SEBI POSH Disclosure & BRSR Principle 5: The Complete Listed-Company Filing Guide

What Is SEBI POSH Disclosure?

SEBI POSH disclosure is the mandatory reporting of Prevention of Sexual Harassment (POSH) Act, 2013 compliance data by listed companies in their Annual Report. It sits within the Business Responsibility and Sustainability Report (BRSR) under Principle 5 (Human Rights), and covers Internal Committee (IC) constitution, complaints received, complaints resolved, and complaints pending beyond 90 days. Regulation 34(2)(f) of SEBI LODR makes this filing mandatory for the top 1,000 listed companies by market capitalisation from FY 2022-23 onwards.

Since FY 2024-25, BRSR reporting has expanded to include specific disclosures tied to the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 and Rules, 2013. The disclosure is filed with stock exchanges (BSE and NSE) in both PDF and machine-readable XBRL formats, alongside audited financial statements. For the top 500 listed companies (FY 2025-26), the disclosure now attracts BRSR Core reasonable assurance by an independent third-party assurance provider — meaning your POSH data will be independently audited, not merely disclosed. Regalwhiz drafts the exact disclosure narrative and tabular format used by leading Nifty 500 companies, coordinated between advocates, the Company Secretary, and the audit committee.

The Governing Framework

Three distinct legal instruments sit behind every SEBI POSH disclosure. Understanding how they interact is the difference between a defensible filing and one that invites SEBI show-cause notices.

The POSH Act, 2013 creates the substantive compliance obligation — every employer with 10 or more employees must constitute an Internal Committee, adopt a policy, conduct training, and complete inquiries within 90 days. The POSH Rules, 2013 (Rule 14) prescribe the format of the annual report filed with the District Officer by 31 January each year. This is a separate obligation from BRSR filing.

SEBI (LODR) Regulations, 2015, specifically Regulation 34(2)(f), require listed companies to include BRSR as part of the Annual Report. SEBI's Annexure II to the July 2023 circular (SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122) prescribes the exact BRSR format, and the December 2024 Industry Standards issued jointly by ASSOCHAM, FICCI and CII (per SEBI notification) standardise BRSR Core disclosure formats. Section (C) of Schedule V, item 10(i) of LODR additionally mandates disclosure in the Corporate Governance Report — which must reconcile with the BRSR Principle 5 numbers.

The Companies Act, 2013 (Section 134) requires every applicable company to include POSH-related information in the Board Report. This obligation was significantly expanded by the July 2025 amendment to the Companies (Accounts) Rules, 2014 — bringing more detailed workforce composition and complaint data into the Board Report. For listed companies, the Board Report data must exactly match the BRSR Principle 5 numbers. Inconsistencies between these two filings are among the top three findings raised by BRSR Core assurance providers.

Who Must File SEBI POSH Disclosure?

BRSR (with POSH disclosure) is mandatory for the top 1,000 listed companies in India by market capitalisation on stock exchanges. The obligation is measured on 31 March of each financial year. Companies moving in and out of the top 1,000 during the year continue to file for the year in which they were covered on the reference date. Beyond the top 1,000, BRSR remains available as a voluntary disclosure — and increasingly expected by institutional investors, banks, and multinational customers who use BRSR data in supplier onboarding.

The BRSR Core assurance obligation — independent third-party audit of a subset of ESG KPIs including certain Principle 5 metrics — is being phased in on this glide path:

If your listed company is in the top 500 by market cap, your FY 2025-26 POSH disclosure will face third-party assurance for the first time this filing cycle. This changes the operational bar — you now need not just a disclosure narrative but a defensible evidence trail behind every number.

The Economic Times reported that India's top 30 listed companies collectively recorded 958 sexual harassment complaints in FY 2024-25, up from 902 in FY 2023-24 — a 6.2% year-on-year increase. This upward trend means the assumption of "quiet POSH years" is no longer available to CS teams; assurance providers now expect complaint numbers to move materially, not remain static.

BRSR Principle 5 POSH Disclosure Format

Principle 5 of BRSR — "Businesses should respect and promote human rights" — is where POSH data lives. The format is prescribed in SEBI's Annexure II to the July 2023 circular and standardised further in the December 2024 Industry Standards. Under Essential Indicators of Principle 5, the disclosure includes a specific table titled "Complaints on Sexual Harassment" with current-year and prior-year data. The format resembles the illustration below:

Beyond the numeric table, Principle 5 requires disclosure of the mechanism to prevent adverse consequences to complainants, IC awareness of complainants' identity protection, and whether the company has a policy against sexual harassment covering employees, workers, and value-chain partners. Companies are also required to disclose, under Leadership Indicators, information on training coverage for the workforce and value-chain partners — POSH training percentages by workforce category.

Corporate Governance Report disclosure under Section (C), Schedule V, item 10(i) of LODR requires a separate parallel entry — number of complaints filed, disposed of, and pending as at end of financial year. This is the same universe of numbers as BRSR Principle 5, but formatted differently. Any mismatch between the two flags the disclosure for scrutiny. Regalwhiz maintains one reconciled dataset that flows into all three filings — BRSR, Corporate Governance Report, and Board Report — so the numbers are provably identical.

BRSR vs BRSR Core — POSH Perspective

The two are often confused. BRSR is the full disclosure document filed by every top-1,000 listed company as part of the Annual Report — 140 questions across nine principles, split into 98 Essential and 42 Leadership Indicators. BRSR Core is a smaller subset — 49 KPIs — that must additionally undergo independent third-party assurance. For POSH, the practical difference is:

For companies newly falling into the BRSR Core assurance bracket, we recommend a pre-assessment audit 60-90 days before the assurance provider's fieldwork begins. This catches issues — improper IC constitution, missing IC minutes for prior quarters, un-empanelled external members, incomplete complaint register entries — while they can still be fixed without escalating to the audit committee.

How to File SEBI POSH Disclosure: Step-by-Step

Follow this six-step process to file a defensible SEBI POSH disclosure. Regalwhiz executes each step for our retainer clients, but the workflow is the same whether we run it or your internal team does.

1. Compile IC data for the FY. Complaints received, resolved, pending beyond 90 days — plus prior-year comparatives in the same format.
2. Prepare the annual report in the prescribed format per Rule 14 of the POSH Rules for District Officer filing.
3. Draft BRSR Principle 5 disclosure in the Annexure II format with narrative and comparative table.
4. Route through CS and audit committee with reconciliation memo showing BRSR = Corporate Governance Report = Board Report numbers.
5. For BRSR Core companies, coordinate with the assurance provider — provide IC minutes, appointment letters, training records and complaint register within their pre-fieldwork checklist.
6. File with stock exchanges in PDF and XBRL by the Annual Report deadline (typically within 60 days of FY end, i.e., 30 May for FY ending 31 March).

BRSR Core Assurance — What Assessors Actually Check

SEBI requires BRSR Core assurance providers to be structurally independent of the company, its statutory auditor, and its consultants. In our experience across FY 2024-25 assurance cycles, the following are the top areas assessors scrutinise on the POSH front:

• IC constitution proof — appointment letters, board resolutions and Order in Writing under Section 4(2) of the POSH Act
• External Member credentials and independence — no vendor relationship, no retainer, no panel counsel appointment
• Minimum women representation — at least 50% of IC as women members, chaired by a senior woman employee
• IC minutes for every quarter — even when no complaint was received, meetings must be minuted quarterly
• Complaint register entries — chronological intake log, unique case IDs, closure dates and inquiry report references
• 90-day inquiry compliance — evidence that inquiries concluded within statutory timeline; extensions properly documented
• Confidentiality undertakings — signed by every IC member as required under Section 16 of the Act
• Annual training coverage — attendance sheets, content records, coverage % by employee category
• Prior-year data consistency — comparative numbers must reconcile with previous filings

A single material gap can trigger a Qualified Assurance Report, which flows directly into your BRSR disclosure and becomes visible to institutional investors, ESG rating agencies, and (post-FY 2026-27) all Indian public equity investors. Once qualified, the remediation cost typically runs 5-10x the cost of getting the disclosure right the first time.

The "Zero Complaints" Trap

Historically, a "Zero Complaints" disclosure was viewed positively. From 2026 onwards, it is a red flag. ESG auditors, BRSR Core assessors, institutional investors, and even proxy advisory firms increasingly treat zero-complaint years as an indicator of suppressed reporting culture rather than compliance excellence. The reasoning is empirical — organisations with adequate awareness training, accessible IC channels, and functioning whistleblower protection typically see complaint numbers rise before they stabilise, not stay static at zero.

If your company has legitimately had zero complaints in the reporting FY, the disclosure must be accompanied by qualitative narrative substance demonstrating that the IC is active, accessible, and known to the workforce. This includes: quarterly IC meetings held even without complaints, annual training coverage percentages, third-party helpline availability, whistleblower policy linkage to POSH, IC contact details displayed prominently, and awareness campaign records. Regalwhiz drafts defensible zero-complaint narratives that satisfy audit committees without inviting suspicion from assurance providers or investors.

Documents & Evidence Trail Required

Before drafting begins, we help you assemble the paperwork that assurance providers, auditors, and (if it comes to it) SEBI investigators will expect on file:

• IC Constitution Order with member details, dated Order in Writing under Section 4(2) of POSH Act
• IC member appointment letters and acceptance letters for the FY
• External Member credential proof — NGO empanelment certificate or Bar Council enrolment
• Quarterly IC meeting minutes for the FY (whether or not complaints were received)
• Complaint register with intake, hearings, resolution status, and closure dates
• Individual case files with confidentiality undertakings and inquiry reports (retained under privileged storage)
• Annual training records — attendance sheets, session content, coverage by category
• Board-approved POSH Policy — latest version with date of adoption
• Prior-year Annual Report POSH data for comparative reporting
• Rule 14 annual report filed with District Officer with acknowledgement
• Workforce composition data — gender split by employee/worker/contractor for the FY

External Member Independence — The Silent Disclosure Killer

Under Section 4(2)(c) of the POSH Act, every IC must include one External Member from an NGO working on women's issues, or a person familiar with issues relating to sexual harassment (typically a legal professional). From 2026, BRSR Core assessors treat External Member independence as a critical governance red flag under Principle 5. If your External Member is any of the following, the IC constitution can be deemed structurally compromised — potentially invalidating the entire committee's actions under the POSH Act:

• A panel lawyer on retainer for the company on other matters
• A consultant currently engaged by the company for HR, legal, or compliance work
• A vendor supplying goods or services to the company
• A person receiving fees from the company outside the POSH sitting fee
• A relative of any employee, director, or promoter of the company

This creates a real conflict for many listed companies — the External Member they've had for years may fail today's independence standards. Regalwhiz provides genuinely independent External Members from empanelled NGOs and Bar Council enrolled advocates with zero vendor relationship. This preserves both statutory validity and BRSR Core assurance outcomes.

Board Report Reconciliation (Section 134)

Under Section 134 of the Companies Act, 2013 read with the Companies (Accounts) Rules, 2014, every applicable company must include POSH compliance data in its Board Report. The July 2025 amendment to the Companies (Accounts) Rules — effective 14 July 2025 — significantly expanded this disclosure to include detailed workforce composition and complaint data, closing the earlier ambiguity where companies disclosed POSH data in different formats.

For listed companies, the Board Report data must exactly match the BRSR Principle 5 numbers. Inconsistencies between the two filings are among the top three findings raised by BRSR Core assurance providers, and they always trigger audit committee scrutiny. The reconciliation should also cover Corporate Governance Report data (Section C, Schedule V, item 10(i) of LODR) — meaning three filings must carry identical numbers: BRSR Principle 5, Board Report (Section 134), and Corporate Governance Report. Regalwhiz manages a single reconciled source of truth to feed all three.

Filing Deadlines & Compliance Calendar

Note: The Rule 14 POSH annual report to the District Officer (due 31 January) is a separate obligation from BRSR filing. Missing this filing while filing BRSR correctly still exposes the company to Section 21 POSH Act non-compliance action, independent of any SEBI consequence.

Cost of SEBI POSH Disclosure Services

Cost varies materially by listing tier, BRSR Core assurance status, and IC volume. A standard BRSR-only drafting engagement is far more modest than a full BRSR Core assurance readiness package, which requires deep IC minutes review, external member reappointment, and pre-assessment audit. Regalwhiz plans start from ₹24,999 (tap to reveal on WhatsApp).

10 Mistakes Listed Companies Make

After working with listed companies across BFSI, IT services, pharma, and manufacturing, these are the recurring gaps we find during BRSR readiness audits:

1. BRSR and Board Report POSH numbers don't match — the #1 audit committee finding, always avoidable with reconciliation.
2. External Member has a vendor relationship — often a company panel lawyer, structurally invalid post-2026 assurance standards.
3. IC minutes only when there's a complaint — quarterly meetings are required regardless; missing minutes attract qualified opinions.
4. "Zero complaints" without narrative — bare zero looks like suppression; must be supported by training, accessibility, and awareness evidence.
5. Confidentiality undertakings never signed — Section 16 breach; discoverable in any assurance file review.
6. Cross-organisation complaints excluded post-Dr. Sohail Malik ruling — vendor-employee complaints must now be included in Principle 5.
7. Rule 14 annual report not filed with District Officer — separate obligation from BRSR; missing it is an independent Section 21 violation.
8. IC composition lapsed — 3-year terms expire; companies forget to reconstitute before reappointment date.
9. Training coverage percentages inflated — assurance providers cross-check attendance sheets against workforce headcount.
10. Corporate Governance Report and BRSR disclose different numbers — same data, different formats; both are LODR obligations.

Penalties & SEBI Action

Non-compliance operates across multiple regulatory tracks, each with its own enforcement mechanism:

The reputational consequence often outweighs the monetary. A Qualified Assurance Report on POSH governance is publicly visible to every institutional investor, proxy advisor, and ESG rating agency for the life of the filing. Recovery in subsequent years is possible but takes 2-3 filing cycles.

2025-2026 Legal Updates Every Employer Must Know

The SEBI POSH disclosure landscape has changed materially in the last 18 months. Listed companies relying on pre-2025 disclosure templates are almost certainly out of compliance with current SEBI expectations. Three developments matter most:

Legal References & Sources

This guide is grounded in the following primary legal sources. Where a specific claim is made, the reader is invited to verify against the source. Regalwhiz reviews all POSH content quarterly to reflect the latest legal position.

Disclaimer: This guide is intended as general information, not legal advice. For advice on a specific SEBI POSH disclosure situation, consult a qualified advocate. Content on this page was reviewed by Senior Advocate Akshaya and the Regalwhiz Legal Team on 10 August 2026. Next scheduled review: November 2026.