Why Organisations Still Get This Wrong

Policies That Exist on Paper Only

Many organisations already have a sexual harassment policy, often unchanged since well before the positive duty commenced. In practice, a document sitting on an intranet page satisfies almost none of what regulators and courts are now asking for.

• Policies never updated to reflect the Fair Work Act 2009 jurisdiction
• No evidence staff have read or understood the policy
• Reporting channels that route complaints back to the alleged offender’s manager
• No review process to check the policy still matches actual practice

Training Treated as a Box to Tick

In fact, a single online module completed once at induction rarely builds the judgement needed to prevent, recognise, or respond to harassment. In particular, generic, off-the-shelf content is weak here, since it cannot reflect an organisation’s own reporting structure, industry risks, or workforce composition.

Consequently, training that is not refreshed, or that ignores an organisation’s real risk profile, leaves a gap that a court can later treat as evidence the duty was not genuinely met.

Third-Party Conduct Left Unmanaged

Because harassment risk from customers, clients, or contractors is harder to control directly than conduct between employees, many organisations simply leave it out of their risk assessments altogether. However, Eklom v Marshall shows exactly why that omission is now dangerous.

• No process for reporting harassment by a customer or client
• Contractor inductions silent on the organisation’s harassment policy
• No escalation pathway when a third party repeatedly crosses a line
• Frontline staff left to manage the situation alone in the moment

The Legal Backbone: From the Sex Discrimination Act to the WHS Act 2011

Sex Discrimination Act 1984 and the Positive Duty

The positive duty under section 47C sits within the Sex Discrimination Act 1984, and the Australian Human Rights Commission enforces it through inquiries, compliance notices, and, where necessary, court proceedings. Recently, that enforcement pathway has become considerably less theoretical, with six inquiries and eighteen monitored organisations already on record.

Fair Work Act 2009: A New Sexual Harassment Jurisdiction

Separately, sections 527D and 527E of the Fair Work Act 2009 created a dedicated sexual harassment jurisdiction, giving workers a direct path to pecuniary penalties and uncapped compensation through the Federal Circuit and Family Court. Specifically, Mejia v Capital City Cafe-Bar and Eklom v Marshall are the first significant decisions to test this jurisdiction, and both resulted in orders against individuals as well as the businesses involved.

• Section 527D covers unwelcome sexual conduct connected to work
• Section 527E allows vicarious liability for the PCBU unless reasonable steps are proven
• Liability can extend to directors and individuals personally
• Orders can include both pecuniary penalties and compensation for harm
• Third parties, including contractors and customers, can also be held liable

Why This Is Also a WHS Issue

Sexual harassment is not only a discrimination matter; the Model WHS Regulations and related codes of practice, adopted across most Australian jurisdictions, explicitly list it as an example of a psychosocial hazard. As a result, a PCBU’s primary duty of care under the WHS Act 2011 already requires managing this risk, so far as is reasonably practicable, in parallel with the positive duty. Similarly, Safe Work Australia’s own psychosocial hazard guidance reinforces this overlap directly.

In practice, this means a single control framework, covering policy, training, reporting, and leadership accountability, can and should satisfy both the WHS Act 2011 psychosocial duty and the Sex Discrimination Act 1984 positive duty at once, rather than running two disconnected compliance projects.

Leadership Behaviour Regulators Now Expect

Officers Must Own This, Not Delegate It

Critically, delegating positive duty compliance entirely to an HR team, without visible officer engagement, no longer matches what regulators and courts expect. Instead, officers should be able to describe specific actions they have personally taken to verify the organisation’s controls.

• Reviewing complaint-handling outcomes directly, not only summary statistics
• Asking whether the organisation has assessed third-party risk, such as customer conduct
• Confirming training completion rates against the whole workforce, not a sample
• Requiring evidence that the team updated the policy since these rulings

Bystander Culture Is Now a Liability

Workplaces where colleagues witness concerning behaviour but say nothing carry a particular kind of risk under the current enforcement environment. Later, silence from bystanders can read as evidence that the organisation tolerated a hostile environment, rather than actively managed it.

• Train all staff, not only managers, on how to raise a concern safely
• Make clear that reporting a concern will not itself create career risk
• Recognise staff who raise issues early, before they escalate

Third-Party Conduct Needs a Named Owner

Specifically, someone within the organisation should be explicitly responsible for managing harassment risk involving contractors, clients, or customers. Otherwise, this risk tends to fall through the gap between HR, operations, and site management, precisely the gap Eklom v Marshall exposed.

From Compliant on Paper to Compliant in Practice

The Gap Between Written Policy and Lived Experience

Fundamentally, a policy document describes intent only. In practice, actual compliance depends on whether workers experience that intent directly, through how the organisation handles complaints, delivers training, and responds when someone raises a concern.

Instead, courts in both decisions looked past the existence of a policy and asked what the organisation had actually done to prevent the conduct in question. In short, that distinction, between having a policy and living it, is now the practical test.

In short, closing that gap is less about writing new documents and more about building repeatable, evidenced practice.

Turning Positive Duty Into an Operating System

Rather than treating positive duty compliance as an annual policy refresh, leading organisations build it into an ongoing operating rhythm, similar to how they already manage other WHS obligations.

• Quarterly review of complaint data and emerging risk patterns
• Training refreshed against real incidents, not a static annual module
• Third-party risk assessed alongside standard WHS hazard reviews
• Board-level reporting on positive duty performance, not just HR metrics

What the Enforcement Era Changes Going Forward

Ultimately, these decisions and the Commission’s active inquiries signal that regulators and courts now judge positive duty compliance on evidence, not intention. Consequently, organisations that can produce records of specific, ongoing action are far better placed than those relying on a policy document alone.

The eCompliance Central Positive Duty Framework

In practice, meeting the standard set by these rulings requires more than a policy update. The following six-step framework gives PCBUs a structured way to build, and evidence, genuine positive duty compliance.

A 6-Step Framework for Control

Run consistently, this framework produces the kind of evidence trail these court decisions and Commission inquiries are now actively looking for, rather than a policy that only looks complete from a distance.