POSH Act Compliance: Setting Up Your Internal Committee

POSH Act Compliance: Setting Up Your Internal Committee

Every organization employing more than a handful of people in India has heard of POSH Act compliance — the law requiring workplaces to prevent, prohibit, and redress sexual harassment. Far fewer have an Internal Committee (IC) that is actually constituted correctly, trained, documented, and ready to handle a complaint the moment one arrives. This gap between "we have a policy" and "we have a functioning committee" is where most employer risk quietly accumulates.

This guide is written for HR managers, founders, and compliance leads who need a practical, step-by-step approach to setting up — or auditing — an Internal Committee that meets statutory requirements and, more importantly, actually works when it's needed. As with any statutory guidance, treat the specifics of composition, timelines, and reporting formats as general direction and verify the current requirements with your legal counsel before finalizing your committee structure, since procedural rules and reporting formats are periodically updated.

Why POSH Compliance Is Not Optional — and Not Just a Document

The law requires every employer with a defined minimum number of employees at a workplace to constitute an Internal Committee, display the policy prominently, conduct awareness programs, and file an annual compliance report. Enforcement authorities and courts have, over time, made clear that a policy document sitting unused in an HR drive does not satisfy the intent of the law — the committee must be properly constituted, accessible, trained, and capable of running a fair, timely inquiry.

For HR and founders, three things typically drive urgency:

• Legal exposure. Non-compliance carries direct penalties, and beyond fines, a poorly handled complaint can expose the company to reputational damage and civil liability far larger than the statutory penalty itself.
• Investor and client due diligence. POSH compliance documentation (IC constitution, training records, annual reports) is now a standard checklist item in funding rounds, M&A due diligence, and increasingly in vendor/client onboarding questionnaires for larger enterprise clients.
• Employee trust. A workplace where employees genuinely believe a complaint will be handled fairly and confidentially is a workplace with lower attrition and higher psychological safety — this shows up in engagement survey data even among employees who never file a complaint themselves.

Who Needs an Internal Committee

The obligation to constitute an Internal Committee applies to every employer with a workplace employing at or above a statutorily defined minimum number of employees. Below that threshold, complaints are typically directed to a Local Committee constituted at the district level by the government — but even small companies below the threshold are well advised to have a documented process for how a complaint would be received and escalated, since employee expectations rarely track the letter of the threshold rule.

For organizations with multiple offices, a common question is whether one IC can cover all locations or whether each workplace needs its own. The safer, more defensible approach — and the one most large employers follow — is to constitute a separate IC for each administrative unit or office location, or at minimum ensure the composition and accessibility rules are satisfied at each location where employees are based, including for remote or field-based teams who need equally clear access to the complaint process.

Composition of the Internal Committee

A properly constituted IC generally requires:

• A Presiding Officer — a senior woman employee at the workplace. If no sufficiently senior woman employee is available at that location, the law allows nomination from another office of the same organization.
• At least two members from among employees who have a demonstrated commitment to the cause of women, or who have relevant legal or social work experience.
• One external member from an NGO or association committed to the cause of women, or a person familiar with sexual harassment issues — this external member is not optional and is one of the most commonly missed requirements in informally constituted committees.
• A composition where not less than half the total members are women.

Common mistakes in composition include: appointing an external member on paper without an actual working relationship or availability, allowing IC membership to lapse when a member resigns or is promoted without immediately backfilling, and failing to formally document the appointment letters and tenure for each member (typical tenure for IC members is a fixed term, after which reconstitution or renewal is required — track this like any other compliance renewal date).

The Committee Constitution Checklist

• [ ] Presiding Officer identified and formally appointed in writing (senior woman employee at that location)
• [ ] At least two internal members appointed with documented rationale for their suitability
• [ ] External member identified from a genuine NGO/association, with a signed engagement letter and agreed availability/compensation terms
• [ ] Composition confirmed to have at least half women members
• [ ] Appointment letters issued to all members with defined tenure
• [ ] IC members list, contact details, and photos displayed at the workplace (physical notice board and intranet/HRMS)
• [ ] IC members have received formal training on the law, inquiry procedure, and confidentiality obligations
• [ ] A documented complaint intake process exists (who can file, how, in what timeframe, and via which channels — email, HRMS ticket, physical drop box)
• [ ] Separate ICs (or clearly extended coverage) confirmed for every office location, including smaller satellite offices
• [ ] Annual report preparation and filing responsibility assigned to a named owner with a calendar reminder

Building the Complaint Process: What Must Be in Place Before You Ever Need It

The worst time to design your inquiry process is after a complaint has already landed. Build this in advance:

1. Multiple, Clearly Publicized Intake Channels Employees should be able to file a complaint via more than one channel — a dedicated email address monitored only by the Presiding Officer, a physical option for employees without regular email access (factory floor, field staff), and ideally a confidential HRMS ticketing option that routes directly to the IC rather than general HR.

2. A Documented Timeline Statutory timelines govern how quickly a complaint must be filed after the incident, how quickly the IC must complete its inquiry, and how quickly the employer must act on the IC's recommendations. Build a tracked, date-stamped workflow (ideally inside your HRMS or a dedicated, access-restricted case management tool) so no step silently lapses past its deadline.

3. Conciliation Option Before initiating a formal inquiry, the law allows (at the complainant's request, and never as a substitute forced on her) an attempt at conciliation. Document how this option is offered and recorded, and make clear that a monetary settlement cannot be the basis of such conciliation.

4. Interim Relief Provisions The IC can recommend interim measures during the pendency of an inquiry — such as transfer of either party, or granting leave to the complainant — to prevent retaliation or an unsafe working environment during the process. Have a pre-agreed process for how HR will action these recommendations quickly.

5. Confidentiality Protocol The identity of the parties, witnesses, and the content of the complaint and inquiry must be kept confidential by law. Define exactly who has access to case files (typically only IC members and, on a need-to-know basis, senior HR/legal), how physical and digital records are secured, and what disciplinary consequence applies internally for a confidentiality breach.

6. Non-Retaliation Commitment Explicitly document — and train managers on — the prohibition against retaliation toward a complainant, respondent, or witness during or after the process, distinct from and in addition to the outcome of the inquiry itself.

Running the Inquiry: A Practical Walkthrough

While every case differs, a well-run IC process generally follows this shape:

1. Complaint received and acknowledged in writing within a short, defined turnaround.
2. Preliminary assessment by the Presiding Officer to confirm the complaint falls within the IC's jurisdiction (workplace-related, timeframe, parties covered).
3. Notice to the respondent with a copy of the complaint, and a defined window to respond in writing.
4. Evidence and witness statements gathered by the IC, maintaining strict confidentiality and giving both parties a fair opportunity to be heard — this is not an adversarial courtroom process, but natural justice principles still apply throughout.
5. Interim relief considered, if requested or clearly warranted, at any point during the process.
6. Findings and recommendation documented in a written report, submitted to the employer within the statutory timeframe.
7. Employer action on the IC's recommendation (disciplinary action, or, where the complaint is not substantiated, closure — and separately, where a complaint is found to be false or malicious with clear evidence of malicious intent, the law allows for action against the complainant, though this provision should be applied with extreme caution and only on genuinely clear evidence, never as a deterrent against good-faith complaints).
8. Appeal window communicated to both parties per the applicable rules.

Training: The Part Everyone Skips

Constituting a committee on paper and never training it is one of the most common — and most dangerous — compliance gaps. Effective training covers two distinct audiences:

For all employees (mandatory, recurring): - What constitutes sexual harassment under the law, using concrete, relatable workplace scenarios rather than only legal definitions. - How and where to file a complaint, and what happens after. - The company's zero-tolerance stance and non-retaliation commitment. - Bystander guidance — what to do if you witness or hear about potential harassment.

For IC members specifically (deeper, less frequent but more rigorous): - Legal framework, statutory timelines, and documentation requirements. - Interviewing technique for a trauma-informed, fair process — treating both complainant and respondent with dignity. - How to write a legally sound inquiry report. - Handling ambiguous or borderline cases, and understanding what does and does not fall within IC jurisdiction (for example, incidents outside work-related contexts, or historical incidents predating current employment). - Confidentiality and record-security obligations.

Track training completion the same way you'd track any other mandatory compliance training — with a percentage-complete dashboard, not a one-time email blast assumed to have been read.

Annual Reporting and Recordkeeping

Employers are typically required to include the number of complaints received, disposed, and pending (with defined timelines) in an annual report, which in many cases also needs to be referenced in the company's broader annual filings. Maintain:

• A confidential, access-restricted case register (never in a shared drive accessible to general HR staff).
• Signed IC appointment letters and training records.
• The published policy document, along with proof of workplace display and periodic re-circulation (e.g., annual re-acknowledgment during onboarding refreshers).
• A log of awareness sessions conducted, with attendance records.

Common Mistakes That Undermine an Otherwise Compliant Setup

• The "committee in name only" problem — members appointed on paper but never trained, and unaware they are even on the committee when a complaint eventually arrives.
• No external member, or a token external member who was never actually consulted or made available for an inquiry.
• Complaint routed to general HR or the reporting manager first, delaying and potentially compromising the confidential IC process the law specifically requires.
• No process for remote, field, or gig workers to access the same complaint channel as office-based employees.
• Confusing POSH complaints with general employee grievances, handling them through the standard grievance redressal process instead of the legally mandated, procedurally distinct POSH inquiry.
• Failing to reconstitute the IC when a member leaves the company, leaving the committee under-strength or non-compliant on composition for months without anyone noticing.
• Treating the annual report as a formality rather than an accurate reflection of actual case activity — inaccurate reporting is itself a compliance risk, independent of how any individual case was handled.
• No vendor/contractor coverage. The law's definition of "aggrieved woman" and "workplace" is broad, covering visitors, clients, and contract staff in many circumstances. A policy silent on how a complaint from a vendor employee or client visitor would be handled leaves a real gap.

How Technology Supports (Without Replacing) Good Governance

An HRMS cannot make POSH inquiry decisions — that judgment sits entirely with a properly trained IC — but it can remove the administrative risk that causes good committees to miss deadlines or lose documentation:

• Confidential case intake routed directly and only to IC members, bypassing general HR ticketing queues.
• Automated timeline tracking for each stage of the statutory inquiry process, with escalation alerts if a deadline is approaching.
• Secure, access-restricted document storage for complaint files, statements, and the final inquiry report, separate from general employee records.
• Training completion tracking across the workforce, with automatic reminders for employees who haven't completed mandatory awareness sessions.
• Annual report generation that pulls case counts and status directly from the tracked workflow, reducing the risk of a manually compiled, inaccurate annual filing.
• IC roster and tenure tracking, flagging when a member's term is expiring or when a resignation has left the committee under-strength.

Internal Committee vs. Local Committee vs. General Grievance Redressal

HR teams new to POSH compliance often conflate three distinct mechanisms. Understanding the difference prevents complaints from being routed incorrectly:

A frequent and serious mistake is routing a sexual harassment complaint through the general grievance process because it "seemed easier" or because HR wasn't sure which mechanism applied. Any complaint that describes conduct falling within the statutory definition of sexual harassment must go to the IC (or LC, if no IC exists), regardless of how it was initially phrased or which channel it arrived through. Train your general HR helpdesk or ticketing team specifically on this triage distinction, since they are often the first point of contact.

Sample Policy Language You Can Adapt

Illustrative wording for the policy document (again, have counsel review the final version, and insert your organization's specific committee names, contact details, and timelines):

"The company is committed to providing a workplace free from sexual harassment in any form. Any employee, contractor, visitor, or client representative who experiences or witnesses conduct that may constitute sexual harassment as defined under applicable law is encouraged to report it to the Internal Committee constituted at their workplace. Complaints may be submitted in writing via [dedicated email/HRMS channel], and the identity of all parties, along with the details of the complaint, will be kept strictly confidential throughout the process. The company will not tolerate retaliation, in any form, against a person who in good faith reports a concern, participates in an inquiry as a witness, or supports a colleague in doing so. Interim measures may be recommended by the Internal Committee at any stage of the process to ensure a safe working environment for all parties involved."

A Practical Case Walkthrough (Illustrative, Not a Real Case)

To make the process concrete, consider how a well-prepared IC handles a typical scenario: an employee reports that a colleague from another team made repeated inappropriate comments during a project, continuing after she asked him to stop.

1. Intake: She emails the dedicated IC address. The Presiding Officer acknowledges receipt within the committed turnaround time and explains the process in plain language, including her right to request conciliation instead of a formal inquiry if she prefers.
2. Jurisdiction check: The IC confirms the conduct occurred in a work context (project calls, office premises) and both parties are covered under the policy.
3. Notice to respondent: The respondent receives a copy of the complaint and a defined window to submit his written response.
4. Interim measure: Because the two continue to work on adjacent teams, the IC recommends a temporary change in project assignment for the duration of the inquiry — not as a punishment, but as a safeguard, applied evenly regardless of eventual outcome.
5. Evidence gathering: The IC interviews both parties separately and any relevant witnesses (for example, colleagues copied on messages referenced in the complaint), maintaining written records throughout.
6. Findings: The IC documents its findings against the evidence gathered and prepares a written report with a clear recommendation.
7. Employer action: HR and leadership act on the recommendation within the required timeframe, and both parties are informed of the outcome and their right of appeal.
8. Closure and monitoring: HR conducts a discreet follow-up with the complainant after a defined period to confirm there has been no retaliation and that the working environment has genuinely improved.

Every real case will differ, but the discipline of a documented, timeline-driven, confidentially-run process is what distinguishes a defensible inquiry from one that unravels under later scrutiny.

The Real Cost of Getting This Wrong

Beyond direct statutory penalties, the costs of a poorly handled POSH case compound quickly:

• Litigation exposure if the inquiry process itself is later found procedurally deficient (wrong composition, missed timelines, inadequate opportunity to be heard for either party) — courts have shown willingness to set aside findings on procedural grounds alone.
• Employer branding damage that spreads fast on employee review platforms and social media, often disproportionate to the size of the original incident if the handling itself is seen as dismissive or opaque.
• Loss of enterprise clients and investors, for whom POSH compliance documentation is now a standard due-diligence checklist item — a missing or clearly inactive IC can stall a funding round or a large vendor contract at the final stage.
• Erosion of psychological safety across the workforce, which shows up in engagement scores and attrition well beyond the individuals directly involved in any one case.

Framing POSH compliance investment in these business terms — not only as a legal obligation — is often what secures budget and leadership attention for proper training, an engaged external member, and a system to track it all.

Beyond Compliance: Building a Culture Where People Actually Speak Up

A technically compliant IC that no one trusts is still a failure in practical terms. Signals that a POSH program is working beyond the paperwork:

• Employees can name at least one IC member without looking it up, because the roster is genuinely visible (physical notice boards, intranet, HRMS) rather than buried in a policy PDF.
• Leadership visibly and repeatedly reinforces the zero-tolerance message in town halls and onboarding — not only in a once-a-year mandatory training video.
• Managers are held accountable, through their own performance reviews, for fostering a respectful team environment — not treated as bystanders to the process.
• The company tracks (confidentially, in aggregate) whether complaint volume and resolution time trend in a healthy direction year over year, using this as a genuine culture metric rather than something to be minimized.

FAQs

1. Do we need a separate Internal Committee for every branch office, or is one committee enough for the whole company? The generally recommended and safer approach is to constitute a committee for each administrative unit or workplace location, ensuring accessibility and appropriate local composition at every site. A single, centralized committee for a geographically spread organization creates practical access and confidentiality challenges — confirm the specific requirement with counsel based on your organizational structure.

2. What is the role of the external member, and can we appoint any outside consultant? The external member must come from an NGO or association committed to the cause of women, or be a person otherwise familiar with issues relating to sexual harassment — not simply any external professional. Many organizations engage a specialized POSH compliance or legal firm that provides trained external members as part of a retained service, which also helps ensure genuine availability when an inquiry is actually convened.

3. Can a complaint be filed anonymously? Formal inquiries generally require a named complainant so the respondent has a fair opportunity to respond, consistent with principles of natural justice. However, employers should still provide a confidential channel for employees to raise concerns or seek guidance before deciding whether to file a formal complaint, and should never dismiss an anonymous tip outright — at minimum, it can trigger a broader awareness or environment review.

4. How long does the IC have to complete an inquiry? Statutory timelines apply at each stage — from acknowledgment of the complaint through completion of the inquiry and submission of the report. Because these timelines are defined in the applicable rules and can be revised, confirm the current figures with legal counsel and build them directly into your case-tracking workflow so no stage silently lapses.

5. What happens if the complaint is found to be false? The law provides for action against a complainant only where there is clear evidence the complaint was made with malicious intent or knowingly false — this is a narrow, high-bar provision, not a default consequence of an unsubstantiated complaint. The mere fact that an inquiry does not find sufficient evidence to substantiate a complaint should never, by itself, be treated as proof of malicious intent.

6. Does POSH compliance apply to contract workers, interns, and vendor staff on our premises? Generally yes — the law's definitions of "aggrieved woman" and "workplace" are intentionally broad and are designed to cover a wide range of working relationships and visitors to the workplace, not only permanent, direct employees. Your policy and complaint channels should explicitly state this coverage rather than leaving it to be assumed.

7. What should happen to the respondent's employment status during the inquiry? The respondent should not be presumed guilty during the process. The IC can, where warranted, recommend interim measures (such as separating the parties through a temporary transfer or seating change) to protect the complainant without pre-judging the outcome. Final disciplinary action follows only after the inquiry concludes and the employer accepts the IC's recommendation.

8. Is a POSH policy required even if our company has fewer than the threshold number of employees? Even where the mandatory-IC threshold isn't met, having a clear, documented complaint process — routed to the district-level Local Committee where applicable — is strongly advisable. Employees increasingly expect a workplace of any size to have a clear answer to "what happens if I need to raise this," and the absence of any process is itself a reputational and retention risk.

9. How do we handle a complaint involving a client, vendor, or visitor rather than a fellow employee? The IC process still applies where the incident occurred in a work context, even if the respondent is not a direct employee of your organization. The practical remedy may differ — you generally can't discipline someone else's employee directly — but the IC should still complete its inquiry, document findings, and the employer should take appropriate action within its control, such as restricting the individual's access to the workplace, raising the matter formally with the vendor or client organization, and supporting the complainant throughout. Silence or "that's not our jurisdiction" is not a defensible position.

10. Should remote and work-from-home employees be covered by the same POSH policy? Yes. Harassment occurring during work-related video calls, messaging platforms, or work-related travel and offsites falls within most modern interpretations of "workplace" under the law and your own policy should say so explicitly. Make sure your intake channels (email, HRMS ticketing) are equally accessible to fully remote employees who may never see a physical notice board.

Building POSH Compliance Into Your Vendor and Staffing Contracts

If your organization relies on staffing agencies, gig platforms, or long-term contractors, extend your due diligence beyond your own IC:

• Require staffing vendors to confirm, in writing, that their own Internal Committee (or equivalent process) is properly constituted and trained, since their deployed staff working on your premises are still entitled to a functioning complaint mechanism.
• Clarify in the vendor contract how a complaint involving a vendor's employee working at your site will be handled jointly — who leads the inquiry, how findings are shared, and what access restrictions your company can independently impose regardless of the vendor's own process timeline.
• Include POSH compliance confirmation as a standard item in your annual vendor compliance review, alongside PF/ESI and labour law confirmations you likely already collect.

This is increasingly expected by enterprise clients conducting their own due diligence on your supply chain, and it closes a gap that's easy to overlook when attention is focused only on direct employees.

Conclusion

POSH compliance is one of the clearest examples in Indian HR of a law where the paperwork is necessary but nowhere near sufficient. A properly constituted, trained, and genuinely accessible Internal Committee protects your employees, your leadership team, and your company's reputation in equal measure — but only if it's built before it's needed, not assembled in a hurry after the first complaint arrives.

Start with the constitution checklist in this guide, run a training session this quarter if you haven't in the last year, and audit your documentation as if an inspector or a due-diligence team were reviewing it tomorrow. If you're looking to bring POSH case tracking, training records, and annual reporting into the same system you already use for payroll and leave, CozyHR's compliance workflows are designed to keep exactly this kind of sensitive, deadline-driven process organized and audit-ready.