Sexual harassment risk assessment: a practical guide for employers

Under the Equality Act 2010, employers have a duty to take steps to prevent sexual harassment of their employees in the course of their employment. Since 30 October 2026, changes made by the Employment Rights Act 2025 mean employers must take all reasonable steps, and can also be liable for harassment of their employees by third parties, such as customers and clients, where they haven't taken all reasonable steps to prevent it.

The law doesn't set out a single required risk assessment form. However, the EHRC's technical guidance on preventing sexual harassment at work recommends that employers assess the risk of harassment as part of taking reasonable steps. The government can also make regulations setting out more detail on what reasonable steps involve, so it's worth checking current guidance.

What's a legal requirement and what's good practice are different things. A risk assessment is a practical way to show you've thought about your risks and acted on them. It doesn't guarantee that you have met the legal duty.

A harassment risk assessment looks at how your people actually work and asks where harassment could happen, who could be affected, what you already have in place and what more could reasonably be done.

It's similar in shape to a health and safety risk assessment. For each risk you record the activity or situation, the risk itself, your existing controls, how likely and serious it is, any further action, who is responsible and the risk that remains afterwards.

Start with the way work happens day to day, rather than with a list of policies. Situations that can increase risk include:

• Contact with customers, clients, patients, visitors or members of the public
• Lone working, home visits or working at customer premises
• Business travel and overnight stays
• Work social events, client entertainment and situations involving alcohol
• Power imbalances, such as junior staff, apprentices or people on insecure contracts
• Informal messaging groups, social media and out-of-hours contact
• Workplaces where reporting a concern feels difficult or unclear

Then look at your existing controls: a clear harassment policy, a reporting route that doesn't depend on one manager, training, behaviour expectations for events and for third parties, and how concerns have been handled in the past.

• Gather what you know about how people work: roles, locations, customer contact, travel and events.
• Identify the situations where harassment could happen and who could be affected.
• Record the controls you already have, honestly, including anything you're not sure about.
• Score each risk using likelihood and impact, so you can see what needs attention first.
• Decide on further actions, give each one an owner and a date.
• Tell employees what has been put in place and how they can raise a concern.
• Set a review date, and review sooner if working arrangements change or a concern is raised.

Avoid recording names or details of individual complaints in the assessment. It's about situations and controls, and is often shared with managers or employees.

A harassment risk assessment template can help you get started, but a generic template gives every organisation the same risks. A business whose employees visit customers' homes faces different risks from one where everyone works in a single office.

Whatever you use, make sure the final assessment reflects your organisation and that you can explain why each risk is included.

A risk assessment isn't a one-off document. Review it at a set interval, and also when something changes: a new type of customer contact, more travel, a significant concern, or updated official guidance. Keep a record of what you reviewed, what changed and who approved it.

PolicyPilot asks straightforward questions about how your people work and uses structured risk rules to build a suggested harassment risk assessment. For each suggested risk you can see why it has been included. You review it, change anything you need to, allocate actions and set the next review date. Your organisation remains responsible for the final content.