Sexual harassment risk assessment: how to carry out one

A sexual harassment risk assessment reviews where, when and to whom sexual harassment could happen at work, and how you’ll reduce that risk. It isn’t a standalone legal requirement today, but the Equality and Human Rights Commission (EHRC) expects employers to assess risk, and it’s some of the clearest evidence you’ve taken all reasonable steps.

This guide covers the risk factors, a six-step method and how to keep the assessment current.

Why does a sexual harassment risk assessment matter now?

A risk assessment matters because the legal bar is rising, and assessing risk is how you show you’ve met it. Since 26 October 2024, section 40A of the Equality Act 2010 has required employers to take reasonable steps to prevent sexual harassment of employees. From 30 October 2026, section 20 of the Employment Rights Act 2025 raises that to all reasonable steps.

That means showing there was nothing further you could reasonably have done. You can’t show that without first working out where the risks are. For the wider picture, see our guide to sexual harassment at work.

The EHRC already treats risk assessment as core component of preventing sexual harassment at work. Step three of its eight-step guide for employers is to assess and reduce risk in your workplace.

The need is real, according to ONS data cited by the UK government. In the year ending March 2025, 22.5% of people who experienced in-person sexual harassment experienced it at their place of work.

What are the risk factors for sexual harassment at work?

The main risk factors are power imbalances, isolation, public contact, alcohol, travel, late and online working, insecure roles, unbalanced teams, culture and physical layout. Most workplaces have several factors, and they can occur in combination with each other.

How to run a sexual harassment risk assessment in 6 steps

To run a sexual harassment risk assessment, gather evidence, identify who’s at risk, rate each risk, decide controls, record owners and dates, and review regularly.

Step 1: Gather the evidence

Start with what you already know. Pull together complaints and grievances, staff surveys, exit interviews, incident and near-miss reports, sickness and turnover patterns, and customer feedback about staff treatment. Near misses count: an uncomfortable comment nobody reported can tell you as much as a grievance.

“Treating 'near misses' seriously starts with building employee trust, and that comes down to how we take care of their information,” says Eliseo Pithey-Street, people relations manager at Ciphr. “Here at Ciphr, we use role-based access controls within Ciphr HR software to ensure sensitive employee records and confidential notes are strictly ring-fenced to the appropriate personnel. When managers and employees know that their information is only seen by people who truly need it, they feel far more confident in how the organisation takes care of them.” 

Step 2: Identify who is at risk and how

Work through the risk factors above for each team, site or role. Ask who could be harmed, by whom, and in what situation. Include agency workers, contractors and volunteers, and remember sexual harassment can overlap with harassment related to race, sexual orientation or disability.

Step 3: Evaluate likelihood and impact

Rate each risk as low, medium or high. Likelihood rises where incidents have already happened or the situation comes up often. Impact rises where people are isolated, junior or dependent on the person involved. Don’t treat a low number of reports as low risk on its own.

Step 4: Decide on controls

Remove the risk where you can, reduce it where you can’t, then back it up with sexual harassment training and clear reporting routes. For each risk, ask: is there anything further we could reasonably do? What’s reasonable depends on factors such as your size, resources and the level of risk, so record why you chose each control.

Step 5: Record it, assign owners and set dates

Write down your findings, the agreed actions, who owns each one and when it’s due. A risk assessment without owners is a document, not a plan. Cross-check your plan with the EHRC’s checklist and action plan.

Step 6: Review at set intervals and after incidents or changes

Set a review date when you sign off the assessment, and review sooner when something changes. Timing is discussed in more detail below.

Training is one of the controls most assessments point to. Ciphr’s sexual harassment course takes around 20 minutes and includes a third-party harassment scenario reflecting the 30 October 2026 change.

How should you involve employees in a sexual harassment risk assessment?

Involve employees by asking them directly where they feel unsafe, through channels where they can answer honestly. Step two of the EHRC guide is to engage your staff through one-to-ones, surveys and exit interviews. The people doing the work know where the late shifts, awkward clients and closed doors are.

• Run a short anonymous survey that asks about specific situations
• Hold small group discussions led by someone outside the line management chain
• Talk to trade union or staff representatives and employee networks
• Hear from higher-risk groups, such as junior staff, agency workers and night teams, and tell everyone what you’re changing
  

 Since 6 April 2026, a disclosure that sexual harassment is likely to occur can be a protected disclosure. That should reassure staff who raise a risk. 

How often should you review a sexual harassment risk assessment?

Review your sexual harassment risk assessment at least once a year, and straight away after a complaint, an incident or a significant change. There’s no fixed legal interval, but regular reviews fit in step eight of the EHRC guide (monitor and evaluate). Triggers for an early review include:

• A complaint, incident or near miss
• A restructure, new site, new shift pattern or move to remote working
• A new client contract or a major work event
• New regulations under section 22, or updated EHRC guidance

How does a risk assessment link to your policy and training?

Your risk assessment tells you what your policy and training need to cover. If you find risks from customers, your sexual harassment policy should say how you’ll deal with third-party harassment. If you find risks at events, it should cover conduct at work socials.

Target training at the risks you’ve found: managers who handle reports, teams who face the public, and leaders who set the tone. TUC Cymru found 36% of workers in Wales had received no training on recognising or reporting sexual harassment. Our guide to sexual harassment prevention training explains what good training covers.

“Under the Worker Protection Act, having a policy isn't enough - employers must demonstrate that they took 'all reasonable steps' to prevent sexual harassment,” says Pithey-Street. “Here at Ciphr, we use our own learning platform, Ciphr LMS, to streamline the entire administrative side of that duty. We don't need to spend our time chasing spreadsheets, and if there's ever an issue we have a verifiable, timestamped piece of evidence that our employees completed relevant training.”

FAQs: sexual harassment risk assessment

A risk assessment shows you where harassment could happen. Training gives your people the confidence to recognise it, stop it and report it.

This article is not legal advice. If you need legal advice, consult a qualified employment law expert.