An employer has a Code of Conduct. A workplace behaviour policy. A complaints process. Mandatory online sexual harassment training. Everyone has clicked through the module, the completion report is sitting neatly in a folder, and the business feels reasonably confident that it has done what it needs to do.
Then a complaint is made.
The first instinct is often to point to the policy and training record. Fair enough. Those things matter. They are part of the picture.
But they are not the whole picture.
The harder question is this: did the employer take reasonable steps in the context of what it knew, or should have known?
That is where many businesses get caught. Not because they have ignored the issue completely, but because they have mistaken activity for effectiveness. A training register might show that something was completed. It does not always show that people understood it, that leaders reinforced it, or that the organisation responded properly to known risk.
And that distinction matters.
The problem with treating training as protection
Sexual harassment training is not enough when it is treated as a shield rather than part of a prevention system.
Training has a legitimate role. Employees need to understand what sexual harassment is, what behaviour is unacceptable, how to raise concerns, what support is available, and what consequences may follow. Leaders need a deeper level of understanding because they carry additional responsibility. They are often the first people to see early warning signs, hear informal disclosures or decide whether conduct is “serious enough” to act on.
The issue is not training itself.
The issue is lazy training.
Training becomes weak when employees complete it while distracted, rushing, multitasking or treating it as another admin task to clear before they get back to “real work”. It becomes even weaker when the organisation cannot show that employees engaged with the content, understood expectations, or had a genuine opportunity to ask questions.
A business can have a technically correct module and still have a poor prevention strategy.
That may sound uncomfortable, but it is also useful. It tells employers where to focus. The goal is not to abandon training. The goal is to make training meaningful, targeted and connected to how people actually behave at work.
“Reasonable steps” depends on context
There is no universal checklist that guarantees an employer has taken reasonable steps to prevent sexual harassment. That can be frustrating, especially for business owners who want clarity. But it also makes sense.
A five-person professional services firm does not need the same system as a large hospitality venue with late shifts, young workers, alcohol exposure, customer interaction and multiple layers of supervision. A corporate office with hybrid workers faces different risks from a healthcare business with clinical rooms, patient interactions, overnight shifts or isolated work.
Reasonable steps are contextual.
They depend on things such as:
- the size and resources of the business
- the nature of the work
- workforce composition, including junior workers, casual workers and vulnerable workers
- power dynamics between managers and employees
- how and where work is performed
- known or foreseeable conduct risks
- whether previous complaints, warnings or informal concerns have arisen
- whether employees feel safe to report concerns
- whether leaders know how to respond early and fairly
This is why “we trained everyone” is not always a complete answer.
A better answer is: “We considered where risk was likely to arise, trained people in a way they could engage with, equipped leaders to act early, monitored known issues, created safe reporting pathways and reviewed whether our controls were working.”
That is a much stronger position.
It also reflects a more mature view of HR. Prevention is not a single event. It is a set of leadership habits, workplace systems and practical controls that work together.
Baseline prevention still matters
Every employer should have basic prevention foundations in place. These are not glamorous, but they matter.
Baseline prevention usually includes:
- clear policies on sexual harassment, discrimination, bullying, workplace conduct and complaints
- induction content for new starters
- regular refresher training
- visible complaint pathways
- clear expectations for social functions, client events and work-related travel
- manager guidance on responding to inappropriate comments, disclosures or complaints
- records showing who completed training and when
- accessible support options for employees
These foundations create a shared language. They tell employees what the organisation expects and where to go if something happens.
But baseline prevention has limits.
A policy does not correct a manager who keeps making inappropriate jokes. A training module does not fix a team culture where junior employees are scared to speak up. A complaint pathway does not help much if employees believe reporting will make their life harder.
The real test is whether the foundations are alive in the business.
Do leaders refer to the policy when needed? Do managers intervene early? Do employees know reporting options without having to search the intranet for 20 minutes? Does the business treat low-level conduct as useful information, not as an inconvenience?
That is where prevention starts to become real.
When an employer is on notice, the bar shifts
This is the part many employers miss.
If a business has no known issues, broad prevention measures may be appropriate as a starting point. But once the business becomes aware of a specific risk, the expectations change.
A previous warning for sexual harassment. Repeated inappropriate comments. A complaint that did not proceed formally but raised credible concerns. A team where junior employees avoid a particular manager. A work function where alcohol and power dynamics keep creating issues.
These are not just “incidents”. They are risk signals.
Once an employer is on notice, it should not treat the situation as if nothing has changed.
For example, if an employee has already received a warning for sexual harassment or related conduct, it is unlikely to be enough to simply leave them in the standard training cycle with everyone else. The risk has become specific. The response should be specific too.
Targeted prevention might include:
- direct one-on-one conduct coaching
- written expectations about future behaviour
- clear consequences for any further breach
- closer supervision or monitoring
- changes to reporting lines or contact arrangements
- restrictions on attendance at particular functions or events
- manager check-ins after the warning
- refresher training delivered in a way that requires engagement
- documenting why particular controls were chosen
- reviewing whether those controls are working
A warning should not be treated as the end of the process. In many cases, it is the point where prevention needs to become more deliberate.
This is where “reasonable steps” becomes much more practical. The question is not, “Did we have a policy?” The question is, “Given what we knew, what did we do next?”
Evidence of genuine engagement matters
Employers often keep evidence of training completion. That is useful, but it is not always enough.
A completion certificate tells you the module was finished. It does not tell you whether the person was given uninterrupted time, whether they clicked through quickly, whether they understood the content, or whether managers reinforced it later.
Stronger evidence may include:
- training attendance records
- quiz results or knowledge checks
- manager discussion notes
- toolbox talk records
- team meeting reminders
- examples used in training that reflect the workplace
- acknowledgement of updated policies
- records of leader-specific training
- documented follow-up after prior conduct concerns
- evidence of action taken in response to reports or warning signs
The point is not to create paperwork for the sake of it. The point is to build a defensible record of active prevention.
If a complaint is later made, the business should be able to explain its approach clearly. Not in a panicked scramble after the event, but from records that already exist.
Sexual harassment is also a psychosocial safety issue
Sexual harassment should not sit in a narrow “HR conduct” box.
It also belongs in the broader conversation about psychosocial safety.
Sexual and gender-based harassment can cause psychological and physical harm. It can also interact with other psychosocial hazards, such as poor support, isolated work, fatigue, bullying, aggression, low job control or poor organisational justice.
That means employers need to think beyond individual misconduct after the fact.
Where could this risk realistically arise in your workplace?
It might be in client-facing roles, late-night work, work social events, travel, remote communication channels, hierarchical teams, isolated spaces, accommodation settings, online messages or informal environments where behaviour has been allowed to drift.
This does not mean employers need to panic or assume every workplace interaction is dangerous. It means they should apply the same commercial discipline they would apply to other workplace risks.
Identify the hazard. Assess the risk. Choose practical controls. Consult where appropriate. Review whether the controls are working.
That is not overcomplicating HR. It is good management.
You can read more about this related issue in DreamStoneHR’s blog on Psychosocial Safety at Work: Why It Matters Now More Than Ever.
A practical prevention ladder for employers
A useful way to think about reasonable steps is to move up the prevention ladder.
1. Policy exists
The business has clear policies on sexual harassment, discrimination, workplace conduct and complaints. These policies are current, accessible and written in language people can understand.
But do not stop there. A policy sitting in a folder is not a prevention strategy.
2. Training is meaningful
Employees complete training with time to engage. New starters receive guidance during onboarding. Refresher training is not treated as a one-off event every few years. Training uses examples that reflect the real workplace, not generic scenarios people instantly forget.
Managers receive additional training because their role is different. They need to know how to respond when someone says, “Can I tell you something, but I do not want to make a formal complaint?”
3. Managers know what to do
Leaders understand how to respond to early warning signs, informal comments, disclosures and complaints. They know when to seek advice. They know not to promise confidentiality they cannot guarantee. They know not to dismiss behaviour as “just a joke” because the person did not intend harm.
This is where many workplaces either build trust or lose it.
For more on early leadership action, see DreamStoneHR’s blog Before It Becomes a Complaint: Why Smart Leaders Act Early on Behaviour.
4. Prior issues are followed up
A warning is not the finish line. It is a risk marker.
If someone has already engaged in inappropriate conduct, the employer should consider whether additional controls are needed. This may include targeted coaching, closer monitoring, restrictions on contact, changes to supervision or clear reminders about consequences.
Treating a known risk like a general risk is where employers can come unstuck.
5. Reporting feels safe
Employees understand how to raise concerns and trust that they will not be ignored, blamed or punished. This does not mean every concern must be handled in exactly the same way. It does mean the business needs visible, accessible and credible reporting pathways.
Low reporting does not always mean low risk. Sometimes it means low trust.
6. Social functions are risk assessed
Employers should think carefully about work social events, even where the event is not strictly “at work”. Alcohol, seniority, transport, after-parties, junior employees and blurred boundaries can all change the risk profile.
A practical employer does not cancel every event. It sets expectations, plans properly, watches for foreseeable risks and acts when concerns arise.
7. The system is reviewed
Good prevention is not “set and forget”.
Review complaints data, exit interview themes, employee feedback, manager confidence, training completion quality, workplace culture indicators and known conduct risks. If the same issue keeps resurfacing, the control is not working.
For related workplace culture guidance, see DreamStoneHR’s blog How to Handle Conflict Within the Workplace.
The leadership test: what are you tolerating?
Sexual harassment prevention is not only an HR task. It is a leadership test.
Employees learn what matters by watching what leaders tolerate. If managers ignore inappropriate comments, the policy becomes decorative. If senior people are protected from consequences, reporting confidence drops. If a junior employee sees a previous complaint quietly disappear, they may decide silence is safer.
That is how culture is shaped. Not through slogans. Through repeated decisions.
The strongest workplaces are not the ones that pretend nothing ever goes wrong. They are the ones that respond early, consistently and proportionately when it does.
That means leaders need enough confidence to act before conduct becomes extreme. A quiet word after an inappropriate comment. A clear reset after a concerning pattern. A documented expectation after a warning. A decision to separate employees where continued contact creates risk.
These are not dramatic steps. They are practical ones.
What employers should do next
If your current approach relies heavily on a policy and annual online training, it may be time to step back and review whether your prevention measures are doing enough.
Start with these questions:
- Are our sexual harassment and workplace conduct policies current?
- Do employees understand what behaviour is unacceptable?
- Do managers know how to respond to disclosures and early warning signs?
- Are employees given proper time to complete training?
- Does our training reflect real scenarios in our workplace?
- Have we identified higher-risk roles, locations, functions or relationships?
- Have we taken targeted action where previous conduct concerns have arisen?
- Can employees report concerns safely and confidentially?
- Do we review whether our controls are working?
- If an issue were raised tomorrow, could we explain what we did to prevent harm, not just respond to it?
If the answer to some of these is “not really”, that is not a disaster. It is useful information.
The businesses that get this right are not perfect. They are attentive. They notice when risk changes. They give leaders the tools to respond. They treat respectful workplace behaviour as part of how the business operates, not as a compliance task that sits off to the side.
My final thought
Sexual harassment training is not enough when it is disconnected from leadership, culture and known risk.
A policy matters. Training matters. Documentation matters. But reasonable steps require more than proof that people clicked through a module.
They require practical, active and responsive prevention.
For employers, the real question is not, “Have we done training?”
The better question is, “Are we confident our people understand the expectations, our leaders know how to act, and our controls match the risks we actually have?”
That is where the work becomes more useful. And frankly, that is where HR starts adding real business value.
Want to know whether your current approach goes beyond policy documents and tick-box training? Use DreamStoneHR’s Respect@Work readiness check to assess whether the foundations of a respectful workplace are genuinely in place.
You can also download our Respect@Work and positive duty guide for practical guidance on what reasonable and proportionate prevention can look like for employers.
