Are we changing culture or keeping business as usual on workplace harassment?

Starting on 26 October 2024, employers in the United Kingdom are required to take reasonable steps to prevent sexual harassment at work. This legal duty shifts the focus from reacting to complaints to proactively reducing risk. If you already run compliance programs for bribery, tax evasion, or fraud, the good news is that you have a strong starting point. The Equality and Human Rights Commission (EHRC) has aligned its guidance on reasonable steps with the government’s familiar six-principles approach to adequate or reasonable controls in adjacent regimes.

The practical message for founders and business leaders is simple. You do not need to rebuild your compliance framework. You need to extend and adapt it, making sure your policies, training, reporting channels, and investigation playbooks can withstand scrutiny under the new standard. Employers that demonstrate a holistic, risk-based program, investigate fairly, and track effectiveness will be in the best position to show that reasonable steps were taken.

The UK’s new duty is part of a wider global movement. The United States, Canada, Australia, and multiple EU states have tightened expectations on employers, expanded guidance, and increased enforcement. In the US, the EEOC has reported a marked rise in sexual harassment charges and continues to pursue significant settlements and corrective actions. Sweden requires employers to maintain clear policies, procedures, and training. France has strengthened prevention and response obligations within companies. Australia has moved to a proactive standard with the Fair Work Commission and the Australian Human Rights Commission issuing detailed guidance.

If you employ across borders, harmonising to the highest common standard is more efficient than managing a patchwork of minimums. Aligning UK operations with proven measures from these jurisdictions will reduce duplication, speed up rollouts, and improve outcomes for employees.

Courts will look at the quality and effectiveness of your controls, not just their existence. A risk-based approach is essential, and the scale of your procedures should be proportionate to the risks in your business. Tribunals will weigh whether conduct continued after measures were put in place, how quickly you acted when issues arose, and whether time, cost, and practicalities were sensibly balanced with the need for prevention.

Below are eight steps that bring the EHRC guidance to life and mirror best practice from adjacent UK compliance regimes and Australian experience operating under a proactive duty.

1) Run a Serious Risk Assessment

Start with a structured assessment of when, where, and how harassment risk is most likely to arise in your organisation. Look beyond the obvious. Consider isolated roles, night shifts, alcohol-related events, client-facing settings, power imbalances, and teams with a history of conflict. Use data and voices from the ground. Survey employees, run focus groups, and interview line managers. Document your assumptions, your evidence, and your residual risks after controls. Revisit the assessment at set intervals and whenever the business changes, such as after an acquisition or a rapid hiring phase.

Leverage what you already use for health and safety or anti-bribery risk assessments. The aim is not a glossy report but a living instrument that drives action.

2) Update Policies and Make Them Work Day-to-Day

Policies must be clear, accessible, and specific to your environment. Define unacceptable conduct, set out roles and responsibilities, and show employees exactly how to raise concerns. Include protections for temporary staff, contractors, and interns. Explain how third-party risks will be handled. Keep legal references accurate, but write in plain language. Review policies at least annually or after material changes.

Do not stop at publication. Test comprehension. Ask employees to confirm understanding. Embed key expectations in onboarding checklists, management toolkits, and supplier terms.

3) Communicate Often and From the Top

Culture follows signals. Senior leaders should set the tone in visible, regular communications that emphasise respect, safety, and accountability. Bring policies to life in team meetings, town halls, and manager cascades. Use short scenario-based communications that show what to do in real situations, including client events or work travel. Reinforce psychological safety by highlighting non-retaliation, confidentiality, and support resources.

4) Provide Multiple Reporting Channels and Train to Use Them

Offer more than one route for raising a concern. Combine named HR contacts with an anonymous hotline or online portal. Make the process clear: what happens next, expected timelines, confidentiality boundaries, and interim support. Avoid arbitrary time limits for making a complaint.

Training should be regular and role-specific. Frontline employees need bystander skills and confidence to speak up. Managers need practical guidance on receiving disclosures, preserving evidence, and escalating appropriately. Investigators need specialised training in trauma-informed interviewing, credibility assessment, and documentation. Reinforce with refreshers and micro-learning, not just a single annual session.

5) Respond Quickly, Fairly, and Consistently

When a complaint arises, act promptly. Acknowledge receipt, assign a trained investigator, define scope, and set out a timeline. Maintain confidentiality to the extent possible, apply interim measures where needed, and protect against retaliation. Keep both complainant and respondent updated on process milestones.

Consistency matters. Similar cases should lead to similar outcomes. When sanctions differ, record the reasons. Close the loop with lessons learned to improve controls and culture.

6) Manage Third-Party Risk

Harassment is not confined to your payroll. Clients, customers, suppliers, and contractors can be sources and victims. Map those interactions in your risk assessment. Bake standards into contracts and codes of conduct. Provide reporting routes for third parties, and tell your people how to get help if problems arise off-site or at events. Train client-facing teams on de-escalation and exit strategies in difficult situations.

7) Monitor, Measure, and Improve

Prevention is a moving target. Track inputs and outcomes. Inputs include training coverage, policy attestations, and time to first response. Outcomes include complaint volumes, themes, resolution times, survey sentiment, and hotspots by location or function. Use technology where appropriate to detect trends while protecting privacy. Share aggregated insights with leadership and the board.

Schedule regular reviews with HR, Legal, Safety, Operations, and business leaders. Adjust controls as the data and lived experience dictate, not just on a calendar cycle.

8) Investigate with Care and Professionalism

Investigations are a core part of prevention. They show employees you take issues seriously and give you the evidence to act. Plan each investigation before you begin. Set a clear scope and issues list. Decide whether legal privilege is available and desirable. Choose investigators who are trained and free from conflicts. Consider whether the complainant would be more comfortable with an investigator of the same sex.

Follow ACAS guidance for fair process. Gather the best available evidence, which often means careful, respectful interviews rather than solely relying on documents. Keep meticulous notes and maintain chain-of-custody for digital evidence. Provide access to emotional support services where appropriate. Manage internal and external communications to protect confidentiality and reduce harm. At the end, document findings and rationale, implement remedial actions, and capture lessons learned for your risk register and program improvements.

Where independence or specialist expertise is needed, consider outsourcing. An external investigator can reduce perceived bias and enhance credibility before a tribunal.

Implementation Tips for Founders and Growth-Stage Leaders:

• Start with a short gap analysis. Map the EHRC reasonable-steps themes against your existing anti-harassment, health and safety, whistleblowing, anti-bribery, and conduct programs.
• Prioritise high-risk areas. Use your risk assessment to sequence work in sprints. Address event protocols and client-facing teams early if those risks are material.
• Equip managers first. They are your early warning system. Give them short, practical tools for receiving concerns, signposting support, and escalating.
• Make it measurable. Set simple KPIs that you can track reliably. Tie them to executive oversight to keep momentum.
• Build the narrative. Employees need to hear why you are doing this, how it protects them, and what support is available.

Compliance keeps you on the right side of the law, but prevention also pays for itself. Strong programs reduce legal exposure, reputational damage, and turnover. They improve engagement, psychological safety, and productivity. Investors, customers, and partners increasingly ask for evidence of safe and inclusive workplaces. Being able to show a risk-based, data-informed program is a competitive advantage in bids, audits, and due diligence.

The UK’s reasonable-steps duty asks employers to move from policy to practice. The expectation is proactive prevention, credible reporting routes, skilled responses, and continual improvement. If you adapt your existing compliance architecture, invest in targeted training, and monitor what works, you can create a workplace that is safer for people and defensible for the business. That is good law, good leadership, and good economics.