The harassment policy benchmark: what ten of Britain's biggest employers actually tell a manager to do

In October 2026 the duty on UK employers changes. "Reasonable steps" becomes "all reasonable steps". A standalone liability arrives for harassment by third parties, and for that one, a single incident is enough.

This piece benchmarks ten large UK employers on four questions that duty makes unavoidable — with particular attention to what each document would leave a manager doing in the moment.

The benchmark

Ten large UK employers, scored on the four questions below. Two comparators — easyJet and Oakham Town Council — show what stronger drafting looks like.

What stands out

easyJet published a bullying and harassment policy in March 2026, written with the incoming duty plainly in view. One sentence does more work than most complete sections elsewhere in the benchmark. It tells employees they are covered whether the behaviour comes from a colleague, a customer or an external party, and whether it happens in the workplace, at a work related event, outside of work, or online.

Questions two and three, settled in a line. If you take one drafting lesson from this piece, take that structure. Source, then setting, both in the same breath rather than scattered across a document.

Now the uncomfortable comparison. The clearest policy in the benchmark was not published by a company.

Oakham Town Council has a handful of staff and no compliance function. Its policy carries a numbered section headed third party harassment. It states zero tolerance for harassment of an employee by a client, customer or member of the public, then does the thing almost nobody else does. It says what happens next: warn the individual, ban them from the premises, report them to the police. It commits to taking all reasonable steps to deter and prevent third party harassment, which is the statutory phrase itself.

Ledbury Town Council is stronger again on scope, naming job applicants, contractors, agency workers and former employees as covered, and naming where the policy applies, with examples given as Christmas parties, leaving celebrations, working lunches and conferences.

The obvious objection is that parish councils are consistent because most adopt the same free model template. That is the finding, not a defence. A free template is outperforming bespoke corporate drafting at organisations employing hundreds of thousands of people. If your policy is weaker than Oakham's, the fix is not expensive.

The four questions

These are not our invention. They fall out of the legislation and the EHRC's technical guidance on the preventative duty. They are also the four things a manager needs answered before they can act.

1. 01Is it named?Does the document use the words sexual harassment, or rely on general language about dignity and respect?Read the findings →
2. 02Who counts as a source?Colleagues only, or also customers, clients, contractors, suppliers, visitors and members of the public?Read the findings →
3. 03Where does it apply?The workplace, or also business trips, work socials, client events, out of hours and online?Read the findings →
4. 04What happens after disclosure?Does the document tell the person who receives a disclosure what to do, or only where to forward it?Read the findings →

Most organisations in the benchmark answer at least one question well. Almost none answer all four. And each unanswered question converts into the same thing: a grey area that a manager will resolve on instinct, with no record of how they resolved it.

How to benchmark fairly

If you compare your policy against a peer, use the document their managers can actually access — not the first PDF a search engine returns. Several employers publish a current code of conduct and a separate harassment policy on their governance index. Search results often surface an older edition.

Six of the ten employers in this benchmark refer staff to an internal harassment policy the public cannot download. Treat the public code as the summary, then look for a standalone bullying-and-harassment or respect-at-work policy on the same index.

Every PDF cited in this piece is linked in Sources. Company names in the article open the same files.

Question 1: is it named

Weak examples. In AstraZeneca's Code of Ethics, the words harassment, sexual harassment, bullying and victimisation do not appear. The nearest provision commits to treating others with fairness, integrity, honesty, courtesy, consideration, respect and dignity. That is a values statement, not a conduct rule. No standalone harassment policy appears in their published library, and the Global Standards the code refers to are not published as a set.

Lloyds names harassment but not sexual harassment in its 2022 Code of Ethics and Responsibility, though it does name specific forms of unacceptable conduct including racist, sexist, homophobic, transphobic and ableist behaviour, which is more than most manage. No later public edition is linked from their policy index.

What it costs you. A manager cannot map what they have just been told onto a policy that does not use the words for it. The common failure is not disagreement about whether conduct was acceptable. It is uncertainty about whether the policy is the relevant one at all. And when that uncertainty is resolved badly, there is nothing in the record showing anyone ever tested whether staff could recognise the conduct in the first place.

Question 2: who counts as a source

This is the question the October change turns on, and it is the least well covered in the benchmark.

Strong examples. SEGRO's diversity and inclusion policy places an explicit duty on employees to report harassment witnessed from any third party, giving a customer or contractor as the examples. It is the strongest third party provision in the benchmark — and it is not in the code of conduct.

Vodafone's external reporting line is explicitly open to contractors, suppliers, joint venture partners and agents. Anglo American's is open to contractors, suppliers and business partners.

Weak examples. None of the ten large employers has a third party provision matching a parish council's for clarity. IAG is the sharpest illustration. Its Flying With Integrity health and safety section says the group does not tolerate actions endangering employees, customers, suppliers or business partners, which frames the employee as a potential source rather than a potential victim. For an airline whose staff spend their working lives in confined spaces with the public, and where the incident type is entirely predictable, that framing is the wrong way round. IAG also publishes a Group Diversity & Inclusion Policy (Board approved December 2025). It commits to not tolerating discrimination or harassment, directs concerns to a manager, HR, or the operating-company Speak Up hotline, and protects anyone who reports from retaliation including bullying, victimising and harassing. Sexual harassment is not named. Customers and passengers do not appear as possible sources of harassment against staff. There is no scope beyond the workplace and nothing on what a manager should say in the first minutes after a disclosure. The policy directs readers to Flying With Integrity for conduct detail.

Model wording worth borrowing. Oakham's structure. State zero tolerance for harassment of an employee by a client, customer or member of the public, then list the remedies available to you, including excluding that person and involving the police. Naming remedies is what makes a manager believe the provision is real, and it is also the part you can later show you acted on.

Question 3: where does it apply

Strong examples. Anglo American has the best scope statement among the large employers, covering all global places of work including business trips, all work related events and functions, and social engagements with colleagues, during or outside normal working hours.

Vodafone's definition states harassment can occur outside the workplace, outside working hours, between people of the same sex, and may be a single incident rather than a pattern. That last point is the one most policies miss and the one the new third party liability makes critical.

Lloyds names channels rather than locations: branches, offices, over the phone, and online on social media. For a business with millions of customer interactions across those channels, that is more useful than a generic workplace reference.

Weak examples. IAG says nothing about crew layovers or business trips, which for an airline is where risk concentrates.

Question 4: what happens after disclosure

This is where nearly everything falls down, and it is the question no amount of drafting will close.

Strong examples (partial). Barclays' 2026 code, The Barclays Way, instructs a People Leader who receives a concern to listen and follow the raising concerns principles. Halma's worked examples, in its code of conduct, name a specific role to approach, the Talent Partner, and add a second instruction: check your colleague is alright. IAG imposes a duty on a witness to report immediately whether or not the conduct was directed at them, the clearest bystander obligation in the benchmark.

Experian puts the reporting instruction inside the harassment section rather than three chapters away, so someone reading about harassment learns where to go without navigating elsewhere. That sounds trivial. It is not. The document is Our Integrity Guide.

Weak examples. Unilever's standalone policy is strong on prohibited conduct, including indirect harassment such as offensive jokes, distributing explicit material, isolating a colleague and spreading malicious rumours. Most policies stop at direct conduct, so this is good drafting. But there is no named reporting route for the employee, no manager duty, no threshold. Line managers are told to provide transparent and confidential procedures for raising concerns. The procedures are not in the document.

HSBC devotes two paragraphs to harassment, both pointing to a Global Anti Bullying and Harassment Code that is not public. The commitment that all allegations are fully investigated is worth something. A colleague wanting to know what to do next cannot read the document that tells them.

Sage is the sharpest contrast in the benchmark. In a 33 page code, harassment appears once, as a single bullet inside the human rights section, positioned between modern slavery due diligence and responsible AI deployment. No definition, no examples, no threshold, and sexual harassment is not named anywhere. Yet the same code prints the Chief People Officer's mobile number, the General Counsel's mobile number, the Audit Committee Chair's email, and free confidential lines for more than thirty countries. An excellent door, and almost nothing about when to walk through it.

The threshold problem

This sits outside the four questions and deserves its own treatment, because it is the most common drafting error in the benchmark and the easiest to make with good intentions.

Diageo's code contains a worked question and answer about an intimidating manager. It acknowledges that everyone is different and will have a different tolerance threshold, and states that "yours will be respected".

That is almost certainly written as reassurance. Read as policy, it makes the standard subjective. A manager applying it cannot distinguish a complaint requiring escalation from one that can be handled informally, because the test has become how the individual felt. A second answer compounds it, explaining that an isolated incident may feel disrespectful but may not amount to bullying, without saying what would.

Experian has a milder version: offensive materials are defined as offensive "as perceived by an employee", a subjective clause inside an otherwise objective section.

The fix is not to become harsh. It is to separate two things that reassurance language collapses. Whether someone is entitled to raise a concern should be subjective and generous. Whether conduct breaches the policy should be objective and defined. Say both. Most policies say only the first and leave the second to whoever receives the report, which means the threshold is set privately, differently, by every manager in your organisation, and recorded nowhere.

The Barclays case: what a live rewrite looks like

Barclays replaced its 2022 code with a new edition in July 2026. Comparing the two shows a document being actively rewritten for one regulatory pressure.

What improved. The 2022 code never used the words sexual harassment. The 2026 code names it as the first item in a list of non financial misconduct, alongside unacceptable comments and communications, violence and intimidation, discrimination, retaliation and victimisation. For a bank, that reclassification carries weight, because non financial misconduct is a regulated category with consequences attached. Manager duties strengthened at the same time.

What did not. The 2022 code stated Barclays would not tolerate discrimination, bullying or harassment in relation to employees, clients, customers, contractors, suppliers, other stakeholders and visitors to its premises. That explicit list does not appear in the 2026 edition. Customers and clients now feature in a separate section about service quality.

We are not going to assert why, and nor should anyone else without more information. The 2026 code is half the length of its predecessor and restructured throughout, so this may be consolidation, and the detail may sit in an internal policy portal. The factual position is that the named third party scope was in the old code, is not in the new one, and the new one was published three months before third party harassment became a standalone liability.

The lesson for your own rewrite. If you are shortening a policy this year, check what leaves. Consolidation removes the explicit along with the redundant, and the explicit is what a manager relies on.

Several employers in the benchmark publish fuller harassment provisions for US employees than for UK ones. HSBC publishes a fuller US version of its code with a dedicated harassment section. BAE Systems publishes a standalone anti harassment policy for US employees with no UK public equivalent on its site. Haleon references a US harassment free workplace policy, again with no UK counterpart located. If your organisation maintains territory-specific versions, check which document your UK managers are expected to use.

Part two: what the benchmark cannot show

Fix all four questions and you still have only half a file.

A refreshed policy is a precondition for all reasonable steps. It is not, by itself, evidence that you took them. The same is true of turning that policy into e-learning. In Allay v Gehlen, the employer pointed to anti-harassment training — but the tribunal treated it as stale, formulaic, and ineffective. Completion was not competence. The case is a reminder that “we published something” and “we ran a module” are assertions. A regulator, a tribunal, or a board asking what you did needs dated proof that people could apply the policy when the moment was live.

That is the gap drafting alone cannot close. The sections above fix the document. They do not show whether a shift supervisor knows what to say when someone discloses at the end of a busy Friday — in the grey cases your policy cannot fully script: a client who is charming and persistent, a comment that might have been a joke, a complaint about someone senior.

Scenario-based practice is the step that changes behaviour and produces evidence. Research on workplace learning consistently ranks realistic practice above passive formats for skill transfer. For conduct risk, it is also the only format that generates a record of what someone actually said under pressure — not what they clicked through in a calm room.

That is what Real Talk Studio is built for.

Try the disclosure moment

This is the conversation question four in this benchmark asks managers to handle: someone reports sexual harassment and pushes back when you take it seriously.

No login. Under ten minutes. At the end you get the same artefact your programme would keep: a scored transcript, policy adherence, and coaching on what to do differently next time — not a grade, a development record.

From your policy to a scenario

You do not need to invent the grey cases from scratch. Read your harassment policy the way a manager would apply it under pressure — where the wording leaves someone guessing — and turn each gap into something people can practise.

Our Conversation Risk Assessment does that read for you. Upload a policy (or paste text), select the Sexual harassment policy — all reasonable steps review lens, and it surfaces the hesitations: unnamed sources, missing settings, no script for the first two minutes after disclosure. Each finding becomes a scenario your people can run, scored against your conduct standards rather than a generic template.

The Simulation Builder then lets you generate custom scenarios from your own policies and language in minutes — same evidence output at the end.

What you get back — and why it links to risk assessment

Your risk assessment should name the roles and environments where harassment is most likely and where a bad first response does most damage. Practice data closes the loop: who in those roles has rehearsed the conversation, who has not, and where behaviour still misses the policy.

At programme level, studio analytics roll that up into the three measures a compliance file actually needs:

• Competence — scored performance in the moment, not quiz recall
• Confidence — pre/post shift on whether someone will act
• Compliance — adherence to linked policies under pressure, with violations, misses, and correct responses counted separately

app.realtalkstudio.com/admin/studios/…/analytics

That is behavioural evidence you can tie to a named role, a dated attempt, and a risk assessment row. It does not replace the policy refresh. It stops the training row in your reasonable steps checklist from being a completion percentage with nothing behind it.

A short self review

Take your policy and answer these in order.

1. Does the phrase "sexual harassment" appear? If not, fix that first.
2. Are customers, clients, contractors, suppliers and visitors named as possible sources, not just as possible reporters?
3. Are your actual settings listed, including trips, socials, client sites and messaging platforms?
4. Is there a sentence telling a manager what to say in the first two minutes after a disclosure?
5. Is the threshold for what breaches the policy stated objectively, separately from the encouragement to raise concerns?
6. Is the document a manager needs actually readable by that manager, or does it point to something behind a login?

Then the question none of the six answers.

7. If you were asked today to show that your managers can handle a disclosure well, what would you produce?

Questions one to three, five and six are drafting. Four is design. Seven is the one that decides whether the rest of it holds up.

Method note: we reviewed publicly available codes of conduct and harassment policies from ten large UK employers, plus comparison documents from easyJet and two parish councils, in September 2026. We worked from each organisation's own policy index and used the current published version of each document. Where we say a provision could not be found, we mean it is not present in the public documents we located, not that no such provision exists internally. Several organisations named here publish internal policies we have not seen, and we say so where it applies. Corrections are welcome from any organisation named. We are not lawyers and this is not legal advice.

Sources

These are the public PDFs. Company names in the article open the same files.

FAQ

Frequently asked questions

01Does a harassment policy count as a reasonable step?

No. The duty is on steps, not documents. A policy is the opening exhibit when an employer is asked to show it took all reasonable steps, and rarely the persuasive one, because it proves what you wrote rather than what your people can do.

02What four questions should a harassment policy answer?

Whether sexual harassment is named, who counts as a source, where the policy applies, and what the person who receives a disclosure should do. Almost none of the ten large employers in the benchmark answered all four.

03Why do parish council policies outperform some corporate ones?

Oakham Town Council names third party harassment, lists remedies a manager can use, and uses the statutory phrase. Ledbury names who is covered and where the policy applies, with examples. A free template is doing the job bespoke corporate drafting often leaves open.

04How do you evidence that managers can handle a disclosure?

A dated record, per person, of how they handled a disclosure under pressure. Completion rates show that people clicked through a module. They cannot show what anyone said when the conversation went sideways.