the employer for action. Conciliation is never mandatory, and no employee can be pressured toward it.

Step 3: Interim Relief

While the inquiry is pending, the complainant can request interim measures: transfer of either party, granting leave up to three months to the complainant (in addition to her regular leave entitlement), or restricting interaction between the parties. These measures are protective, not punitive, and should be granted without prejudging the outcome.

Step 4: The Inquiry

The IC has the powers of a civil court for the purposes of the inquiry — it can summon and examine witnesses, and require the production of documents. The inquiry must be completed within 90 days of the complaint being filed. Both parties must be given a reasonable opportunity to be heard, and both are entitled to bring a support person (not necessarily a lawyer) to assist them, though legal representation in the formal sense is generally not permitted for either party during IC proceedings.

Step 5: The Report and Recommendations

Within 10 days of completing the inquiry, the IC submits its findings and recommendations to the employer. If the complaint is substantiated, the IC can recommend actions ranging from a written warning to termination, and may also recommend deduction from the respondent's salary as compensation to the complainant, calculated based on factors like the mental trauma caused, the respondent's income, and medical expenses incurred.

Step 6: Employer Action

The employer must act on the IC's recommendations within 60 days of receiving the report. This is a common point of failure — organizations sometimes receive a report and then stall on implementation because the recommended action (often termination of a senior employee) is organizationally inconvenient. That delay itself is a compliance failure.

Step 7: Appeal

Either party can appeal the IC's decision to the appropriate court or tribunal within 90 days of the recommendations being issued.

Confidentiality: The Rule That Trips Up Most Organizations

Section 16 of the Act explicitly prohibits the publication or disclosure of the identity of the complainant, respondent, witnesses, and details of the inquiry to the media or public — the only exception is dissemination of information about the outcome, without disclosing names, and even that is limited.

This means:

• No mentioning the case in an all-hands meeting, even in general terms.
• No naming either party in Slack, email chains, or team updates.
• No informal "the investigation found nothing so it's fine now" broadcasts.
• IC members and anyone involved in the process must sign confidentiality undertakings.
• Even HR business partners not directly involved should not have access to case files unless there's a specific need.

Violating confidentiality is itself punishable under the Act with a fine, so this is not a soft guideline — build it into your case management workflow from day one.

Common Implementation Mistakes

Treating the IC as a formality. An IC that has never conducted a mock inquiry, never met outside of actual complaints, and whose members don't know the 90-day timeline by heart is not ready to handle a real case under pressure.

Skipping the external member or filling the role superficially. Courts have specifically flagged inquiries as defective where the external member's independence or expertise was questionable.

No process for anonymous or informal complaints. Not every employee is ready to file a formal written complaint immediately. Having an informal, confidential first point of contact — sometimes called an Anti-Sexual Harassment (ASH) point of contact — who can explain the process and options without triggering a formal inquiry increases the likelihood that issues surface early.

Weak training. A single slide in the onboarding deck does not meet the "regular workshops and awareness programs" requirement. Effective programs run annually at minimum, include scenario-based discussions (not just legal definitions), and are refreshed when the IC composition changes.

No coverage for contractors, vendors, and gig workers. The Act's definition of "workplace" and "aggrieved woman" is broad enough to cover interactions with third parties working at your premises. Your policy and IC should explicitly address complaints involving contractors, delivery partners, clients, and visitors.

Failing to file the Annual Report. This is a simple compliance step that gets missed when HR ownership of POSH is unclear. Assign a named owner and calendar the deadline well in advance.

A Practical 90-Day Readiness Plan

Days 1–15: Assess. Review whether an IC currently exists at each location with 10+ employees, verify the external member's credentials and documentation, and audit the last three years of Annual Reports for gaps.

Days 16–30: Reconstitute or Formalize. Issue fresh appointment letters if terms have lapsed, formally engage a qualified external member with a written agreement, and publish the IC composition and contact details on the intranet and physical noticeboards.

Days 31–50: Build the Process Infrastructure. Set up a confidential complaint channel, draft or refresh the POSH policy with current timelines and contacts, and create a standard case-tracking template that logs dates for each stage (filing, conciliation offer, inquiry start, 90-day inquiry deadline, report submission, 60-day action deadline).

Days 51–70: Train. Run a mandatory session for all employees covering what constitutes harassment, how to file a complaint, and what protections exist against retaliation. Run a separate, deeper session for IC members covering inquiry procedure, evidence handling, and confidentiality obligations, ideally facilitated by an external POSH trainer or lawyer.

Days 71–90: Test and Institutionalize. Run a mock inquiry scenario with the IC to surface process gaps, confirm the Annual Report deadline is calendared with an owner, and integrate POSH policy acknowledgment into your onboarding checklist so every new hire signs off within their first week.

How HR Technology Supports POSH Compliance

Manually tracking IC terms, training completion, and inquiry deadlines across multiple locations is error-prone once an organization grows past a handful of offices. A modern HRMS can help by storing IC composition, appointment letters, and external member documentation centrally per location, sending automated reminders ahead of IC term expiry and the Annual Report deadline, tracking POSH training completion as part of the broader compliance training module, and maintaining an access-controlled repository for policy documents that's separate from general HR records, respecting the confidentiality requirements of actual case files (which should generally stay outside of a general-purpose HRMS and be held by the IC directly, given confidentiality obligations).

The goal isn't to run the sensitive parts of an inquiry through a software tool — that should remain a carefully controlled, need-to-know process — but to make sure the administrative backbone (deadlines, documentation, training records) never silently lapses.

Sector-Specific POSH Considerations

POSH implementation looks different depending on how and where your workforce actually operates. A one-size-fits-all policy copied from a template rarely accounts for these realities.

IT, ITES, and remote-first companies. Most interactions happen over video calls, chat, and collaboration tools, and harassment can take the form of inappropriate messages, unwanted video call behavior, or exclusionary conduct in digital spaces. Policies should explicitly name these channels as covered "workplace" contexts, and IC training should include how to preserve and review digital evidence like chat logs and call recordings without violating other employees' privacy rights in the process.

Manufacturing and field operations. Here the workforce is often more male-dominated, shift-based, and geographically spread across plants or field sites. It's common for a single IC to be shared across a cluster of nearby small units, provided the composition and process still meet the Act's requirements. Field employees and site supervisors need the same access to the complaint channel as office staff — a policy poster in the HR office does nothing for someone who works at a client site three states away, so make sure contact details travel with the employee (in the employee handbook, on the payslip, or via SMS/WhatsApp broadcast).

Hospitality, retail, and customer-facing roles. Complaints here often involve third parties — customers, vendors, or delivery partners — rather than colleagues. Your policy should state clearly that the organization will support employees facing harassment from a client or customer, including options like reassignment or involving the client's own management, even though the offending party isn't an employee you can discipline directly.

Startups and small teams. Founders sometimes assume informal culture substitutes for process, or worry that a formal IC feels bureaucratic for a 20-person team. Neither is true, and neither is optional once headcount crosses 10. The good news is that a lean startup can build a fully compliant, lightweight IC quickly — the effort is in getting the composition and documentation right once, not in ongoing overhead.

Building a POSH Culture, Not Just a POSH File

Compliance sets the floor; culture determines whether people actually feel safe using the process. A few practices separate organizations where POSH works from those where it exists only on paper.

Make the IC visible and human. Employees are far more likely to come forward if they know who the IC members are, have seen them introduced (not just listed in a PDF), and understand that reaching out doesn't automatically mean a formal, public process starts. Consider an annual "meet the IC" session as part of your broader compliance calendar.

Protect against retaliation explicitly. Fear of retaliation — being sidelined, denied a promotion, or subtly pushed out — is one of the biggest reasons complaints go unreported. Your policy should state in plain language that retaliation against a complainant or witness is itself a disciplinary offense, and managers should be trained to recognize what retaliation can look like beyond obvious cases (exclusion from meetings, sudden negative feedback, project reassignment).

Track leading indicators, not just complaint counts. A year with zero complaints isn't automatically a good sign — it can also mean employees don't trust the process. Track training completion rates, employee awareness survey results (do people know how to file a complaint?), and time-to-resolution for any cases that do arise, and review these with leadership annually alongside the Annual Report filing.

Debrief after every case, without breaching confidentiality. After a case concludes, the IC should hold a process debrief — what worked, what took longer than expected, where documentation was thin — without discussing case specifics outside the committee. These lessons should feed back into policy and training updates.

A Simple Case Tracking Template

Whether you manage this in a spreadsheet, a document management tool, or an HRMS module, every case file should capture the same core fields so nothing falls through the cracks:

Keeping this tracker current is what turns "we have a POSH policy" into "we can demonstrate, on any given day, exactly where every case stands relative to its statutory deadline."

Budgeting for POSH Compliance

Founders often ask what this actually costs to run properly. Budget for an annual honorarium for the external IC member (rates vary widely by city and the member's experience, so get a written quote rather than assuming a token amount will suffice), an annual training program, ideally facilitated externally at least once a year even if internal refreshers happen more often, and either a lightweight case management tool or a securely access-controlled shared drive with strict permissions for documentation. None of this is expensive relative to the legal and reputational exposure of getting it wrong, but it does need a named line item and a named owner rather than being absorbed informally into general HR admin time.

Frequently Asked Questions

Does the POSH Act apply to organizations with fewer than 10 employees? Yes, the Act itself applies to every employer regardless of size. What changes below 10 employees is that the organization is not required to constitute its own Internal Committee — instead, complaints from that workplace go to the district-level Local Committee. Even small organizations should have a written policy and should point employees to the applicable Local Committee.

Can a male employee file a complaint under the POSH Act? The POSH Act specifically protects "aggrieved women" and does not cover complaints by men as complainants under this particular law. Many organizations choose to extend a parallel, equally rigorous grievance mechanism through their general Code of Conduct or an Ethics Committee to handle harassment complaints from any employee, which is considered good practice even though it isn't mandated by the POSH Act itself.

What happens if a company doesn't constitute an Internal Committee? Non-compliance can result in a monetary penalty, and repeated non-compliance can lead to a higher penalty and even cancellation or non-renewal of business licenses or registrations required to operate. Beyond the legal exposure, it also leaves the organization without a lawful mechanism to handle a complaint if one arises, which compounds the risk.

How long should IC members serve, and can they be removed? The typical term is up to three years from the date of nomination. Members can be removed for reasons specified under the Act, such as being convicted of an offense, being found guilty of misconduct in an inquiry, or misusing their position — removal should always be documented with clear reasoning.

Is the identity of the complainant ever revealed? No, the Act specifically protects the identity of the complainant, respondent, and witnesses throughout the process, with disclosure restricted even after the inquiry concludes. Only the broad outcome, without names, can be shared internally where appropriate.

Do remote employees and virtual interactions fall under POSH? Increasingly, yes. Harassment occurring over video calls, chat platforms, or during remote work-related interactions is generally treated as falling within the scope of the Act, since the definition of workplace has been interpreted broadly to include any place or medium connected to employment. Update your policy language to explicitly address digital and remote workplace conduct.

What is the difference between conciliation and an inquiry? Conciliation is an optional, complainant-initiated route to settle the matter informally without a monetary payment, used only when the complainant requests it. An inquiry is the formal fact-finding process the IC conducts when conciliation isn't chosen or doesn't resolve the matter, culminating in a report and recommendations to the employer.

Can the IC's inquiry findings be challenged? Yes. Either the complainant or the respondent can appeal the IC's recommendations to the relevant court or tribunal within 90 days of the recommendations being communicated.

Getting POSH Compliance Right, Consistently

POSH compliance is not a one-time project — it's an ongoing operational responsibility that touches policy, people, training, and record-keeping every single year. The organizations that handle it well share a common trait: they treat the Internal Committee as a functioning body with real authority and support, not a name on a policy PDF, and they build enough process discipline that deadlines, documentation, and confidentiality never depend on any one person remembering to follow through.

If your team is still tracking IC terms, training completion, and compliance deadlines in scattered spreadsheets, it's worth centralizing that administrative layer so nothing slips silently. CozyHR helps growing Indian companies keep compliance documentation, training records, and policy acknowledgments organized in one place, so your HR team can focus on getting the sensitive parts of this process right rather than chasing paperwork. Explore how CozyHR supports HR compliance workflows to see if it fits your team's needs.

This article is intended as general guidance and does not constitute legal advice. POSH Act requirements and interpretations can vary and evolve; consult a qualified labour law professional and refer to official government sources before finalizing your organization's policy and procedures.