POSH Compliance Checklist for Companies in India

Every employer in India is covered by the POSH Act, and an organisation with 10 or more employees must do considerably more than adopt a policy. A complete POSH compliance programme has eight parts: an Internal Committee, a written policy, displayed notices, regular training, SHe-Box registration, complaints handled on time, annual reports, and records that prove all of it.

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (the POSH Act) and the POSH Rules, 2013 set out what an employer must put in place, what it must do when a complaint is made, and what it must report every year. Since 2024, the Supreme Court, the Ministry of Women and Child Development and the Ministry of Corporate Affairs have each added to how that compliance is monitored.

This checklist brings those obligations together in the order most organisations need them.

1. Constitute the Internal Committee

Under Section 4, every employer with 10 or more employees must constitute an Internal Committee (IC), also widely called the Internal Complaints Committee (ICC). Where the organisation has offices or administrative units in different locations, an IC is required at each of them.

The Act prescribes its composition:

• A Presiding Officer, who must be a woman employed at a senior level
• At least two members from among employees, preferably committed to the cause of women or with experience in social work or legal knowledge
• One external member from a non-governmental organisation or association committed to the cause of women, or a person familiar with issues relating to sexual harassment
• At least half of the members nominated must be women

Members hold office for a term not exceeding three years. Keep the written order constituting the IC on file, and diarise the date it expires.

Employers with fewer than 10 employees are not required to constitute an IC. Complaints from such workplaces go to the Local Committee constituted by the District Officer under Section 6. The rest of the Act, including the duty to prevent harassment, still applies.

2. Adopt and circulate a written POSH policy

Rule 13 of the POSH Rules asks employers to formulate and widely disseminate an internal policy for the prohibition, prevention and redressal of sexual harassment. A good policy explains, in plain language:

• What constitutes sexual harassment, with examples relevant to your workplace
• Who is covered, including interns, contractual staff, visitors and clients
• How and to whom a complaint can be made, and the time limits
• The inquiry process, confidentiality and protection against retaliation
• The consequences of misconduct, linked to your service rules or standing orders

Section 19 separately requires employers to treat sexual harassment as misconduct under their service rules, so check that the two documents agree.

3. Display the required information

Under Section 19, the employer must display, at a conspicuous place in the workplace, the penal consequences of sexual harassment and the order constituting the IC. The POSH Rules also call for the names and contact details of all IC members to be declared.

In practice, that means a physical notice at every office, plus the same information on the intranet or HR portal for remote and hybrid teams.

4. Train employees and the Internal Committee

Section 19 requires workshops and awareness programmes for employees at regular intervals, and orientation programmes for IC members. The Rules add capacity-building and skill-building programmes for the IC. We have covered whether POSH training is mandatory and what Internal Committee training should cover in separate articles.

For compliance purposes, the training also has to be documented: dates, attendance, content covered and the trainer. The number of workshops and awareness programmes held is one of the figures that goes into the IC’s annual report.

5. Register your Internal Committee on SHe-Box

The Ministry of Women and Child Development relaunched the SHe-Box portal on 29 August 2024. It allows women to file complaints online, which are forwarded to the IC or Local Committee concerned, and it maintains a central record of committees across the country.

Following the Supreme Court’s directions of 3 December 2024 in Aureliano Fernandes v. State of Goa, several States and Union Territories, including Delhi and Maharashtra, have issued notices asking employers to register their ICs on the portal. Registration is done through the “Private Head Office Registration” option, after which branches and IC members are added. Check the notice issued for your state or district, and update the portal whenever the IC is reconstituted.

6. Handle complaints within the statutory timelines

The Act builds its timelines into the process, and an IC that misses them weakens both the outcome and the organisation’s position.

Throughout the process, the identity of the parties and witnesses, the inquiry proceedings and the recommendations must be kept confidential (Section 16). The IC can also recommend interim relief for the complainant while the inquiry is pending (Section 12).

7. File the annual reports

Reporting happens at two levels, and companies now have a third:

• The IC’s annual report (Section 21 and Rule 14) goes to the employer and the District Officer. It records the number of complaints received and disposed of, cases pending for more than 90 days, workshops or awareness programmes held, and the nature of action taken.
• The employer’s annual report must include the number of cases filed and their disposal (Section 22). An organisation that does not prepare an annual report must give this information to the District Officer instead.
• The Board’s report (companies). From 14 July 2025, the Companies (Accounts) Second Amendment Rules, 2025 require the Board’s report to state the number of sexual harassment complaints received, disposed of and pending for more than 90 days during the year. This is in addition to the earlier statement confirming that an IC has been constituted.

Because the same numbers now appear in several places, keep a single complaints register that the IC, HR and the company secretary all work from.

8. Keep records you can rely on

When compliance is questioned, by an inspector, an auditor, a client or a court, the organisation will be asked to show it, not describe it. Maintain:

• The IC constitution order and each reconstitution
• The current policy and the date it was circulated
• Training calendars, attendance records and content
• SHe-Box registration details
• Complaint files, inquiry reports and action taken, stored securely with restricted access
• Copies of the annual reports filed

What happens if you don’t comply?

Under Section 26, failing to constitute an IC, or otherwise contravening the Act or the Rules, is punishable with a fine of up to ₹50,000. A repeat contravention can attract twice the punishment and the cancellation, withdrawal or non-renewal of the employer’s business licence or registration.

The larger risk is usually not the fine. An inquiry that is badly conducted can be set aside by a court, which leaves the complainant without redress and the organisation exposed.

The checklist at a glance

• Internal Committee constituted at every office, with the correct composition and a current term
• Written POSH policy, circulated and aligned with service rules
• Penal consequences, IC order and member contact details displayed
• Regular employee awareness sessions, and orientation and skill-building for the IC, all documented
• IC registered and kept up to date on SHe-Box
• Complaints handled within the timelines in Sections 9 to 13, with confidentiality maintained
• IC annual report, employer’s annual report and, for companies, the Board’s report disclosures filed
• Records kept securely and ready to produce

Most organisations find their gaps are not in the policy, but in training that was never repeated, an IC whose term quietly lapsed, or reports that were not filed. If you would like help closing those gaps, POSH training and IC advisory for organisations covers each of these steps.

Frequently asked questions

Does the POSH Act apply to companies with fewer than 10 employees?

Yes. Every workplace is covered by the Act. Only the requirement to constitute an Internal Committee depends on having 10 or more employees. Complaints from smaller workplaces are made to the Local Committee constituted by the District Officer.

How long can a member serve on the Internal Committee?

The Presiding Officer and members hold office for a period not exceeding three years from the date of their nomination, so the committee must be reconstituted at least every three years.

Is registration on the SHe-Box portal mandatory for private companies?

Following the Supreme Court’s directions of December 2024, several states and districts, including Delhi and Maharashtra, have issued notices requiring employers to register their Internal Committees on SHe-Box. Check the notice for your state, and treat registration as part of your compliance.

What must a company disclose about POSH in its Board’s report?

Since 14 July 2025, the Board’s report must state the number of sexual harassment complaints received during the year, the number disposed of, and the number pending for more than 90 days, in addition to confirming that an Internal Committee has been constituted.

What is the penalty for not complying with the POSH Act?

A fine of up to Rs 50,000 under Section 26. A repeat contravention can attract twice the punishment and cancellation, withdrawal or non-renewal of the employer’s licence or registration.

This article is for general information and does not constitute legal advice.