Workplace Harassment: Types, Reporting, and Prevention

Workplace harassment is unwanted conduct that violates someone's dignity or creates an intimidating, hostile, degrading or offensive environment for them — and in most of the world it is now two things at once. It is a legal wrong, tested against discrimination law. It is also a psychosocial hazard, which means it belongs in your risk assessment alongside noise and manual handling, with controls, monitoring and records. Most guidance covers the first and ignores the second.

That gap is where sites get caught. In sixteen years of assurance work across ports, offshore assets, EPC projects and factories in seventeen countries, the harassment failures I have written up were almost never failures of policy wording. They were failures of route and reach. A policy existed. The reporting channel it named could not be physically reached by anyone on nights, and the supervisor had never been told what to do in the ninety seconds after someone tells him something.

This guide covers what harassment is and the types you meet on operating sites. It then sets out how the legal duty differs across the UK, US, Australia and the ILO framework in 2026, and how to test your reporting and prevention controls the way an auditor would.

Key takeaways

The six points below are what a practitioner needs to hold before reading further:

• Harassment is a psychosocial hazard under ISO 45003:2021, and ISO 45001:2018 clause 6.1.2.1 already requires hazard identification to consider social factors including harassment and bullying — so it belongs in the risk assessment, not only in the staff handbook.
• In Great Britain, the preventative duty under section 40A of the Equality Act 2010 has applied since 26 October 2024. It rises to all reasonable steps, with employer liability for third-party harassment, on 30 October 2026.
• In the United States, the EEOC rescinded its 2024 Enforcement Guidance on Harassment in the Workplace on 22 January 2026. Title VII and the case law behind it are unchanged; the detailed federal interpretive framework is not.
• The safety regulator usually is not the enforcing body. In Great Britain, HSE refers harassment complaints to Acas, the EHRC or the police — but the underlying duty to assess and control the risk still sits with the employer under health and safety law.
• Training is the weakest control in this set. Victoria's psychological health regulations, in force since 1 December 2025, explicitly restrict reliance on information, instruction and training where higher-order measures are reasonably practicable.
• A reporting channel that cannot be reached at 03:00, without a company email address, in a worker's own language, is not a reporting channel. Walk the route before you claim it works.

What counts as harassment: two tests, not one

Two different questions get asked about the same behaviour, and confusing them is the most common analytical error I see in site investigations. The legal question is whether conduct meets a statutory test for unlawful harassment. The safety question is whether exposure to that conduct creates a foreseeable risk of harm that the employer must control. A behaviour can fail the legal test and still be a hazard you are obliged to manage.

The legal test

In Great Britain, section 26 of the Equality Act 2010 defines harassment as unwanted conduct related to a protected characteristic that has the purpose or effect of violating dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment. Sexual harassment is unwanted conduct of a sexual nature under section 26(2). The effect limb matters on site: intent is not a defence, though the tribunal weighs whether it was reasonable for the conduct to have that effect.

In the United States, harassment becomes unlawful under Title VII where it is based on a protected characteristic. It must then either be tied to a tangible employment action, or be severe or pervasive enough that a reasonable person would find the environment hostile. Federal law does not police ordinary rudeness. State law frequently goes further than the federal floor.

The hazard classification

ISO 45003:2021, the international guidance on managing psychosocial risk, places bullying, harassment and violence squarely among the hazards arising from social factors and workplace relationships. ISO 45001:2018 clause 6.1.2.1 goes slightly further than most auditors realise: hazard identification must take account of how work is organised and social factors, and the standard names workload, work hours, victimisation, harassment and bullying as examples.

That single clause is the reason a certified management system with no harassment exposure profile has a genuine nonconformity, not a philosophical gap.

The two framings ask for different evidence, and a site needs both:

The types you will actually see on an operating site

The standard taxonomies are written for office populations, so they lead with email, meetings and video calls. On a container terminal, a turnaround or a night packaging hall the same behaviours appear in different places, and the type matters because each one responds to a different control.

Discriminatory harassment is conduct related to a protected characteristic — race, sex, religion, disability, age, sexual orientation, gender reassignment and the rest. On multinational projects it shows up around language and nationality, and it is easy to miss because it is often carried in a language the site's HSE lead does not speak.

Sexual harassment covers unwanted conduct of a sexual nature, in both its forms: quid pro quo, where a benefit or detriment is tied to submission, and the hostile environment version built from repeated comments, images and touching. Isolation and skewed gender ratios raise exposure sharply, which is why offshore accommodation, remote camps and lone night roles need specific assessment.

Bullying and power harassment is repeated unreasonable behaviour by someone with real or positional power — humiliation in front of a crew, allocation of the worst tasks as punishment, deliberate exclusion from briefings. It rarely fits neatly under discrimination law, and it is frequently the biggest single psychosocial exposure on a site.

Third-party harassment comes from people who are not your employees: hauliers, customers, patients, passengers, client representatives and other contractors. On a terminal, drivers at the gate are the exposure. In a hospital or a retail estate, it is the public.

Digital harassment on industrial sites lives in crew WhatsApp groups, shift handover chats and shared-device photographs rather than corporate email — which means it is invisible to IT monitoring and evidence disappears when a phone is wiped.

Retaliation and victimisation is detriment aimed at someone who reported, supported or witnessed a complaint. It is the type that determines whether every other control works, because a workforce that watches one reporter get moved to a worse rota will not report again.

Where each type concentrates, and what actually reduces it:

If you are triaging where to look first, these are the three signals that a type is present but unreported:

• Bullying — one crew carrying both high absence and high turnover while its output holds
• Third-party — gate or counter staff who describe abuse as "part of the job"
• Retaliation — a reporter who moves shift, area or employer within three months of closing a case

What the law requires in 2026, by jurisdiction

Two things changed in this area within a year of each other, in opposite directions, and any guide written before 2026 gets at least one of them wrong. If you run a multinational standard, this is the section to check your policy against.

Great Britain

The preventative duty inserted by the Worker Protection (Amendment of Equality Act 2010) Act 2023 has applied since 26 October 2024. It requires employers to take reasonable steps to prevent sexual harassment of employees, and a tribunal that finds a breach may uplift compensation in a successful sexual harassment claim by up to 25%. The Equality and Human Rights Commission can enforce the duty without waiting for an incident.

From 30 October 2026, under the Employment Rights Act 2025 and the government's implementation timetable, that becomes a duty to take all reasonable steps, and employer liability for third-party harassment returns, covering the relevant protected characteristics rather than sexual harassment alone. Regulations defining what counts as reasonable steps are expected later. Anticipatory risk assessment, done and documented before a complaint arrives, is what the higher standard is built to test.

United States

On 22 January 2026 the EEOC voted to rescind its 2024 Enforcement Guidance on Harassment in the Workplace. Guidance is not law, and Title VII, the Supreme Court precedent interpreting it, and every state and city civil rights statute are untouched. What has gone is the single federal document employers were using to calibrate policies, training and examples. Practically, that pushes the reference point down to case law and to state law, which in several states is more demanding than the federal floor.

Separately, safety law reaches part of this ground. There is no federal OSHA standard for workplace violence, but the General Duty Clause, section 5(a)(1) of the OSH Act, has been used where violence is a recognised hazard. California went further: Labor Code section 6401.9, added by SB 553, has required nearly all employers to maintain a written workplace violence prevention plan, annual training and a violent incident log since 1 July 2024.

Australia and international

Every Australian jurisdiction now requires psychosocial hazards to be identified and controlled like physical ones, with Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 completing the set on 1 December 2025. Internationally, ILO Convention No. 190 has been the reference instrument since it entered into force in 2021. Armenia became the 54th ratifying member state in December 2025 and Sri Lanka followed in April 2026. Check the ILO's own register for the current count before citing a number.

Where the duty sits, at a glance:

Who regulates harassment, and why safety still owns the hazard

Safety practitioners routinely get told this topic belongs to HR, and there is a real jurisdictional basis for that. It does not release the safety function from the hazard.

In Great Britain, HSE states plainly that it is not the appropriate body to investigate bullying or harassment. It refers those matters to Acas, to the EHRC where a protected characteristic is engaged, and to the police for physical violence or offences under the Protection from Harassment Act. HSE will look at work-related stress where several workers are affected and there is evidence of an organisational failing, and its interest in violence and aggression is mainly third-party violence.

Read that carefully and the split becomes workable. The individual complaint is handled through grievance, discipline and employment law. The pattern — the exposure, the risk assessment, the adequacy of controls — remains a health and safety matter under section 2 of the Health and Safety at Work etc. Act 1974 and regulation 3 of the Management of Health and Safety at Work Regulations 1999, and HSE's own Management Standards include a Relationships standard covering unacceptable behaviour.

Auditing a chemical complex, I asked who owned the psychosocial section of the risk register and got three answers in one morning: HR, the site manager, and "it's in the wellbeing programme". Nobody could produce an assessment. That is the normal finding, not the unusual one.

A workable split of duties looks like this:

• HR or employee relations — individual complaints, investigation, discipline, grievance, settlement
• Safety — the hazard in the risk assessment, exposure profiling, control adequacy, monitoring data, management review
• Line management — first response, immediate protective measures, escalation within a stated timescale
• Legal or the equality regulator route — statutory tests, tribunal exposure, enforcement engagement

Assessing harassment as a psychosocial hazard

A harassment risk assessment is not a survey. It is an exposure profile: which groups of workers, in which tasks and at which hours, are most exposed, and what stands between them and harm. I run it the same way I would run one for a physical agent, and it takes about half a day on a mid-sized site.

Start by identifying the conditions that raise exposure rather than the behaviours themselves. The recurring ones are isolation, power asymmetry, insecure employment, unclear reporting lines, public or customer contact, and low supervisory presence. Those are the same factors NIOSH flags as overlooked psychosocial hazards in construction and that Safe Work Australia sets out for the same sector.

Then get data from somewhere other than the complaint log, because the complaint log is the one number guaranteed to understate the problem. The ILO reports that 22.8% of people in employment — about 743 million — have experienced violence and harassment at work during their working life. If your site of 400 has two logged reports this year, the log is measuring the reporting route, not the exposure.

Before signing off an assessment, I want to see four sources of evidence in it:

1. Exit interview themes for the last twelve months, read by area rather than in aggregate
2. Absence and turnover by crew and shift, because a single crew carrying both is a signal
3. Anonymous survey results split by shift, not site-wide averages that bury the night population
4. The complaint log with time-to-first-response, which tells you more than the volume does

Reporting: why channels fail, and the five tests I run

Every site I audit has a reporting channel. Perhaps a third of them have a reporting channel that a night-shift agency worker could actually use. The gap between those two statements is where most harassment goes unreported, and it is almost always structural rather than cultural.

The recurring failures are dull and fixable. The single route runs through the line manager, who is the subject of a meaningful share of complaints. The hotline number is on an intranet that half the workforce has no login for. The poster is in English on a site where the night crew speaks Polish and Tagalog. The contractor's people are told to report to their own employer, whose supervisor is the person they are reporting. Nobody ever hears what happened to a report, so the second one never comes.

What the night shift never tells you

At an offshore energy support hub, I reviewed leadership walkabout logs and found almost no structured night visits, despite a high density of night permits. That was not a harassment case — it was a visible-leadership finding, and I have described it as such. But the mechanism transfers directly. I scheduled accompanied night walkabouts and tracked night findings separately; findings rose first, then recurring issues declined.

The lesson is the one that matters here. If no leader is present between 22:00 and 06:00, then for a third of the working week your reporting system consists of a poster. Harassment concentrates in exactly those hours, and so does the confidence that nothing will be done about it.

The five tests

Before I accept that a reporting route works, I run it rather than read it:

1. Walk it at 03:00. Can a worker with no company email, no intranet login and no personal data allowance reach a route that reaches someone with authority?
2. Bypass the supervisor. Is there at least one route that does not pass through the person most likely to be the subject?
3. Check the languages. Are the route and the policy available in the languages actually spoken on nights, not the languages in the head office HR system?
4. Test the contractor chain. Can an agency or subcontractor worker report to the site operator directly, and does the bridging document say so?
5. Follow one closed report. Was the reporter told the outcome, and did anyone check on them 30 and 90 days later?

Test five is the one that fails most often, and it is the one that predicts whether you will get a second report.

Prevention: controls in hierarchy order, not a training slide

Ask a site how it prevents harassment and you will usually be handed a completion percentage for an e-learning module. Training is a control. It is close to the bottom of the hierarchy, and treating it as the programme is the reason so many well-trained sites still have a problem.

Victoria's psychological health regulations make this explicit: employers cannot rely on information, instruction and training alone as a control where higher-order measures are reasonably practicable. That is the same logic that stops you handing out earplugs instead of fixing a compressor, and it applies here for the same reason. Behaviour is downstream of how the work is organised.

Higher-order controls that actually exist here

Eliminate or design out the exposure where you can. Do not roster apprentices alone with a single supervisor for extended periods. Do not put a lone worker on a public-facing gate at night without a second person or a monitored withdrawal option. Break up crews where an entrenched power structure has produced repeat concerns, and change the rota rather than asking the affected worker to move.

Substitute and engineer next. Physical barriers and controlled access at delivery bays reduce third-party contact. Cameras in public interface areas support investigation, though they do not prevent much on their own and they carry their own consultation obligations.

Then come the administrative controls where most programmes start. Conduct standards written in concrete behaviours rather than abstractions. Supervisor competence and selection. Contractor pre-qualification, and a stated first-response procedure so a supervisor knows what to do in the first hour.

The four changes I would make first on a site starting from a policy-and-training programme are:

1. Change the rota, not the target — move the subject of a complaint, never the person who reported it
2. Give gate and counter staff written authority to withdraw from an abusive third party without prior permission
3. Train supervisors on the first hour, not on definitions — what to say, what to protect, who to call, by when
4. Put psychosocial risk on the management review agenda with data attached, so it survives a change of site manager

Contractors and third parties on multi-employer sites

This is the part of the topic that changes most in the next two months, and it is the part where site operators have the least in place. Running contractor interface programmes on mega-projects, the pattern I saw repeatedly was a client anti-harassment policy that covered client employees and stopped at the fence line, while most of the people on site worked for someone else.

From 30 October 2026 in Great Britain, employers become liable for harassment of their employees by third parties where they have not taken all reasonable steps to prevent it. A third party is anyone who is not the employer or a fellow employee: contractors, suppliers, clients, customers, hauliers, patients, passengers and the public. For an operator whose gates see two hundred external drivers a day, that is a live exposure with a date on it.

The interface controls that hold up under audit are documented rather than assumed:

• Bridging documents that name the reporting route — which organisation receives a report, in what timescale, and how the other party is informed
• Pre-qualification questions with evidence — not "do you have a policy" but the last twelve months of complaint volumes, response times and outcomes
• A single site induction covering conduct for every worker regardless of employer, delivered in the languages present
• Stated authority to withdraw from contact with an abusive third party without needing permission first, which is the control that most gate staff lack
• Client-side escalation for third parties who are commercially important, agreed before the first incident rather than during it

What I check on site, and what the records must show

When I audit this area, I do not start with the policy. I start with whether the hazard exists anywhere in the safety management system, and then I test whether the paper matches what the night shift experiences.

The first three questions take ten minutes and sort most sites. Where is harassment in the risk register, and who signed the assessment? What did management review discuss about psychosocial risk in the last twelve months? How many reports were closed, and how long did first response take? A site that cannot answer the third question is not measuring the control, it is only storing complaints.

Then I go to the workforce. I ask a night-shift worker to tell me how they would report something about their supervisor. I ask a subcontractor's operative the same question. The answers are consistently more informative than the documentation, and the gap between the two is the audit finding.

Frequently asked questions

These are the questions that come up most often when I run this session with site teams and supervisors.

Is workplace harassment a health and safety issue or an HR issue?

Both, and they split cleanly. The individual complaint is handled through grievance, discipline and employment law. The exposure — who is at risk, what controls exist, whether they work — is a health and safety matter that belongs in the risk assessment under ISO 45001 clause 6.1.2.1 and general duty legislation.

What are the main types of workplace harassment?

Discriminatory harassment related to a protected characteristic, sexual harassment in its quid pro quo and hostile environment forms, bullying and power harassment, third-party harassment from customers and contractors, digital harassment through messaging and shared devices, and retaliation against anyone who reports or gives evidence.

How should an employee report workplace harassment?

Use whichever route reaches someone with authority who is not the subject of the complaint: a manager other than the person involved, HR, a confidential hotline, a union representative, or the site operator if you work for a contractor. Record dates, locations, what was said and who was present.

What changes for UK employers on 30 October 2026?

The duty to prevent sexual harassment rises from reasonable steps to all reasonable steps, and employer liability for third-party harassment returns, covering the relevant protected characteristics. Documented, anticipatory risk assessment becomes the practical test rather than the presence of a policy.

Does the EEOC rescission mean US harassment law has changed?

No. Title VII, the Supreme Court precedent interpreting it, and state and local civil rights laws are unchanged. What was withdrawn on 22 January 2026 was the agency's detailed interpretive guidance, so employers now calibrate against case law and state requirements instead.

Does anti-harassment training prevent harassment?

Not on its own. Training sits at the bottom of the hierarchy of controls, and Victoria's psychological health regulations expressly restrict relying on information, instruction and training where higher-order measures are reasonably practicable. Rostering, supervision and reporting design move the numbers further.

How often should a harassment risk assessment be reviewed?

Annually as a minimum, and whenever something changes the exposure: a new contractor population, a shift pattern change, a restructure, a serious incident, or a cluster of reports from one crew. Record the trigger alongside the review date.

About the author

Chloe Anderson is a British Occupational Health, Safety and Environment (OHSE) Technical Educator and Site Assurance Consultant with 16 years of continuous field experience across 17 countries. She has led corporate wellbeing and MSD prevention work at IKEA Industry, a night operations fatigue risk programme at DP World, offshore campaign HSE assurance at Equinor and contractor interface HSE programmes at Fluor, and has inspected 180+ workplaces and trained 6,500+ professionals. She holds CMIOSH, the NEBOSH National Diploma, ISO 45001 Lead Auditor and Mental Health First Aid (MHFA England), and leads Anderson OHSE Assurance & Education in Edinburgh.

Sources and further reading

• HSE — Reporting a concern about work-related stress, bullying and harassment
• HSE — What are the Management Standards?
• legislation.gov.uk — Worker Protection (Amendment of Equality Act 2010) Act 2023
• GOV.UK — Implementing the Plan to Make Work Pay and Employment Rights Act
• EEOC — Commission votes to rescind 2024 harassment guidance
• OSHA — OSH Act section 5, Duties and workplace violence prevention programs
• Cal/OSHA — Workplace violence prevention guidance and resources
• ISO — ISO 45003:2021 Psychological health and safety at work
• ILO — Promoting the ratification and application of Convention No. 190
• Safe Work Australia — Psychosocial hazards and mental health in construction
• NIOSH — Psychosocial hazards often overlooked in construction