Harassment risk assessments
Sexual Harassment Risk Assessments for Employers
Know what to consider. Know what needs action.
Employers need to consider where employees could be exposed to sexual harassment, including situations involving customers, clients and other third parties. The difficult bit is often knowing where to start.
PolicyPilot asks straightforward questions about how your employees actually work, identifies relevant risks and creates a suggested assessment for you to review.
No blank forms. No generic assessment. You stay in control.
Client entertainment
ExampleWhy has this been suggested?
"You told us that employees attend client events where alcohol may be available and some employees stay away overnight."
Suggested consideration
"Consider setting expectations before the event, ensuring employees know who they can contact and making clear that they can leave work-related social activity if they feel uncomfortable."
Why it matters
More than having a harassment policy.
Having a harassment policy is important, but you also need to consider where harassment could occur and what preventative steps may be appropriate.
That includes thinking about how your employees actually work – customer contact, lone working, business travel, social events and interactions with other third parties. PolicyPilot turns that into a manageable process.
What the law says, in brief
- Legal duty: since 30 October 2026, employers must take all reasonable steps to prevent sexual harassment of their employees, and can be liable for harassment of employees by third parties where they haven't taken all reasonable steps to prevent it.
- Official guidance: the Equality and Human Rights Commission recommends assessing the risk of harassment as part of taking reasonable steps.
- PolicyPilot's role: it suggests risks and controls for you to consider. It isn't legal advice and doesn't guarantee legal compliance.
How it works
From a few questions to a reviewable assessment.
- 01
Tell us how your people work
Answer straightforward questions about customers, clients, lone working, business travel, overnight stays, events, third parties, working arrangements and the controls you already have. The questions adapt to your answers.
- 02
PolicyPilot identifies relevant risks
Structured risk rules use your answers to identify relevant risks. AI can help tailor the wording to your organisation, but AI does not independently decide what your risks are. For every suggested risk you can select “Why has this been suggested?”.
- 03
Review what needs action
You see a simple colour-coded assessment. Change the wording, the risk score or the suggested controls, add or remove risks, allocate actions and set deadlines. Add anything we've missed.
- 04
Approve and keep it under review
When you're satisfied it reflects your organisation, submit it for approval where required, approve it, export it, publish relevant information to employees, track actions and set the next review date. PolicyPilot reminds you when it's due.
The assessment
A clear, colour-coded assessment you can work from.
Each risk shows the activity, the risk, the controls you already have, the risk level, any further action, who owns it and the risk that remains. Only the risk level is colour-coded: green for low, amber for moderate, orange for high and red for critical.
Harassment risk assessment
Example| Activity | Risk | Existing controls | Initial risk | Further action | Owner | Residual risk |
|---|---|---|---|---|---|---|
| Customer-facing employees | Employees may experience inappropriate comments or behaviour from customers at the counter or by phone. |
| 9 MODERATE | Make clear employees can end an interaction and how to report it | Operations Manager | 4 LOW |
| Client entertainment | Inappropriate behaviour from clients during work-related social events where alcohol is available. |
| 12 HIGH | Introduce client behaviour expectations | Sales Director | 6 MODERATE |
| Lone working at customer premises | Employees visiting customers alone may be harassed somewhere you don't control, with no one nearby to help. |
| 16 CRITICAL | Introduce check-in calls and confirm employees can leave a visit | Service Manager | 8 MODERATE |
Customer-facing employees9 MODERATE
- Risk
- Employees may experience inappropriate comments or behaviour from customers at the counter or by phone.
- Existing controls
- Harassment policy, Customer behaviour notice
- Further action
- Make clear employees can end an interaction and how to report it
- Owner
- Operations Manager
- Residual risk
- 4 LOW
Client entertainment12 HIGH
- Risk
- Inappropriate behaviour from clients during work-related social events where alcohol is available.
- Existing controls
- Harassment policy, Manager reporting route
- Further action
- Introduce client behaviour expectations
- Owner
- Sales Director
- Residual risk
- 6 MODERATE
Lone working at customer premises16 CRITICAL
- Risk
- Employees visiting customers alone may be harassed somewhere you don't control, with no one nearby to help.
- Existing controls
- Visit log
- Further action
- Introduce check-in calls and confirm employees can leave a visit
- Owner
- Service Manager
- Residual risk
- 8 MODERATE
See a complete example
A sample harassment risk assessment for a fictional company, exported from PolicyPilot. PDF, 3 pages. The risks and scores are examples, not a template to copy.
Try it
Get a sample built from your answers
Answer five quick questions and download a sample assessment created by the same structured risk rules PolicyPilot uses. It's a starting point to show how it works, not a finished assessment.
Your answers are only used to create the PDF. They aren't saved, and you don't need to give your name or email.
Why has this been suggested?
Every suggested risk comes with its reason.
PolicyPilot uses your answers to explain why a risk has been suggested, and offers a practical consideration alongside it. If something doesn't apply to your organisation, you can change it or take it out.
Client entertainment
ExampleWhy has this been suggested?
"You told us that employees attend client events where alcohol may be available and some employees stay away overnight."
Suggested consideration
"Consider setting expectations before the event, ensuring employees know who they can contact and making clear that they can leave work-related social activity if they feel uncomfortable."
How suggestions are made
Consistent logic. Useful wording. Your decision.
Rules
Identify risks that may apply based on your answers, the same way every time.
AI
Helps tailor the wording to your organisation. It doesn't decide what your risks are.
You
Review the suggestions and decide what is right for your organisation.
PolicyPilot suggests. You decide.
Actions
A risk assessment should lead to action.
Where something further may be needed, you can turn it into a clear action, assign an owner and set a date. Actions stay visible so you can see what remains outstanding.
Action
Example- Risk
- Customer-facing employees may experience inappropriate behaviour from third parties.
- Action
- Introduce a clear customer behaviour standard.
- Owner
- Operations Manager
- Due
- 30 November
- Status
- In progress
Employee communication
Turn the assessment into something employees can use.
Once the assessment is approved, you can publish relevant information through the employee handbook. You decide what is appropriate to publish. Confidential information does not need to be included.
Employees can understand
- What has been considered
- What controls are in place
- What they should do
- How concerns can be reported
Scores, internal notes and anything confidential stay private.
Keep it current
Don't complete it and forget it.
Set a review date and PolicyPilot keeps the assessment visible. You can also review it sooner if working arrangements change, a significant concern arises or relevant guidance changes.
Workplace harassment risk assessment
Example- Current
- Approved
- 3 actions
- 1 outstanding
- Next review
- 14 May 2027
Questions
Harassment risk assessments: common questions
- What is a sexual harassment risk assessment?
- It's a structured look at where sexual harassment could happen in your organisation, who could be affected, what controls you already have and what further steps may be appropriate. For each risk it records the activity, the risk, existing controls, a risk score, further action, an owner and the risk that remains.
- Do employers need a sexual harassment risk assessment?
- Employers must take all reasonable steps to prevent sexual harassment of their employees. The law doesn't prescribe a specific risk assessment form, but official EHRC guidance recommends assessing the risk of harassment as part of taking reasonable steps. A risk assessment helps you show what you've considered and done. It doesn't by itself guarantee that you've met the legal duty.
- What should a harassment risk assessment include?
- How your people actually work, such as customer contact, lone working, travel, events and messaging; who could be affected; the controls you already have; a likelihood and impact score; further actions with owners and dates; and a review date. It shouldn't include names or details of individual complaints.
- Should a risk assessment consider customers and other third parties?
- Yes. Employers can be liable for harassment of their employees by third parties, such as customers and clients, where they haven't taken all reasonable steps to prevent it. PolicyPilot asks about third-party contact and includes those risks where your answers mean they may apply.
- Can PolicyPilot create the assessment automatically?
- PolicyPilot creates a suggested starting point. Structured rules use your answers to identify relevant risks and controls, and AI may help tailor the wording. You review and change the assessment, and your organisation remains responsible for approving the final content.
- Who should review and approve the assessment?
- Someone with the authority to put the actions in place, such as a director, owner or senior manager. In PolicyPilot you can share a draft with reviewers and use the same approval steps as your policies.
- How often should a harassment risk assessment be reviewed?
- At a regular interval you set, often yearly, and sooner if working arrangements change, a significant concern is raised or relevant guidance changes. PolicyPilot keeps the next review date visible and reminds you when it's due.
- Can employees see the assessment?
- Only if you choose. Once it's approved you can publish a summary through the employee handbook covering what has been considered, the controls in place, what employees should do and how to report a concern. Confidential information doesn't need to be included.
Prefer to start on paper?
Print our sexual harassment risk assessment checklist and work through it with your team.
Want more detail? Read our sexual harassment risk assessment guide or the guide to third-party harassment risks
From “where do I start?” to a structured first assessment.
Answer straightforward questions about how your people work and let PolicyPilot build a suggested starting point for you to review.