POSH Compliance for Companies: ICC & Board Report Rules

Last verified: 2026-07-21

POSH compliance for companies is no longer a quiet HR file: it now runs from the boardroom to the Registrar of Companies. Every company with 10 or more employees must constitute an Internal Committee under the POSH Act, 2013, and every company must now put hard numbers into its Board’s Report. Since 14 July 2025, Rule 8(5)(x) of the Companies (Accounts) Rules, 2014 requires the Board’s Report to state not just that the Internal Committee exists, but how many sexual harassment complaints were received, disposed of, and left pending beyond 90 days. Get the disclosure wrong and the company faces a penalty of up to Rs. 3,00,000 under the Companies Act, 2013, with a further Rs. 50,000 on each officer in default.

This article sets out what POSH compliance now requires of companies: the Internal Committee, the annual report, and the new Board’s Report disclosure introduced by the 2025 amendment.

Two duties sit on top of each other here, and reading them together is the whole point. The POSH Act, 2013 controls the substance, the committee, the inquiry, the annual return to the district officer. The Companies Act, 2013 controls the disclosure, the statement a company’s directors sign in the Board’s Report each year. A company can run a flawless inquiry and still be penalised for the one line it left out of a filing.

The change that makes this urgent is recent. The Ministry of Corporate Affairs rewrote the POSH line in the Board’s Report through the Companies (Accounts) Second Amendment Rules, 2025, and the new format applies to every Board’s Report a company adopts on or after 14 July 2025. For most boards, the reports being prepared through the 2026 season are the first ones that have to carry the full figures.

POSH compliance as a company obligation

POSH compliance for a company runs on three layers that feed into each other: the Internal Committee that hears complaints, the annual report the committee files with the district officer, and the disclosure the board makes in the company’s Board’s Report. Miss any one layer and the chain breaks, usually at the point a regulator or an acquirer looks for it. The statute behind all three is the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, read now with the Companies Act, 2013 and its accounts rules.

Why does a sexual harassment statute reach into company law at all? Because Parliament and the Ministry of Corporate Affairs decided that how a company treats women at work is a governance fact, not a private HR matter, and governance facts belong in the annual disclosures directors answer for. That is the shift a compliance team has to internalise: the same complaint data now travels to two different authorities, the district officer under the POSH Act and the Registrar of Companies under the Companies Act.

Which companies and workplaces are covered

The POSH Act covers every workplace, and for corporate compliance the trigger is the headcount. Any employer with 10 or more employees at a workplace must constitute an Internal Committee, so the duty catches almost every operating company well before it is large enough to think of itself as one. The count is not limited to the permanent payroll. Under the Act, an “employee” includes anyone engaged on regular, temporary, ad hoc or daily-wage terms, whether directly or through a contractor, and whether paid or not, so interns, probationers and contract staff all count towards the threshold.

“Workplace” is drawn just as wide, and companies with distributed teams read it too narrowly. It covers the registered office, but also branch offices, factory floors, a client site, a conference, a vehicle used for work, and increasingly the remote and hybrid setups a company runs. A complaint arising out of a work offsite or a work chat is still a workplace complaint.

There is one more point that surprises company boards. The Act protects any woman at the workplace, not only employees, so a customer, a visitor or a woman working for a vendor on the premises can be an aggrieved woman and can complain to the company’s Internal Committee. Treating POSH as an internal-staff issue is the first mistake a narrow reading makes.

Why POSH became a governance and disclosure issue

POSH moved into the governance column because the numbers finally started to be counted and published. Data compiled on listed companies shows reported sexual harassment complaints rising from 161 in FY 2013-14 to more than 1,100 in FY 2022-23, with reporting heavily concentrated in a small set of large firms and hundreds of companies still disclosing zero. That gap, between what is happening and what is disclosed, is exactly what the disclosure rules are built to close.

For directors, the practical consequence is that POSH is now a line item they certify, not a task they delegate and forget. The Board’s Report is a document the directors approve and sign, and the POSH statement inside it is theirs to stand behind. That is why the 2025 change to the Board’s Report format matters more than a routine rule tweak, and why it is worth walking through each layer in turn.

The Internal Committee under the POSH Act

The Internal Committee is the body a covered company must constitute under Section 4 of the POSH Act, and it is the foundation the rest of the compliance chain is built on. The Act calls it the Internal Committee, though corporate documents and the accounts rules often use the older label Internal Complaints Committee, or ICC. Whatever the name, Section 4 requires every employer to constitute it, and that duty effectively attaches once a workplace has 10 or more employees, since smaller establishments are served by the district Local Committee instead. Failing to constitute the committee is itself a breach, independent of whether any complaint is ever made.

Does the 10-employee count include contract and part-time staff? Yes. Because the Act’s definition of employee is deliberately broad, a company that runs largely on contractors or interns can cross the threshold without a single name on its permanent rolls. The safe reading is to count everyone who works at the workplace.

Composition and quorum

The composition of the Internal Committee is prescribed, not left to the company’s discretion. The Presiding Officer must be a woman employed at a senior level at the workplace. There must be at least two members from among the employees, preferably ones committed to the cause of women or with experience in social work or legal knowledge. And there must be one external member drawn from a non-governmental organisation or association committed to women’s causes, or a person familiar with issues of sexual harassment.

The external member is the requirement companies drop most often, usually to save cost or avoid bringing an outsider into sensitive matters. That is a costly shortcut. At least half of the total members must be women, the members hold office for a term of up to three years, and an inquiry run by a committee that was never validly constituted is open to challenge on that ground alone. Fixing the composition, external member included, before any complaint arrives is far cheaper than defending a defective committee later. iPleaders sets out the membership rules and disqualifications in its explainer on the Internal Complaints Committee, which is a useful companion read for HR teams building the panel.

When the Local Committee applies

The Local Committee is the district-level body constituted under Section 6 of the Act, and it exists for the cases a company’s own committee cannot handle. Where an establishment has fewer than 10 employees, there is no obligation to form an Internal Committee, so any complaint goes to the Local Committee instead. It also takes complaints made against the employer itself, because an in-house committee cannot fairly judge the person who controls it.

The Local Committee is constituted by the District Officer, a role the state government designates, usually the District Magistrate or Collector. For a company, the practical relevance is narrow but real: a complaint against a proprietor, a promoter-director in day-to-day control, or the company at large may have to travel to the Local Committee rather than stay in-house.

The POSH annual report the Internal Committee files

The POSH annual report is the record that turns a committee that exists on paper into one that demonstrably functioned, and it is the source of the numbers the Board’s Report now has to carry. Under Section 21 of the POSH Act, the Internal Committee must prepare a report each calendar year and submit it to the employer and to the District Officer. This is a recurring, dated filing, and its absence is the first thing an inspection or a dispute exposes.

What goes into it is set by the POSH Rules. The annual report records the number of complaints of sexual harassment received in the year, the number disposed of, the number pending for more than 90 days, the number of workshops and awareness programmes carried out, and the nature of the action taken by the employer. Those are close to the exact figures the Companies Act now wants in the Board’s Report, which is not a coincidence.

What the annual report must contain

The contents of the annual report matter because they are now doing double duty. A company that keeps its complaint register clean through the year can generate the annual report and the Board’s Report figures from the same source in minutes. A company that reconstructs the numbers at year end, from memory or scattered emails, is the one that reports inconsistent figures to the two authorities and creates its own compliance gap.

The discipline this asks for is modest but has to be continuous. Log every complaint on receipt, record the date of disposal, and flag anything crossing the 90-day line, because that last figure is one the Board’s Report specifically calls out.

The filing to the district officer

Section 22 of the POSH Act closes the loop on the company side. It requires the employer to include in its own annual report the number of cases filed and their disposal under the Act, or, where no such report is otherwise prepared, to intimate the number to the District Officer. So the company’s reporting obligation to the district machinery predates the Companies Act change; what 2025 did was route the same information to a second regulator as well.

Reading the two together, a company now answers for the same complaint numbers in two places: the POSH filing to the District Officer, and the Board’s Report to the Registrar of Companies. Making those two sets of figures agree is the single most important housekeeping task the new regime creates.

The new Board’s Report disclosure under Rule 8(5)(x)

The Board’s Report disclosure on POSH changed on 14 July 2025, and this is the development that gives the whole subject fresh urgency. The Board’s Report is the statement the directors of every company prepare under Section 134(3) of the Companies Act, 2013, and Rule 8(5)(x) of the Companies (Accounts) Rules, 2014 is the sub-clause that governs its POSH content. The Ministry of Corporate Affairs substituted that sub-clause through the Companies (Accounts) Second Amendment Rules, 2025, notified by G.S.R. 357(E) dated 30 May 2025 and brought into force on 14 July 2025.

The reach of the change is wide. It applies to all companies registered under the Companies Act, 2013, public and private, listed and unlisted, and it takes effect for every Board’s Report adopted on or after the commencement date. There is no turnover or listing filter to hide behind, which is why even small private companies need to look at it now. The board report drafting that flows from Section 134 is a discipline in itself, and our walkthrough of Board’s Reports under Section 134 of the Companies Act, 2013 is a useful companion to the POSH-specific rule covered here.

What changed on 14 July 2025

Before the amendment, Rule 8(5)(x) asked for a single line: a statement that the company had complied with the provisions relating to the constitution of the Internal Complaints Committee under the POSH Act. It was a box a company could tick whether or not the committee ever met. That light-touch statement is what the old rule required, and it is what many boards had been reproducing verbatim for years.

The substituted rule keeps the compliance statement and then adds the data behind it. The Board’s Report must now confirm compliance, including the constitution of the Internal Committee, and go on to disclose the actual complaint figures for the year. The point of the change is to make the disclosure falsifiable: a bare “we comply” can no longer sit next to numbers that would contradict it.

The exact data points to disclose

The revised Board’s Report has to carry three complaint figures and a headcount. The three figures are the number of sexual harassment complaints received during the financial year, the number disposed of during the year, and the number pending for more than 90 days. Alongside them, the prescribed format requires the company to state the number of female, male and transgender employees as at the close of the financial year, the first time company-law disclosures have asked for a gender-disaggregated headcount.

The same amendment added a second social-compliance line unrelated to POSH but landing in the same Board’s Report: a declaration that the company has complied with the Maternity Benefit Act, 1961. A company that is not covered by that Act should say so expressly rather than leave the line blank. Both additions are filed electronically, because the amendment also routed the Board’s Report extract into the e-form annexed to Form AOC-4 under Rule 12(1C).

Small companies, OPCs and the abridged report

Do the smallest companies escape this? Mostly not, though the mechanics differ. A one person company or a small company files an abridged Board’s Report under Rule 8A rather than the full Rule 8 report, and how much of the new POSH format has to appear in that abridged form is a point on which companies should take specific advice. What does not change for them is the underlying POSH duty: if the workplace has 10 or more employees, the Internal Committee is mandatory, and the annual report to the District Officer is due, whatever the size of the company.

Establishments below the 10-employee line sit differently again. They need not constitute an Internal Committee, but the safer practice, and the one the disclosure regime pushes towards, is still to record a short compliance statement rather than stay silent, since silence in a Board’s Report reads as an omission rather than an exemption.

Building the POSH compliance trail

The POSH compliance trail is the set of documents and records that let a company prove, not just assert, that each layer worked, and building it is mostly a coordination problem. The people who hold the pieces sit in different functions: HR runs the committee and the complaints, the legal team owns the policy and the inquiries, and the company secretary drafts the Board’s Report and files with the Registrar. The 2025 change forces those three to reconcile their numbers before year end rather than after.

The backbone of the trail is the written POSH policy. It sets out what conduct is prohibited, names the Internal Committee and how to reach it, and explains the complaint process, and it is the document an inquiry and later a court looks to first. Getting it right is a drafting exercise in its own right, which our guide to drafting an anti-sexual harassment POSH policy covers clause by clause.

Aligning the board report, the district filing and BRSR

For most companies the reconciliation is a two-way match, between the Board’s Report and the Section 22 filing to the District Officer. For the top listed companies it is a three-way match. The largest listed entities already report their POSH complaint numbers in the Business Responsibility and Sustainability Report under SEBI’s framework, so the same figures now appear in the BRSR, the Board’s Report and the district-officer return, and all three have to agree. The overlap with sustainability reporting is exactly why POSH has become a topic independent directors are expected to understand, a theme our piece on ESG compliance and the SEBI BRSR framework takes further.

The practical fix is to close the complaint register once, at financial year end, and drive every downstream number from that single close. When the BRSR team, the secretarial team and the HR team each pull from their own working file, the mismatches are not fraud, they are drift, but a regulator cannot tell the difference from the outside.

Documentation the committee must maintain

The records the Internal Committee keeps are what convert good intentions into a defensible position. A dated complaint register, minutes of each inquiry, notices issued to the parties, the annual report filed with the district officer, and evidence of the awareness workshops the Act requires are the core file. Each of these is cheap to keep contemporaneously and expensive to reconstruct later.

There is a second reason to keep the file tight. Because the Board’s Report figures are now signed disclosures, the documentation behind them is what a company relies on if a number is ever questioned, and a committee that cannot show its working invites the assumption that the disclosure was guesswork.

Penalties and enforcement for companies

The penalties for getting POSH compliance wrong now come from two statutes at once, which is what makes the exposure larger than most boards assume. The POSH Act punishes the underlying failure, no committee, no annual report, no action on a recommendation, and the Companies Act punishes the disclosure failure in the Board’s Report. A company can be exposed under either, or both, for what looks like a single lapse.

On the POSH side, Section 26 of the Act sets the base penalty at a fine of up to Rs. 50,000 for a contravention, which includes failing to constitute the Internal Committee, failing to act on its recommendations, or failing to file the required returns. The figure looks small until the repeat-offence rule is read with it: a second or subsequent contravention doubles the punishment and, more seriously, allows the government to cancel, withdraw or refuse to renew the licence or registration the business runs on.

The two penalty regimes

On the Companies Act side, the disclosure failure is punished under Section 134(8). Where a company fails to comply with the Board’s Report requirements of Section 134, the company is liable to a penalty of Rs. 3,00,000, and every officer of the company who is in default is liable to a penalty of Rs. 50,000. That officer exposure is why the disclosure is a director-level concern and not something safely left to a junior in the secretarial team; the personal risk directors carry is the subject of our note on the personal liability of independent directors in India.

Smaller companies get proportionate relief, not an exemption. Under Section 446B of the Companies Act, a one person company, a small company, a startup or a producer company faces a penalty reduced to one-half of the amount otherwise payable, subject to statutory ceilings. And Sections 448 and 449 sit behind the whole exercise: a false statement in a filing carries its own civil and criminal liability, so an inaccurate POSH number is not a harmless overstatement.

What enforcement looks like

Enforcement of the disclosure duty is not theoretical, and a pre-amendment case shows how it works. In an adjudication order dated 12 September 2023, the Registrar of Companies, Karnataka penalised Ceeta Industries Limited for failing to include the Internal Committee compliance statement in its Board’s Reports for the financial years 2018-19 and 2019-20, as Section 134(3)(q) read with Rule 8(5)(x) then required. The company argued that it had fewer than ten employees at each location and so needed no committee, but the Registrar rejected that as a reason to omit the disclosure and imposed the full Section 134(8) penalty of Rs. 3,00,000 on the company and Rs. 50,000 on each of the managing director, the chief financial officer and the company secretary, for each of the two years. Because Ceeta was a public company, and not a small company, it did not get the reduced-penalty relief under Section 446B. That was the price of omitting a single statement under the old, lighter rule.

The wider enforcement climate points the same way. In Aureliano Fernandes v. State of Goa, (2023) SCC OnLine SC 621, the Supreme Court found serious lapses in POSH implementation more than a decade after the Act was passed and directed governments and establishments to verify that compliant Internal Committees exist, to train their members, and to make the complaint process public. That direction, read with a disclosure rule that now demands real numbers, tells companies plainly that a committee existing only on paper is not compliance. The line the courts have held since Vishaka & Ors. v. State of Rajasthan, (1997) 6 SCC 241 and Medha Kotwal Lele v. Union of India, (2013) 1 SCC 297 has always run towards turning a stated protection into an enforced one.

Frequently asked questions

1. What is the new POSH disclosure requirement in the Board’s Report from 2025? From 14 July 2025, Rule 8(5)(x) of the Companies (Accounts) Rules, 2014, as substituted by the Companies (Accounts) Second Amendment Rules, 2025, requires a company’s Board’s Report to disclose the number of sexual harassment complaints received during the year, the number disposed of, and the number pending for more than 90 days, in addition to confirming that the Internal Committee has been constituted. The report must also state the number of female, male and transgender employees at the close of the financial year.

2. Which companies does the new Board’s Report disclosure apply to? All companies registered under the Companies Act, 2013, whether public or private, listed or unlisted. There is no turnover or listing threshold. It applies to every Board’s Report adopted on or after 14 July 2025.

3. When did the amendment come into force? The Ministry of Corporate Affairs notified the Companies (Accounts) Second Amendment Rules, 2025 through G.S.R. 357(E) dated 30 May 2025, and the rules came into effect on 14 July 2025.

4. What did Rule 8(5)(x) require before the amendment? Before the change, Rule 8(5)(x) required only a single statement that the company had complied with the provisions relating to the constitution of the Internal Complaints Committee under the POSH Act. No complaint numbers had to be disclosed.

5. When must a company constitute an Internal Committee? As soon as a workplace has 10 or more employees. Section 4 of the POSH Act requires every employer to constitute an Internal Committee, and because establishments with fewer than ten workers are instead covered by the Local Committee under Section 6, the obligation effectively applies at 10 or more employees. The count includes contract, temporary and part-time staff, not just the permanent payroll.

6. Who must sit on the Internal Committee? A Presiding Officer who is a senior woman employee, at least two employee members preferably with a background in social work or law, and one external member from an NGO or a person familiar with sexual harassment issues. At least half the members must be women, the external member is compulsory, and members hold office for up to three years.

7. Where do the complaint numbers in the Board’s Report come from? From the Internal Committee’s annual report under Section 21 of the POSH Act, which records complaints received, disposed of, pending beyond 90 days, workshops held, and action taken. The same register should drive both the Section 22 filing to the District Officer and the Board’s Report figure.

8. What is the penalty for a wrong or missing POSH disclosure in the Board’s Report? Under Section 134(8) of the Companies Act, 2013, non-compliance with the Board’s Report requirements makes the company liable to a penalty of Rs. 3,00,000 and every officer in default liable to Rs. 50,000. False statements in a filing can also attract liability under Sections 448 and 449.

9. Are there separate penalties under the POSH Act itself? Yes. Under Section 26 of the POSH Act, failing to constitute the Internal Committee, act on its recommendations or file returns attracts a fine of up to Rs. 50,000. A repeat contravention doubles the penalty and can lead to cancellation or non-renewal of the licence or registration needed to run the business.

10. Do one person companies and small companies have to make the disclosure? The underlying POSH duties apply to them regardless of size: if the workplace has 10 or more employees, the Internal Committee and the annual report are mandatory. One person companies and small companies file an abridged Board’s Report under Rule 8A, and how much of the new POSH format appears in that abridged form is a point on which they should take specific professional advice.

11. Do smaller companies get any relief on the Companies Act penalty? Yes. Under Section 446B, a one person company, small company, startup or producer company faces a penalty reduced to one-half of the amount otherwise payable, subject to statutory ceilings. It is a reduction, not an exemption.

12. What is the gender-wise employee disclosure? The revised Board’s Report format requires the company to state the number of female, male and transgender employees as at the close of the financial year. It is the first time company-law disclosures have asked for a gender-disaggregated headcount.

13. Does the amendment also cover the Maternity Benefit Act? Yes. Alongside the POSH changes, the 2025 amendment requires the Board’s Report to carry a declaration that the company has complied with the Maternity Benefit Act, 1961. A company outside that Act’s coverage should state that expressly rather than leave the line blank.

14. How does this interact with the BRSR for listed companies? Large listed companies already disclose POSH complaint numbers in the Business Responsibility and Sustainability Report under SEBI’s framework. The same figures now appear in the BRSR, the Board’s Report and the district-officer return, so all three have to be reconciled to one complaint register.

15. What if the company received zero complaints during the year? It still discloses. A company reports the figures as nil rather than omitting the disclosure, because a blank or missing statement in the Board’s Report reads as an omission, not an exemption, and the disclosure obligation applies whether or not any complaint was made.

References

Case Law

1. Aureliano Fernandes v. State of Goa, (2023) SCC OnLine SC 621. Found serious lapses in POSH implementation and issued directions to public and private establishments to verify that compliant Internal Committees exist (decided 12 May 2023).
2. Medha Kotwal Lele v. Union of India, (2013) 1 SCC 297; AIR 2013 SC 93. Directed effective implementation of the Vishaka guidelines and functional complaint committees.
3. Vishaka & Ors. v. State of Rajasthan, (1997) 6 SCC 241; AIR 1997 SC 3011. Laid down the binding guidelines on workplace sexual harassment, including the complaints committee, that governed until the 2013 Act.

Statutes and Rules

1. Maternity Benefit Act, 1961. A compliance declaration is now required in the Board’s Report.
2. Companies Act, 2013. Sections cited: 134(3) and 134(8) (Board’s Report and penalty), 446B (reduced penalty for one person companies, small companies, startups and producer companies), 448 (false statement) and 449 (false evidence).
3. Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013. Sections cited: 4 (Internal Committee), 6 (Local Committee), 21 and 22 (annual report), 26 (penalty); read with the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Rules, 2013 (Rule 14).
4. Companies (Accounts) Rules, 2014. Rules cited: Rule 8(5)(x) (POSH disclosure in the Board’s Report), Rule 8A (abridged Board’s Report for OPC and small companies), Rule 12(1C) (electronic filing of the Board’s Report extract with Form AOC-4).

Regulatory and enforcement

1. Ministry of Corporate Affairs, Companies (Accounts) Second Amendment Rules, 2025, Notification G.S.R. 357(E) dated 30 May 2025 (in force 14 July 2025).
2. Registrar of Companies, Karnataka, adjudication order in the matter of Ceeta Industries Limited dated 12 September 2023, penalising non-disclosure of the Internal Committee’s constitution in the Board’s Reports for FY 2018-19 and FY 2019-20 under Section 134(3)(q) read with Rule 8(5)(x).

This article is for informational purposes only and does not constitute legal advice. For specific legal guidance, consult a qualified legal professional.