There is a version of this conversation that most organisations are having. It goes something like this: October 2026 is coming; we need to demonstrate we are taking all reasonable steps to prevent sexual harassment in our organisations. Let us make sure our training is in place, our reporting channels are working, and our investigation process is documented.
All of that matters, but none of it is enough on its own.
Because the organisations that will be genuinely prepared for October – and genuinely protected beyond it – are not just the ones that have ticked the operational boxes. They are the ones whose boards understand that sexual harassment is not an HR problem; it is a governance problem. And that the question is not just whether the framework exists, but whether the culture it is sitting in actually supports it.
That was the central argument of our fourth Employment Rights Act webinar, and it is one that we think deserves more attention than it is currently getting.
The full recording is available below. What follows is our attempt to capture not just what was said, but why it matters.
The compliance trap
It is easy to understand why organisations default to a compliance mindset. The legislation is clear, the deadline is real, and the consequences of falling short are significant. So, the natural instinct is to focus on what is measurable and documentable – training completion rates, reporting channel usage, investigation timelines.
But here is the problem with that framing. A policy that sits in a drawer offers no protection. A training programme that people sit through without engaging with changes nothing. A reporting channel that employees do not trust or do not know about is not a reporting channel at all. And a board that receives assurance – rather than data – is not exercising oversight. It is performing it.
Legislation sets the floor by defining the minimum standard below which organisations must not fall. But the organisations that experience the most serious incidents of sexual harassment are rarely the ones that ignored the law. They are the ones that complied with it on paper while something very different was happening in practice.
The signals were usually there – they almost always are. As our panel pointed out, the worst kept secrets in organisations are rarely secrets at all – they are just things that nobody felt safe enough to say out loud, or that nobody with the authority to act was paying close enough attention to.
That is a culture problem. And culture is a board problem.
What boards actually need to be asking
During the session, we put a poll to the audience asking when their board had last formally discussed harassment risk or reviewed speak-up data. The results were honest. A significant proportion could not say with confidence that it had happened recently – or at all.
That is not unusual, and it is not necessarily a sign of bad intent. Boards are busy and there is a tendency – in some organisations a very deeply embedded one – to treat people matters as operational rather than strategic. Something for HR to manage, not something for the board to govern.
That distinction is no longer tenable. From October 2026, a board that cannot demonstrate meaningful oversight of sexual harassment risk is an organisation that cannot demonstrate all reasonable steps. And meaningful oversight means more than having the right committees in place. It means those committees are asking the right questions, receiving the right information, and doing something with it.
So, what are the right questions? A few that came through strongly in the session.
- Are we confident that employees who have concerns feel able to raise them – not just that they have somewhere to go, but that they trust the process enough to use it?
- Are we looking at our data in the round, rather than in isolation – because high absence, high turnover and low reporting in the same team tells a very different story than any one of those things on its own?
- Are we asking about third-party risk – because from October, liability extends to harassment by clients, customers and contractors, and boards often have far less visibility of this than they do of internal culture?
- And when we receive assurance that everything is in hand, are we satisfied with that – or are we asking to see the evidence behind it?
The distinction between receiving assurance and exercising oversight came up repeatedly. Good governance looks like a board that challenges what is presented to it, asks follow-up questions, and is not satisfied with “no news” as an answer. Because as Trish Houston, a FTSE-250 board director, put it during the session, if you have a large and diverse workforce and you are genuinely hearing nothing, that is not reassuring. It is a reason to dig deeper.
From compliance to culture – the more interesting question
The most energising part of the session was a conversation about what boards should actually be trying to build, rather than just what they are trying to avoid.
The framing that resonated most was the idea of a floor and a ceiling. The floor is the legal standard – the minimum. The ceiling is the culture an organisation is actively trying to create. And the most effective boards are not the ones focused on staying above the floor. They are the ones focused on raising the ceiling.
What does that look like in practice? It starts with understanding where your culture actually is – not where you assume it is. A cultural audit, ideally conducted with some external independence, gives boards the evidence they need to have an honest conversation. Not just about risk, but about whether the organisation’s culture is genuinely aligned with what it is trying to achieve. Whether the environment it has created is one where the best people want to work, want to stay, and are able to do their best work.
The business case for this is not complicated. Organisations where people feel psychologically safe – where they trust that concerns will be taken seriously, where they see behaviour challenged rather than overlooked – tend to perform better. Discretionary effort, the willingness of people to go beyond what is required of them, is the product of a culture where people feel valued and respected. That is not a soft outcome. It’s a commercial one.
And the reputational dimension is real too. The organisations that have suffered the most damaging public incidents of sexual harassment have almost never been ones where the problem appeared without warning. There were usually signals – patterns in the data, people who knew, cultures where certain behaviours were tolerated because the person responsible was too valuable, too senior, or too well-connected to challenge. The boards that let that happen were not all negligent. Some of them just did not have the right information, they didn’t ask the right questions, or they failed to create the right conditions for those questions to be answered honestly.
What good board reporting actually looks like
One of the most practical parts of the session covered what boards should actually be receiving – and what it looks like when reporting is done well.
The answer is not voluminous. It is not detailed case notes or sensitive personal information. The best examples of board reporting on speak-up activity tend to be focused, structured dashboards – key statistics on volumes, timescales, the nature of concerns, and outcomes. RAG ratings that allow boards to see at a glance where attention is needed. Enough information to give genuine confidence that issues are being taken seriously and dealt with appropriately, without breaching the confidentiality of the individuals involved.
Beyond the immediate speak-up data, boards benefit from a broader picture. Staff engagement survey results – particularly around psychological safety and whether employees know where to raise concerns. Turnover patterns by team or department. Sickness and absence data. The power of this kind of reporting is not in any single data point. It is in the relationships between them. A team with high turnover, elevated absence and minimal reporting is a combination that warrants attention. A board that is only seeing the last of those three is missing the story.
Making the case internally
For many of the HR, compliance and risk professionals in the audience, the challenge is not understanding why board engagement matters. It is getting the board to engage.
A few approaches that came through as genuinely effective.
- Getting it onto the agenda formally, with the support of the company secretary if there is one – because an item that is on the agenda is one that cannot easily be avoided.
- Framing it as a risk issue rather than an HR issue, because boards that are comfortable with financial and regulatory risk will respond to that language.
- Connecting it to the audit and risk committee, or whatever committee structure is most relevant, because governance frameworks are often the most direct route to meaningful board attention.
And then there is the framing question. For some boards, the risk and legal argument is exactly right. For others, the more compelling case is the positive one – that culture is a strategic asset, that the ability to attract and retain the best people increasingly depends on how an organisation behaves as well as how it performs, and that boards have a direct stake in getting this right. Not just because the law requires it, but because the business benefits from it.
Where to go from here
If this session raised questions about how your board is currently engaging with this agenda – what information it is receiving, what questions it is asking, whether your cultural foundations are as strong as you need them to be before October – our team of experts are always happy to help!