The harassment policy benchmark: what ten of Britain's biggest employers actually tell a manager to do

In October 2026 the duty on UK employers changes. "Reasonable steps" becomes "all reasonable steps". A standalone liability arrives for harassment by third parties, and for that one, a single incident is enough.

The regulations that will define "all reasonable steps" are not expected until 2027 or 2028. So employers are working to a raised standard without a definition of it, and most will be reviewing their policy this autumn on judgement alone.

Before we get to what we found, one thing is worth saying plainly, because it shapes everything else.

When an employer is asked to show it took all reasonable steps, the policy is the opening exhibit and rarely the persuasive one, because a document proves what you wrote, not what you did or what your people can do.

That gap between the document and the behaviour is the subject of this piece. We read the published harassment provisions of ten large UK employers, compared them against four questions the new duty makes unavoidable, and paid particular attention to what each document would leave a manager doing in the moment. The wording that worked and the wording that did not are both below, so you can hold your own policy against them.

The four questions

These are not our invention. They fall out of the legislation and the EHRC's technical guidance on the preventative duty. They are also the four things a manager needs answered before they can act.

1. Is it named? Does the document use the words sexual harassment, or rely on general language about dignity and respect?

2. Who counts as a source? Colleagues only, or also customers, clients, contractors, suppliers, visitors and members of the public?

3. Where does it apply? The workplace, or also business trips, work socials, client events, out of hours and online?

4. What happens on receipt? Does the document tell the person who receives a disclosure what to do, or only where to forward it?

Most organisations we read answer at least one well. Almost none answer all four. And each unanswered question converts into the same thing: a grey area that a manager will resolve on instinct, with no record of how they resolved it.

What we read, and how

Only documents any member of the public can download. We started from each organisation's own policy or governance index rather than a search engine, then read everything that could carry harassment provisions.

That distinction matters if you are benchmarking against peers. Several organisations serve an out of date document through search results while publishing a current one on their own site. Two published a substantive harassment policy somewhere we would not have found by searching alone. Start at the policy index or you will reach the wrong conclusion.

Where we say we could not find something, we mean it is not in the public documents we located. Six of the ten name an internal policy that is not published.

Every document we scored or cited is linked in Sources. Company names in the article open the same PDFs. Unilever, Vodafone, Diageo, Experian, Lloyds and IAG have not had a full policy-index check, so a standalone harassment policy may exist that we did not find. If you work there and we have the wrong document, write in.

The benchmark

easyJet published a bullying and harassment policy in March 2026, written with the incoming duty plainly in view. One sentence does more work than most complete sections we read elsewhere. It tells employees they are covered whether the behaviour comes from a colleague, a customer or an external party, and whether it happens in the workplace, at a work related event, outside of work, or online.

Questions two and three, settled in a line. If you take one drafting lesson from this piece, take that structure. Source, then setting, both in the same breath rather than scattered across a document.

Now the uncomfortable comparison. The clearest policy in the whole review was not published by a company.

Oakham Town Council has a handful of staff and no compliance function. Its policy carries a numbered section headed third party harassment. It states zero tolerance for harassment of an employee by a client, customer or member of the public, then does the thing almost nobody else does. It says what happens next: warn the individual, ban them from the premises, report them to the police. It commits to taking all reasonable steps to deter and prevent third party harassment, which is the statutory phrase itself.

Ledbury Town Council is stronger again on scope, naming job applicants, contractors, agency workers and former employees as covered, and naming where the policy applies, with examples given as Christmas parties, leaving celebrations, working lunches and conferences.

The obvious objection is that parish councils are consistent because most adopt the same free model template. That is the finding, not a defence. A free template is outperforming bespoke corporate drafting at organisations employing hundreds of thousands of people. If your policy is weaker than Oakham's, the fix is not expensive.

Benchmark table

Question 1: is it named

Where it fails. In AstraZeneca's Code of Ethics, the words harassment, sexual harassment, bullying and victimisation do not appear. The nearest provision commits to treating others with fairness, integrity, honesty, courtesy, consideration, respect and dignity. That is a values statement, not a conduct rule. We could not find a standalone harassment policy in their published library, and the Global Standards the code refers to are not published as a set.

Lloyds names harassment but not sexual harassment, though it does name specific forms of unacceptable conduct including racist, sexist, homophobic, transphobic and ableist behaviour, which is more than most manage. That finding is from the 2022 Code of Ethics and Responsibility. We could not find a later public edition, or a URL for the 2026 Code of Supplier Responsibility.

What it costs you. A manager cannot map what they have just been told onto a policy that does not use the words for it. The common failure is not disagreement about whether conduct was acceptable. It is uncertainty about whether the policy is the relevant one at all. And when that uncertainty is resolved badly, there is nothing in the record showing anyone ever tested whether staff could recognise the conduct in the first place.

What to check in yours. Search for "sexual harassment". If it returns nothing, that is your first fix, and it is a five minute one.

Question 2: who counts as a source

This is the question the October change turns on, and it is the least well covered in the review.

Where it works. SEGRO's diversity and inclusion policy places an explicit duty on employees to report harassment witnessed from any third party, giving a customer or contractor as the examples. It is the strongest third party provision we found in any corporate document, and it took three attempts to locate, because it is not in the code of conduct.

Vodafone's external reporting line is explicitly open to contractors, suppliers, joint venture partners and agents. Anglo American's is open to contractors, suppliers and business partners.

Where it fails. None of the ten large employers has a third party provision matching a parish council's for clarity. IAG is the sharpest illustration. Its Flying With Integrity health and safety section says the group does not tolerate actions endangering employees, customers, suppliers or business partners, which frames the employee as a potential source rather than a potential victim. For an airline whose staff spend their working lives in confined spaces with the public, and where the incident type is entirely predictable, that framing is the wrong way round. IAG also publishes an Equity, Diversity and Inclusion Policy that we have not read for this review. If that is where the real harassment provisions sit, the table row would change.

What to check in yours. Two separate things, often confused. Can a third party be the perpetrator, and does your policy say so. Can a third party use your reporting channel. Most policies addressing third parties only do the second.

Model wording worth borrowing. Oakham's structure. State zero tolerance for harassment of an employee by a client, customer or member of the public, then list the remedies available to you, including excluding that person and involving the police. Naming remedies is what makes a manager believe the provision is real, and it is also the part you can later show you acted on.

Question 3: where does it apply

Where it works. Anglo American has the best scope statement among the large employers, covering all global places of work including business trips, all work related events and functions, and social engagements with colleagues, during or outside normal working hours.

Vodafone's definition states harassment can occur outside the workplace, outside working hours, between people of the same sex, and may be a single incident rather than a pattern. That last point is the one most policies miss and the one the new third party liability makes critical.

Lloyds names channels rather than locations: branches, offices, over the phone, and online on social media. For a business with millions of customer interactions across those channels, that is more useful than a generic workplace reference.

Where it fails. IAG says nothing about crew layovers or business trips, which for an airline is where risk concentrates.

What to check in yours. List the settings where your people actually work and socialise, then check each appears. Client sites. Conferences. Overnight stays. The pub after the away day. Teams and WhatsApp. If a setting is not named, a manager will treat it as out of scope, and you will have no evidence anyone was ever told otherwise.

Question 4: what happens on receipt

This is where nearly everything falls down, and it is the question no amount of drafting will close.

Where it works, partially. Barclays' 2026 code, The Barclays Way, instructs a People Leader who receives a concern to listen and follow the raising concerns principles. Halma's worked examples, in its code of conduct, name a specific role to approach, the Talent Partner, and add a second instruction: check your colleague is alright. IAG imposes a duty on a witness to report immediately whether or not the conduct was directed at them, the clearest bystander obligation we found.

Experian puts the reporting instruction inside the harassment section rather than three chapters away, so someone reading about harassment learns where to go without navigating elsewhere. That sounds trivial. It is not. The document is Our Integrity Guide.

Where it fails. Unilever's standalone policy is strong on prohibited conduct, including indirect harassment such as offensive jokes, distributing explicit material, isolating a colleague and spreading malicious rumours. Most policies stop at direct conduct, so this is good drafting. But there is no named reporting route for the employee, no manager duty, no threshold. Line managers are told to provide transparent and confidential procedures for raising concerns. The procedures are not in the document.

HSBC devotes two paragraphs to harassment, both pointing to a Global Anti Bullying and Harassment Code that is not public. The commitment that all allegations are fully investigated is worth something. A colleague wanting to know what to do next cannot read the document that tells them.

Sage is the sharpest contrast in the review. In a 33 page code, harassment appears once, as a single bullet inside the human rights section, positioned between modern slavery due diligence and responsible AI deployment. No definition, no examples, no threshold, and sexual harassment is not named anywhere. Yet the same code prints the Chief People Officer's mobile number, the General Counsel's mobile number, the Audit Committee Chair's email, and free confidential lines for more than thirty countries. An excellent door, and almost nothing about when to walk through it.

What to check in yours. Find the sentence telling a manager what to do in the ten minutes after someone discloses. Not where to file it. What to say. In most policies that sentence does not exist, which means the most consequential moment in your entire process is the one part of it you have never specified and cannot evidence.

The threshold problem

One finding sits outside the four questions and deserves its own treatment, because it is the most common drafting error we saw and the easiest to make with good intentions.

Diageo's code contains a worked question and answer about an intimidating manager. It acknowledges that everyone is different and will have a different tolerance threshold, and states that "yours will be respected".

That is almost certainly written as reassurance. Read as policy, it makes the standard subjective. A manager applying it cannot distinguish a complaint requiring escalation from one that can be handled informally, because the test has become how the individual felt. A second answer compounds it, explaining that an isolated incident may feel disrespectful but may not amount to bullying, without saying what would.

Experian has a milder version: offensive materials are defined as offensive "as perceived by an employee", a subjective clause inside an otherwise objective section.

The fix is not to become harsh. It is to separate two things that reassurance language collapses. Whether someone is entitled to raise a concern should be subjective and generous. Whether conduct breaches the policy should be objective and defined. Say both. Most policies say only the first and leave the second to whoever receives the report, which means the threshold is set privately, differently, by every manager in your organisation, and recorded nowhere.

The Barclays case: what a live rewrite looks like

Barclays replaced its 2022 code with a new edition in July 2026. Comparing the two shows a document being actively rewritten for one regulatory pressure.

What improved. The 2022 code never used the words sexual harassment. The 2026 code names it as the first item in a list of non financial misconduct, alongside unacceptable comments and communications, violence and intimidation, discrimination, retaliation and victimisation. For a bank, that reclassification carries weight, because non financial misconduct is a regulated category with consequences attached. Manager duties strengthened at the same time.

What did not. The 2022 code stated Barclays would not tolerate discrimination, bullying or harassment in relation to employees, clients, customers, contractors, suppliers, other stakeholders and visitors to its premises. That explicit list does not appear in the 2026 edition. Customers and clients now feature in a separate section about service quality.

We are not going to assert why, and nor should anyone else without more information. The 2026 code is half the length of its predecessor and restructured throughout, so this may be consolidation, and the detail may sit in an internal policy portal. The factual position is that the named third party scope was in the old code, is not in the new one, and the new one was published three months before third party harassment became a standalone liability.

The lesson for your own rewrite. If you are shortening a policy this year, check what leaves. Consolidation removes the explicit along with the redundant, and the explicit is what a manager relies on.

Two patterns worth knowing about

The operative document is often not the public one. Six of the ten name an internal harassment policy, standard or code the public cannot read. Twice we initially concluded an organisation had published nothing substantive, then found a full policy elsewhere on their own site. Treat the code of conduct as the summary and go looking for the policy.

US disclosure is opening documents that UK disclosure leaves closed. HSBC publishes a fuller US version of its code with a dedicated harassment section. BAE Systems publishes a standalone anti harassment policy for US employees with no UK equivalent we could find. Haleon references a US harassment free workplace policy, again with no UK counterpart located. Same companies, same year, two audiences.

The evidence problem

Here is the thing that ought to worry a compliance function more than any individual clause.

Suppose you fix all four questions. Your policy names sexual harassment, covers customers and contractors, lists every setting from client sites to WhatsApp, and tells a manager exactly what to do on receipt. It is now a good policy, better than any of the ten we read.

What can you show?

You can show the document. You can show a version history. If you run e-learning, you can show completion rates, which tell you that people clicked through it and nothing about whether they understood it. You may have an acknowledgement form.

That is a thin file to bring to a question about all reasonable steps, and it gets thinner the harder anyone looks, for three reasons.

Almost nobody reads the policy. Not because your people are careless, but because harassment policies are read at induction, once, alongside eleven other documents, by someone whose main concern that week is where the printer is. Publishing a policy is a precondition for taking steps. It is not itself much of a step.

The risk sits in the parts the policy does not resolve. Nobody hesitates over the clear cases. A manager knows what to do when a colleague is assaulted. The hesitation happens in the grey: a client who is charming and persistent, a comment that might have been a joke, a complaint about someone senior, a customer who is a large account. Those are exactly the situations your document leaves open, because they are the situations that are hard to write rules for.

Documents cannot evidence capability. Your policy shows what you told people. It cannot show whether a shift supervisor knows how to respond when someone discloses at the end of a busy Friday. And that response, not the document, is what will be examined if it goes wrong.

A better risk adjusted position closes that gap on both sides. You improve the document, because the four questions are cheap to fix and the drafting is genuinely load bearing. Then you find out whether the people who have to apply it actually can, in the grey cases, before a real one arrives.

That second half produces something a policy never will. A dated record, per person, of how they handled a disclosure. Not that they attended, not that they completed, but what they said when a difficult conversation went sideways, and whether they got better at it. A completion log tells you 94% finished the module. It cannot tell you what anyone said under pressure. If the standard is all reasonable steps, the difference between those two records is the difference between an assertion and an argument.

Reading about a difficult conversation is the theory test. The theory test is not the licence. A training audit that only collects completions already knows this; the five conversations the duty will put on trial are the ones a document cannot sit in for you.

A short self review

Take your policy and answer these in order.

1. Does the phrase "sexual harassment" appear? If not, fix that first.
2. Are customers, clients, contractors, suppliers and visitors named as possible sources, not just as possible reporters?
3. Are your actual settings listed, including trips, socials, client sites and messaging platforms?
4. Is there a sentence telling a manager what to say in the first two minutes after a disclosure?
5. Is the threshold for what breaches the policy stated objectively, separately from the encouragement to raise concerns?
6. Is the document a manager needs actually readable by that manager, or does it point to something behind a login?

Then the question none of the six answers.

7. If you were asked today to show that your managers can handle a disclosure well, what would you produce?

Questions one to three, five and six are drafting. Four is design. Seven is the one that decides whether the rest of it holds up.

Method note: we reviewed publicly available codes of conduct and harassment policies from ten large UK employers, plus comparison documents from easyJet and two parish councils, in September 2026. We worked from each organisation's own policy index and used the current published version of each document. Where we say a provision could not be found, we mean it is not present in the public documents we located, not that no such provision exists internally. Several organisations named here publish internal policies we have not seen, and we say so where it applies. Corrections are welcome from any organisation named. We are not lawyers and this is not legal advice.

Sources

These are the public PDFs. Company names in the article open the same files. Read them if you want to check our scoring.

FAQ

Frequently asked questions

01Does a harassment policy count as a reasonable step?

No. The duty is on steps, not documents. A policy is the opening exhibit when an employer is asked to show it took all reasonable steps, and rarely the persuasive one, because it proves what you wrote rather than what your people can do.

02What four questions should a harassment policy answer?

Whether sexual harassment is named, who counts as a source, where the policy applies, and what the person who receives a disclosure should do. Almost none of the ten large employers we read answered all four.

03Why do parish council policies outperform some corporate ones?

Oakham Town Council names third party harassment, lists remedies a manager can use, and uses the statutory phrase. Ledbury names who is covered and where the policy applies, with examples. A free template is doing the job bespoke corporate drafting often leaves open.

04How do you evidence that managers can handle a disclosure?

A dated record, per person, of how they handled a disclosure under pressure. Completion rates show that people clicked through a module. They cannot show what anyone said when the conversation went sideways.