Mid-Year PoSH Audit: 7 Things Every IC Should Check Before July

January is when most organisations think about PoSH. The annual report has just been filed. The IC has been reconstituted. Training has been scheduled. The policy is on the noticeboard. By June, the picture is often different.

IC members have changed jobs or moved teams. The external member’s contact details are outdated. Training happened once in February and nobody remembers what was covered. A complaint came in March, was acknowledged, and has been sitting in an email thread ever since with no formal inquiry opened. The annual report was submitted, but the organisation’s IC details were never updated on the SHe-Box portal.

None of this registers until a complaint lands, a regulatory inspection is called, or an investor due diligence audit asks uncomfortable questions. By that point, fixing the gaps is no longer preparation. It is damage control.

June is the right month to do the audit that should have been done in April. There are still six months left in the year to correct course, retrain, reconstitute, and document. July is when the window gets tighter.

Here are 7 things every Internal Committee, and every HR professional who manages one, should check before the month is out.

1. Is Your IC Actually Legally Constituted Right Now?

This is the foundational question, and the one most organisations skip because they assume the answer is yes. It frequently is not.

Under Section 4 of the PoSH Act, a valid IC requires:

• A Presiding Officer who is a senior woman employee
• At least two internal members committed to women’s causes or with social work experience or legal knowledge
• At least one external member from an NGO, association committed to women’s causes, or a person familiar with labour law or employment issues
• At least 50% of total IC members must be women

The Act specifies that IC members hold office for a term not exceeding three years from the date of their nomination. This is a hard limit. If any member’s three-year term has expired, even if they are still at the organisation and willing to continue, the IC is not validly constituted until fresh appointment orders are issued.

In January 2026, a mid-size IT company in Bengaluru had its entire PoSH inquiry invalidated by a District Officer because the Presiding Officer had left the organisation eight months earlier and the committee had never been reconstituted. The employer received a show-cause notice. The respondent used the invalid IC constitution to challenge the inquiry. The proceedings had to restart from zero.

The mid-year check: Pull the original appointment letters for all IC members. Verify the date of nomination. Check whether anyone has resigned, been transferred, or is no longer available. If a member’s term is expiring within the next six months, begin the reconstitution process now, before the term lapses, not after. Update SHe-Box immediately when any change occurs.

2. Is Your External Member Actually Independent?

The external member requirement is one of the most frequently violated provisions in PoSH compliance, not through negligence, but through misunderstanding of what “external” actually requires.

The external member must come from outside the organisation. They cannot be a current or former employee, a vendor, a client, or anyone with a financial or personal relationship with the organisation that could create a conflict of interest. They must have experience in social work or legal knowledge relevant to sexual harassment cases, or be a member of an organisation committed to women’s causes.

Common mistakes seen in practice: appointing the company’s retainer lawyer as external member (conflict of interest, they represent the employer); appointing the founder’s CA or personal advocate; nominating a friend of the HR Director who has no relevant background; appointing someone who is so unavailable that the IC cannot achieve quorum when a complaint arrives.

The external member’s absence at an inquiry, or a conflict of interest challenge against them, can derail the entire process. Courts have set aside IC inquiry reports where the composition, including the external member’s appointment, was found deficient.

The mid-year check: Verify your external member’s current appointment letter, their qualifications for the role, and whether they have any new conflict of interest that has arisen since their appointment. Confirm their availability and willingness to participate in inquiries for the remainder of the year. If there are concerns, identify and onboard a replacement before a complaint arrives.

3. Are Any Complaints Currently Open, and Where Do They Stand?

This is the check that HR teams dread most, because the answer sometimes reveals that a complaint acknowledged three months ago has not progressed to a formal inquiry.

The PoSH Act is specific on timelines:

• The IC must send a copy of the complaint to the respondent within 7 days of receiving it
• The respondent must submit a written reply with supporting documents and witnesses within 10 working days of receiving the complaint
• The IC must complete its inquiry within 90 days of receiving the complaint
• The IC must submit its report to the employer within 10 days after concluding the inquiry
• The employer must act on the IC’s recommendations within 60 days of receiving the report

A complaint that was filed in March and is still at the stage of “we need to schedule the first IC meeting” is already well inside the danger zone. A complaint filed in January that has not been resolved is potentially already in breach of the 90-day window.

Since the SHe-Box portal now provides District Officers with a monitoring dashboard showing complaint timelines, delays that previously went unnoticed are increasingly visible to regulators.

The mid-year check: Pull a status report on every complaint received since January 1. For each one: note the date of receipt, confirm the 7-day acknowledgment was issued in writing, verify what stage the inquiry is at, and calculate the remaining time within the 90-day statutory window. If any complaint is close to or past the 90-day limit, escalate immediately, to legal counsel if necessary.

4. Has Your IC Conducted Awareness Training This Year?

Section 19(c) of the PoSH Act mandates that employers organise workshops and awareness programmes for sensitising employees on the issues and implications of workplace sexual harassment at regular intervals.

“At regular intervals” is not defined as once a year. Best practice, and increasingly, regulatory expectation, is that awareness programmes happen multiple times a year, with dedicated sessions for IC members and separate sessions for employees and managers.

The most common failure mode: a training was conducted in Q1, attendance records were not maintained, new joiners since then have had no PoSH awareness whatsoever, and the IC members who attended the training still have not had any dedicated IC-specific training on inquiry procedures, natural justice, documentation, or confidentiality.

An IC constituted on paper but never trained is a legal liability. Courts have confirmed that procedural errors by untrained ICs can result in entire inquiry proceedings being set aside, regardless of the merits of the underlying case.

The mid-year check: Pull training attendance records from January to June. Verify that IC members have received training specific to inquiry procedures, not just general awareness. Identify employees who joined after the last training and ensure they receive awareness before year-end. If no training has happened this year, schedule it before July. Retain all attendance records.

5. Is Your PoSH Policy Current, and Actually Visible?

A PoSH policy that was drafted in 2021 may be missing provisions that have become compliance expectations since, including remote and hybrid workplace coverage, digital harassment (covered under the BNS 2023), third-party and client harassment, and gender-neutral language if your organisation has voluntarily adopted broader protections.

Beyond the document itself, Section 19(b) of the PoSH Act requires employers to display at conspicuous places in the workplace: the penal consequences of sexual harassment, the composition of the IC, and the contact details of IC members. This display obligation is separate from having a written policy, it is an ongoing physical and digital visibility requirement.

In practice, what the audit finds: the policy was displayed at the old office and never updated for the new office address. The IC member names on the noticeboard are two years out of date. The intranet policy page was last updated in 2022. New employees signed an offer letter acknowledging receipt of the policy, but nobody can locate the signed acknowledgments.

The mid-year check: Retrieve the current PoSH policy document and verify it reflects the current workplace scope (including WFH and hybrid arrangements), updated IC member details, and coverage of digital and third-party harassment scenarios. Physically verify that IC composition and contact details are displayed at all office locations and on internal digital platforms. Confirm that new joiner onboarding includes policy acknowledgment and that signed acknowledgments are being stored.

6. Are You SHe-Box Compliant?

This has moved from best practice to active regulatory obligation.

The SHe-Box portal, relaunched on 29 August 2024, now requires employers to register their IC details, maintain current member information, and upload annual reports. Multiple state and district authorities have issued formal directives: Delhi’s Department of Women and Child Development (June 2025), Karnataka Labour Department (August and November 2025), Tamil Nadu’s state-wide SOP (June 2025). The Supreme Court’s follow-up orders in the Aureliano Fernandes matter, December 2024, August 2025, January 2026, have directed Chief Secretaries to ensure District Officers actively monitor portal registration.

Recently, on 19^th June 2026, National Commission for Women (NCW) issued an advisory to all States and UTs, calling for mandatory annual PoSH audits and stronger workplace safety mechanisms. This shows that regular PoSH compliance checks are now becoming a key expectation nationwide.

Non-registration is documented non-compliance. When a complaint is filed against an unregistered organisation on SHe-Box, the portal notifies nodal officers, making the employer’s non-registration an active flag in the regulatory system.

Additionally, from 14 July 2025, the MCA’s Companies (Accounts) Second Amendment Rules require all companies to make PoSH disclosures in their Board Report, complaints received, disposed, pending beyond 90 days, awareness workshops conducted, and actions taken by the employer. This data sits in a document reviewed by auditors, lenders, investors, and the ROC. If your SHe-Box records and your Board Report data are inconsistent, that is a problem waiting to surface.

The mid-year check: Verify your organisation is registered on SHe-Box at https://shebox.wcd.gov.in. Confirm that IC member details on the portal match your current IC composition. Verify that the annual report for calendar year 2025 has been uploaded. If any of this is outstanding, complete it this month, not when a complaint arrives.

7. Does Your IC Know What to Do When a Complaint Actually Comes In?

This is the check that reveals the gap between compliance on paper and compliance in practice. Many organisations have a valid IC, a current policy, and a reasonable training record, but their IC members have never worked through an actual or simulated inquiry process and would be unprepared if a complaint arrived tomorrow.

The failure points in a live complaint are consistent across organisations: the 7-day acknowledgment is not issued in writing; the complaint copy is not formally served on the respondent; meeting minutes are not maintained; witness statements are not recorded in a signed, dated format; the chain of custody of evidence is not tracked; confidentiality obligations are not communicated to all parties in writing; and the IC’s final report does not contain the specific elements the Act requires.

Any one of these failures creates grounds to challenge the inquiry’s findings, regardless of whether those findings are substantively correct.

The mid-year check: Run a mock inquiry exercise with your IC. Work through the scenario from complaint receipt to report submission. Identify where the IC would have fumbled. Provide targeted training on those specific failure points. Ensure that your IC has a complaint acknowledgment template, a respondent notice template, a witness examination format, a signed confidentiality undertaking, and a final report template, all ready to use before a complaint arrives.

How Kelp Can Help

Kelp’s PoSH advisory practice runs mid-year compliance audits for organisations that want a structured, honest assessment of where their IC stands, and a clear action plan for what needs to be fixed before the year ends.

We can help with:

• PoSH diagnostic audits, a full review of IC constitution, training records, complaint status, policy currency, and SHe-Box registration
• IC reconstitution, appointment of qualified external members and support for valid reconstitution documentation
• IC member training, inquiry procedure, natural justice, documentation, and confidentiality, not just general awareness
• Mock inquiry workshops, walking your IC through a live simulation so they are ready when a real complaint arrives
• SHe-Box registration and compliance, ensuring your portal records are accurate and your annual report data is correctly filed
• PoSH policy refresh, updating your policy to cover hybrid work, digital harassment, and extended workplace scenarios

The second half of the year is the better half to be compliant in. The audit that catches a problem now is far less expensive than the inquiry that collapses because of it later.

Reach out to our team at www.kelphr.com | info@kelphr.com | 95001 29652