From Advisory to Audit: What the NCW's 2026 Directive Means for Employer Compliance

On 19 June 2026, the NCW issued a formal advisory to Chief Secretaries and DGPs of all States/UTs (further disseminated to District Magistrates, SSPs and Commissioners of Police), calling for immediate, effective implementation of the POSH Act, 2013 across government, private, organised and unorganised workplaces.

The advisory sets out eighteen action points; the most consequential for employers:

• Mandatory annual POSH audits for establishments with 10+ employees, covering IC functioning, complaints, safety infrastructure and SHe-Box use — non-conduct itself is treated as non-compliance.
• State-Level POSH Monitoring Cells / digital compliance dashboards in every State and UT.
• District Officers notified as nodal authority in every district, backed by Nodal Officers at Block/Tehsil/Taluka/Ward/Municipality level.
• Universal, functional Internal Committees in every Government Department, PSU, Board, Corporation, institution and establishment with 10+ employees.
• Mandatory public disclosure of Committee/grievance details, and protection against retaliation for complainants, witnesses and Committee members.

The Commission frames this as moving "beyond mere compliance" toward a culture of dignity, accountability and safety.

Is it legally binding? The NCW is a statutory advisory body (NCW Act, 1990) and cannot legislate; this advisory is, in form, non-binding. However, several asks restate obligations already enforceable under Section 26, and States may convert recommendations into binding directions under Section 25.

A POSH Audit is a structured, independent review of an establishment's compliance with the POSH Act and its rules — examining both the documentary record and functional reality (IC meetings, employee awareness, complaint timelines) to test whether the framework would withstand regulatory or judicial scrutiny.

Scope of a POSH Audit

• IC/Local Committee validity and functioning (Section 4).
• Statutory complaint-handling timelines (Sections 9–18).
• Employer's affirmative duties — display, training (Section 19).
• Confidentiality safeguards (Section 16) and anti-retaliation protection.
• Physical safety measures — lighting, access control, surveillance, emergency support.
• Mandatory disclosures, SHe-Box registration, annual reporting (Sections 21–22).

Legal and governance rationale

• Statutory exposure: failure to constitute an IC, act on its recommendations, or file annual reports attracts a fine up to Rs. 50,000 (Section 26); repeat defaults double the penalty and risk licence cancellation.
• Corporate disclosure risk: MCA norms (effective 14 July 2025) require Board's Report disclosure of POSH complaint numbers and IC status — an audit builds the evidence base.
• Capital markets exposure: listed entities report POSH compliance under SEBI's LODR.
• Defensibility: a documented audit trail is the strongest evidence of due diligence in any appellate, labour court or writ proceeding.

When does it become mandatory?

The POSH Act does not itself prescribe a periodic audit. The NCW's advisory recommends an annual audit for establishments with 10+ employees, treating non-conduct as non-compliance. Maharashtra (WCD circular, 14–15 May 2026, Section 25) and Haryana (Gurugram ADC checklist) have already converted this into binding instruments. Pending notification elsewhere, employers should treat the annual audit as effectively mandatory.

A POSH audit tests the framework against:

• Section 2: correct identification of 'workplace', 'employee' and 'aggrieved woman'.
• Section 4: IC composition, tenure, independence of external member — the most heavily audited provision.
• Sections 5–8: Local Committee applicability (under-10 employers, domestic workers).
• Sections 9–18: statutory clocks — 3 months to file, 90 days inquiry, 10 days report, 60 days employer action, 90 days appeal.
• Sections 16–17: confidentiality, and penalty for its breach.
• Section 19: employer's duties — display, training, facilitation.
• Sections 21–22: annual reporting by Committee and employer.
• Section 25: power of inspection — basis for State audit drives (e.g., Maharashtra).
• Section 26: penalty for non-compliance — what the audit pre-empts.

This is a single, uniform advisory; implementation on the ground is uneven. Position as of mid-2026:

Separately, the Supreme Court in Aureliano Fernandes v. State of Goa has directed a district-wise IC survey (orders 3 Dec 2024, 12 Aug 2025), results uploaded to SHe-Box — a third converging enforcement strand.

• Governance ownership: treat POSH as a board-level matter given Companies Act/SEBI exposure, not solely HR's.
• Committee health check: confirm valid constitution — woman Presiding Officer, external member, 50%+ women, current seniority.
• Branch-level coverage: constitute Committees at every unit for multi-location employers.
• Inclusive training: cover contractual, security and gig staff, in local languages, with attendance records.
• SHe-Box as default channel: register early — several States treat this as a compliance checkpoint.
• Document 'zero-complaint' filings — a required annual filing, not optional.
• Schedule the audit ahead of the Board's Report/annual filing cycle to allow remediation time.
• Maintain a centralised, access-controlled compliance repository for quick production on inspection.

The NCW's advisory does not amend the POSH Act — it sharpens enforcement and adds one new practice: the annual audit. Read with Maharashtra's and Haryana's instruments, the Supreme Court's oversight in Aureliano Fernandes, and MCA's 2025 disclosure norms, the message for 2026 is clear: POSH compliance is being actively verified.

Management's response: confirm the IC is validly constituted and functional, keep audit-ready records, and conduct an annual audit even absent a State mandate — treating this as genuine governance, not paperwork formality.