Sexual harassment prevention: policies, reporting pathways and manager training

Most Australian employers have a sexual harassment policy and some form of training. An employer should also be able to show where harassment risk sits in its operation, what it changed as a result, and how it knows the change worked, because the legal framework asks what the employer did to prevent the conduct, not only whether it responded well to a complaint.

A document and a completion rate are inputs. Prevention is a system: risk identification, control design, leadership behaviour, accessible reporting, capable managers, support that does not depend on a formal complaint, and monitoring that shows whether it works. Handling a matter once it is raised is covered in our guides to managing discrimination and harassment complaints and early triage.

Section 47C of the Sex Discrimination Act 1984 (Cth) requires duty holders to take reasonable and proportionate measures to eliminate, as far as possible, specified unlawful conduct connected with work. The duty is not confined to sexual harassment: it also covers sex discrimination in a work context, harassment on the ground of sex, conduct resulting in a workplace environment hostile on the ground of sex, and related victimisation. It attaches to employers and persons conducting a business or undertaking, and reaches conduct by and towards workers and, in defined circumstances, agents, contractors and others connected with the work.

Two features are commonly misread. First, the duty is preventative and systemic: handling a complaint competently is a response, not the discharge of a duty framed around elimination as far as possible. Second, reasonable and proportionate is context-specific, turning on the size, nature and circumstances of the business, its resources, and the practicability and cost of measures. No policy, training cadence or audit report proves compliance on its own.

The Australian Human Rights Commission's Guidelines for Complying with the Positive Duty set out four guiding principles (consultation, gender equality, intersectionality, and a person-centred and trauma-informed approach) and seven standards: leadership; culture; knowledge; risk management; support; reporting and response; and monitoring, evaluation and transparency. These are authoritative guidance, not separate statutory elements, and adopting them is not a safe harbour. Use them as a design and assurance structure, with the statutory test applied on top. The Commission's compliance and enforcement functions include inquiry and, in defined circumstances, enforceable undertakings and compliance notices.

An identified gap may be relevant to the Commission's assessment of compliance, but inquiry, recommendations, an enforceable undertaking, a compliance notice and court enforcement are distinct steps, and a control gap does not of itself result in a penalty. Work health and safety duties apply at the same time and independently: harassment is treated as a work health and safety hazard, and the risks associated with it and with other psychosocial hazards must be managed under the applicable WHS or OHS law. Model WHS material frames that as elimination so far as is reasonably practicable and, if elimination is not reasonably practicable, minimisation so far as is reasonably practicable; the statutory formulation, regulations, codes and hierarchy or control requirements differ across jurisdictions, including Victoria's OHS framework. Safe Work Australia publishes guidance on sexual and gender-based harassment, psychosocial hazards and a model Code of Practice. Model material has no legal effect until adopted, so check what applies through your WHS regulator. The Fair Work Ombudsman's prevention guidance and the Fair Work Commission's sexual harassment jurisdiction complete the picture.

The matrix below is a design aid, not a compliance test. Use it to check that each standard has controls that operate in practice and evidence someone could examine.

Risk assessment is often underdeveloped, yet it is the step that makes the rest defensible, asking where the conditions associated with harassment are strongest in this operation. Recognised contextual risk factors include power imbalance and gendered work structures; gender inequality in composition and progression; isolated, remote or lone work; client, patient, customer or public contact; work travel, shared accommodation and work-related social functions; alcohol; digital channels; insecure work; young or inexperienced workers; and intersecting factors such as disability, cultural background or migration status. These are indicators about conditions, not conclusions about individuals.

Document the assessment usefully: setting, factors present, who is exposed, existing controls, gaps, agreed actions, owners and review dates. Weight controls towards work design: rostering and supervision so people are not routinely isolated with clients or senior staff, alcohol settings at work functions, physical and digital design, and clear authority to withdraw from unsafe client interactions.

Consulting workers and their representatives on health and safety matters is required where the applicable WHS or OHS law requires it, and it is an essential source of operational evidence about where risk sits, alongside incident and escalation data, survey and exit information and control reviews. Use health and safety representatives and committees, targeted focus groups, de-identified surveys, and the most exposed cohorts rather than only head-office populations. Record what was raised and what was done with it; consultation that produces no visible change reduces confidence.

Leadership is a control, not a sentiment: a named executive accountable for prevention, a reporting line to the board or an appropriate committee, prevention objectives in senior performance expectations, and a demonstrated willingness to apply the same standards to high performers and senior people. Workers often judge what is tolerated by what happens to the most senior person who breaches the standard, rather than by the policy.

Governance should make prevention visible in the organisation's ordinary rhythm: periodic reporting of de-identified trends and control status, decisions recorded with reasons, and actions tracked to completion. Culture work such as bystander capability, expectations at client events and review of drinking practices belongs here rather than in a training module.

A workable policy is short, specific and plain. It should describe the behavioural standard concretely with examples from the organisation's real settings; state its scope, including conduct at work-related events, on work travel and through digital channels connected with work; and identify who it covers, including workers, managers, contractors and, so far as the organisation can control the interaction, clients and visitors. An employer can set expectations, condition access and withdraw service, but it does not control every third party and statutory coverage is not unlimited.

The policy should also set out roles; reporting and support routes; response options from supported conversation through to formal investigation; the limits on confidentiality; an express non-retaliation commitment; consequences for breach; and a review cycle. Employers can generally update conduct policies as part of managing the workplace without employee consent, though consultation obligations, enterprise agreement or contractual terms and reasonable notice may apply. Person-centred and trauma-informed practice shapes how the policy is applied, but does not displace procedural fairness, safety obligations or legal requirements.

People do not report into channels they distrust or cannot reach. Offer more than one route, including at least one outside the person's line hierarchy: an alternative manager, an HR contact, a contact officer or an external service. Match the channels to the workforce: shift workers, field-based staff, labour-hire workers and people with limited English or digital access each need a usable route.

Three terms are frequently conflated. A confidential report is one where information is shared only with those who need it; it is not secrecy, and follow-up, safety obligations, fairness to a respondent and legal requirements can require wider sharing. An anonymous report is one where the reporter's identity is not provided or is withheld, although surrounding facts can sometimes permit identification; it can still prompt inquiry and control changes, though it may limit what can fairly be tested. De-identified information has identifying details stripped for trend analysis. Never promise absolute confidentiality or anonymity: say plainly, before a report is made, what will and will not be shared.

Contact officers are a useful control when the role is defined narrowly: trained points of information, initial support and referral who explain the options and connect the person to support. They are not investigators, decision-makers, counsellors or advocates unless separately appointed and competent for that role. Select them across sites, shifts and demographics, train and supervise them, give them a safety escalation path, and manage conflicts of interest.

Support should be available without requiring a formal complaint. Interim workplace adjustments must be lawful, proportionate, precautionary rather than punitive, no more disruptive than reasonably necessary, and reviewed at set intervals. Do not default to moving or disadvantaging the person who raised the concern.

Managers are a critical operating point in the system. The capability required is narrow but demanding: recognise conduct and the conditions that produce it; respond calmly to a disclosure; preserve the person's choice about next steps where it is safe and lawful; explain the options accurately; avoid expressing a view on the merits; prevent retaliation; escalate promptly; and record what was said and done. Where the conduct is serious, others are at risk, or a legal obligation is engaged, the employer may need to act even if the person would prefer otherwise, and managers should say so rather than give assurances they cannot keep.

Training design follows the same logic. Tailor content to role and setting rather than issuing one module to everyone, and make it accessible in language, format, timing and delivery mode, including for shift and field-based workers. Deliver at induction, refresh on a planned cycle, and add event-triggered uplift on promotion into leadership, restructure, a serious incident or a change in law. Use scenario-based manager practice covering ambiguous conduct and matters involving a senior respondent.

Evaluate more than attendance, which shows delivery rather than effectiveness. Test comprehension, ask managers to demonstrate the response in a scenario, sample the quality of later escalations, and use de-identified survey data on whether workers believe a report would be handled well. Annual training is common and often sensible, but it is not a universal legal requirement; what matters is that the measures adopted are reasonable and proportionate.

Report volume alone is a weak indicator, and the most frequently quoted. Few or no reports can reflect under-reporting, fear of retaliation or inaccessible channels rather than low risk, and a rise can indicate growing confidence rather than deteriorating conduct.

Use a balanced set. Leading indicators include risk assessments completed and reviewed, consultation activity, control implementation, training comprehension, manager confidence, awareness of reporting routes, and time from report to first contact. Lagging indicators include substantiated matters by category and setting, time to resolution, retaliation allegations, related workers' compensation claims, turnover in exposed cohorts and exit-interview themes. Analyse trends in de-identified form so patterns can be discussed without exposing individuals.

Assurance closes the loop. Periodically test whether controls operate as designed rather than whether documents exist: sample records, walk the reporting pathway end to end, and interview managers and contact officers. Report findings to the accountable executive and governing body with owners and dates. An internal prevention review assesses workplace controls; it does not determine statutory liability.

Risk signals. Twelve venues; a large casual and young workforce; late-night trade with alcohol service; contractor security and cleaning staff; lone opening and closing shifts; customer-to-worker conduct as the dominant issue; supervisors promoted from the floor without leadership training; almost no reports through the central HR inbox despite consistent anecdotal accounts.

Proportionate controls. Rostering changed so no worker opens or closes alone; a documented refusal-of-service and escalation protocol covering customer conduct towards staff, with express authority to withdraw from an interaction; venue-level contact officers on rotating shifts; reporting by phone and mobile message, since floor staff do not use email; standards extended into contractor terms; scenario-based supervisor training on customer-perpetrated harassment; and prevention responsibilities in venue-manager expectations.

Evidence and review. Risk assessments per venue with shift-level detail; consultation records from crew meetings; escalation logs distinguishing customer, contractor and worker conduct; training completion with a comprehension check; quarterly de-identified trend reporting to the operations executive; and a six-month review of whether escalations were made and how they were handled. The rise in logged incidents was read as improved visibility.

Risk signals. Partner-led teams with steep hierarchy and significant partner influence over allocation, progression and remuneration; client secondments and interstate travel; entertainment involving alcohol; heavy use of messaging platforms outside hours; a hybrid pattern that reduces informal observation; two formal complaints in five years against a strong survey signal that people would not report a partner.

Proportionate controls. A confidential channel reporting to the general counsel and an external service, both outside the practice-group line; contact officers from outside those reporting chains; explicit standards for digital communication and client events, including alcohol limits at firm-hosted functions; a travel and secondment protocol with check-ins and an escalation contact; scenario-based partner training on conduct by senior people; and reduced single-point control over progression through moderated allocation and promotion decisions.

Evidence and review. A documented risk assessment covering seniority, travel, digital channels and client settings; consultation records from junior-cohort focus groups; a board note explaining why the low report count was not read as low risk; confidence to report measured as a leading indicator; and a control review after twelve months of whether allocation moderation and the alternative channel were used. Where a matter did arise involving a senior person, the firm applied the criteria in our guide to appointing an external investigator and the standards in managing complaints through a fair process.

The sequence below is an implementation order, not a compliance guarantee. Scale each step to the size, resources and risk profile of the organisation, and record the reasoning where a step is scaled down.

• 1. Name the accountable executive and set the reporting line to the board or appropriate committee.
• 2. Confirm which duties apply, including the positive duty and the WHS or OHS law of each jurisdiction of operation.
• 3. Conduct and document a risk assessment across sites, shifts, cohorts and settings.
• 4. Consult workers and their representatives, including the most exposed cohorts, and record what was raised.
• 5. Weight controls to work design, rostering, supervision, alcohol settings and digital channels, not training alone.
• 6. Rewrite the policy in plain language with real examples, scope, roles, response options and confidentiality limits.
• 7. Build reporting pathways with at least one route outside the line hierarchy, and define confidential, anonymous and de-identified in practice.
• 8. Appoint, train and supervise contact officers as information, support and referral points, with escalation and conflict management.
• 9. Make support available without requiring a formal complaint, and keep interim adjustments proportionate and reviewed.
• 10. Deliver role-specific training, including scenario-based manager practice, at induction, on cycle and on trigger events.
• 11. Establish leading and lagging indicators, de-identified trend reporting and periodic control assurance.
• 12. Review on a planned, risk-appropriate cycle and after material change, and retain records of assessment, consultation, decisions, training and review with access limited in line with applicable privacy and recordkeeping requirements, including the <a href="https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act" rel="noopener" target="_blank">Privacy Act 1988 (Cth)</a> where it applies.

AWS assists employers with risk assessment and consultation design, policy and reporting-pathway review, contact officer and manager training, prevention governance and assurance through workplace advisory, independent workplace investigations, and control and evidence tracking through Strobe. AWS does not provide legal advice; organisations should obtain their own advice on how the law applies to their circumstances.