Harassment protection bill highlights importance of workplace risk assessments

A new Private Members’ Bill that would place a legal duty on employers to conduct risk assessments to prevent workplace harassment is set for its second reading in the Commons on 7 March. If passed, it would amend the Health and Safety at Work Act to explicitly require risk assessments for workplace violence and harassment, particularly gender-based violence. Like most Private Members’ Bills it is unlikely to become law but, importantly, it reflects a shift in expectations showing that risk assessments are increasingly seen as an essential tool in preventing harassment. We’ll speak to a health and safety expert about conducting risk assessments and where responsibility for them lies.

A reminder. Employers already have a general duty under health and safety law to identify and mitigate risks to health, safety, and welfare, and that arguably includes the risk of workplace harassment. But while risk assessments are a well-established tool in health and safety management, they are not yet a specific legal requirement for workplace harassment. That is what this new Bill seeks to change. If passed, it would require all employers to conduct risk assessments focused on workplace violence and harassment, rather than simply leaving it to their discretion as part of broader compliance with health and safety duties. The Bill also proposes that the Health and Safety Executive  take a more active role by developing and publishing guidance to help employers meet this obligation. It’s an approach which our health and safety team believe is unnecessary as they explain in their Out-Law article.

The new Bill comes just months after a separate legal duty to prevent sexual harassment in the workplace came into force on 26 October 2024. That duty already requires employers to take proactive steps to prevent harassment, but it does not explicitly require risk assessments. Instead, it expects employers to take reasonable steps. which could include risk assessments but does not mandate them.

So while the new Bill would formalise the requirement, it does not change the core expectation that employers should already be identifying and mitigating the risks of workplace harassment. That raises a practical question who within an organisation should take responsibility for harassment risk assessments? 

The Equality and Human Rights Commission published guidance a month before the new duty to prevent harassment came into force but it doesn’t go as far as directing who within the business should take responsibility for the risk assessment, nor how it should be conducted. So, is it a responsibility for HR or one for health and safety and does this new duty to prevent sexual harassment fall within the scope of health and safety, or not? It’s a question I put to health and safety expert Zoe Betts:

Zoe Betts: “Well, that’s a really interesting question, Joe, and I think if I had to get off the fence and give an answer it is yes, but I don't think that this new duty in any way extends an employer's duty under the Health and Safety at Work Act. I think the employer has always had a duty to reasonably foresee risks to employees’ health, safety and welfare and then take reasonable measures to either eliminate or guard against those risks. So, yes, risk of harassment does fall within the scope of an employer's health and safety duty but I think, really, this is primarily a piece of HR law and I think, at its worst, if there was a serious incident of sexual harassment, or assault, then the HSE, Health and Safety Executive would not be the right regulator. I think they would defer to the police in that occasion. So yes this is a health and safety issue, but I think more it's an employment issue, and where I foresee there being relevance from health and safety professionals is that they could assist their HR colleagues to do a risk assessment because that, as I understand it, is really the starting point for an employer being able to evidence that they've understood that they've got this positive duty, and they've taken the right steps to discharge it.”

Joe Glavina: “Can you just explain what a risk assessment involves in practice, in broad terms?”

Zoe Betts: “Yes. A risk assessment, certainly in in health and safety terms, has to be suitable and sufficient. So it's got to be comprehensive, but I don't want people to believe that a risk assessment is actually a piece of paper. A risk assessment is a thought process. A risk assessment is an exercise in foresight. Ultimately, if you have more than five employees, under health and safety law you do have to reduce the significant findings to writing but actually what's more important, in my view, is that process that has been gone through mentally to understand what are the foreseeable risks here and, therefore, what are the reasonable measures? This is not about perfection, this is about reasonable measures that we could take as an employer to either eliminate those risks altogether, or if that's not possible, to reduce the risk to as low a level as is possible and that risk assessment process, I think, with this particular duty, the positive duty to prevent sexual harassment, really sits with the HR professionals. They will understand those issues and those risk factors facing the workforce, but working with a health and safety professional, they will understand how to conduct a risk assessment and how to reduce those significant findings into writing. But the really important point as well, as far as I'm concerned, is that a risk assessment is not simply a means to an end. It is not a process which, once finished, can be filed away either on the internet or on a shelf somewhere. A risk assessment is really a blueprint for action so an employer has to then implement those reasonable controls in order to do what it's trying to do, which is prevent the sexual harassment in the workplace.”

Joe Glavina: “Just thinking about what you end up with when you've got a risk assessment completed, Zoe. What does it look like? Is it a document?” 

Zoe Betts: “Yes, it is generally a document, and it will often have a table, so there will often be columns relating to the risks, or the hazards, in the workplace. What are we identifying as those hazards? What is the likelihood of that happening? It is the hazard and the likelihood that then determines the risk. What is the extent of the risk? Is it a high risk or a low risk? So we can start to put things into their proper context. You also have to identify the people that may be put at risk. So is this employees only? Is it particular categories of employees? Is it trainees, for example, or is it third parties? Is it contractors? Is it visitors? Is it clients? So you start to have a column identifying who might be at risk and then, ultimately, what's most important, is this column for reasonable controls. What do we believe we can do, reasonably, to eliminate or guard against these risks? Examples of controls here could be putting in place a policy, putting in place a procedure, making sure that we've got proper training and we've briefed out those policies and procedures, making sure that we've got a proper complaints hotline, or some sort of whistleblowing mechanism, so that people can speak out if they've been the subject of sexual harassment in the workplace. So, those are the sorts of controls that will ultimately be reduced into a table, a risk assessment table, and I'm not a fan of people over engineering this process. I don't like seeing risk assessments which are so complicated that actually, on the face of it, it's difficult to understand what the risk is and what you're intending to do to reduce that risk. This should be a relatively straightforward, common-sense, document written in layman's terms which can then, as I say, act as the spur for action to be taken.”

Joe Glavina: “The Equality and Human Rights Commission has made it very clear in their guidance, Zoe, that they do expect employers to prepare a risk assessment but then, of course, you have to make sure you implement it. So it’s something of a hostage to fortune? You could, if you’re not careful, shoot yourself in the foot.”

Zoe Betts: “You very much have and I do like the phrase hostage to fortune because that's exactly what a good risk assessment could be because you are very clearly identifying a reasonably foreseeable risk to somebody's health, safety and welfare. You are then identifying a range of reasonable controls which you believe are capable of being implemented. If you then fail to do so, you have absolutely shot yourself in the foot because you're on notice of a risk, you've identified a way in which you could have dealt with it, but you've simply not done it and it will be difficult to justify that after the event. So, I always urge my clients to act upon their risk assessments. These are not documents that should exist in isolation, they are documents which have to live and breathe within the organisation.”

Joe Glavina: “Final point Zoe. Given that this is probably the first time that many HR professionals will have had responsibility for a risk assessment, I guess the key thing for them to do is to go along to their health and safety colleagues and get help from them?” 

Zoe Betts: “Yes, absolutely and I'm sure many health and safety professionals would welcome that. You know, they are experts in health and safety and they're experts in conducting risk assessments so they’ll be very grateful to pass on that knowledge and some of their wisdom. I've been talking for many years, and you've interviewed me on HRTV about mental health, and I think this is another one of those crossover issues where actually HR professionals and health and safety professionals have got a lot in common and, in fact, maybe the starting point for the risk assessment for the duty to prevent sexual harassment could be the risk assessment for work-related stress. There's a wealth of guidance on the HSE’s website. There are template risk assessments about preventing work-related stress and I can see some real crossover there, and the dialog between HR and H&S professionals will be a rich one and will be a very worthwhile conversation. In fact, I think there is a danger in HR professionals trying to go it alone when actually there is already a body of information within their organisation, within the health and safety team, that could be very usefully mined.”

Zoe mentioned there is a wealth of guidance on the HSE website. There is, and we’ve put a link to that guidance in the transcript of this programme for you. We’ve also included a link to the Out-Law article by our health and safety team commenting on the Bill. 

- Link to HSE guidance on managing risk and risk assessments

- Link to Out-Law article: ‘Bill seeks to improve UK workplace violence and harassment protections’