She Box and the Record
A compliance head showed us her annual report. Everything was in order: complaints handled, timelines met, committee active. Then we asked to see the entries on the government portal, the ones filed with the authority. Her face changed. The reports she had been filing internally and the entries the portal expected were two different records, and no one had been maintaining the second one.
This is the gap between the record and the portal. The SHe Box and the associated reporting trail are the official record of a workplace's POSH activity, and a company can be perfectly organised internally while being invisible, or wrong, on the record that the government actually keeps.
What SHe Box is
SHe Box is the government portal for reporting and tracking complaints related to sexual harassment at the workplace. It is a single point through which complaints can be filed and, importantly, through which the workplace's compliance activity is recorded with the authority. It is not the same as the company's own complaint register. It is the external record, held by the government, and it is the one that matters when the authority looks.
For many workplaces, SHe Box is understood only as a place where a woman can file a complaint directly. That is true, and it matters, because a complaint filed on the portal bypasses the company's internal intake and arrives at the authority instead. What is less understood is the reporting obligation that sits alongside it, the duty to keep the authority informed of the workplace's POSH activity.
The reporting trail companies forget
The reporting trail is where most workplaces fall short, not because they are hiding anything, but because nobody owns the task. The internal register is maintained because it is useful. The portal entries are forgotten because they are not.
- The annual report is filed internally but the corresponding information is never entered on the portal.
- The committee is constituted and the order filed internally, but the authority is not informed.
- Complaints are handled and closed internally, with no record on the external system.
- The person who used to do the portal entries has left, and nobody noticed the task stopped.
- The login details for the portal are lost, so the entries cannot be made even when someone remembers.
The result is a workplace that can show a full internal record and an empty or stale external one. When the authority checks, it does not read the internal register first. It looks at its own record, and the company is not in it.
Why the external record matters more than companies think
There is a natural instinct to treat the internal register as the real record and the portal as an administrative chore. That instinct is backwards.
The internal register is your version of events. The portal is the version the authority holds. When there is a dispute, an inspection, or a complaint that reaches the authority, the external record is the one that is read first, because it is the one the government already has. A company that has done everything right internally but kept nothing on the record has, from the authority's point of view, done nothing it can see.
The portal also matters because a complaint can arrive there directly. A person who does not trust the internal process can file on the portal instead. When that happens, the company learns of the complaint from the authority, and its own internal record, however neat, is suddenly only part of the story.
The problem of two records
When the internal register and the external record are not kept in step, the company is running two versions of its own history. The two will disagree, and the disagreement will be found.
An inspector who compares them will see the gap immediately. A respondent in a complaint will use it. And the company itself will lose the ability to answer a simple question accurately: how many complaints have we had, and what did we do with them? If the internal answer and the external answer differ, the company cannot be sure of its own position.
The fix is to treat the two records as one task. Whoever maintains the internal register should be responsible for the portal entry, at the same time, from the same information. The moment they are separate tasks, owned by different people or no one, the two records begin to drift.
What we check in a records review
- Is the workplace registered on the portal, and are the login details held by more than one person?
- Are the committee details, including the external member, recorded on the portal?
- Is there an annual entry, and is it current?
- Do the portal entries match the internal register, complaint for complaint?
- Is there a named owner for the portal, with a backup, so the task survives a resignation?
Where the answers are no, the work is not complicated. It is a matter of making the external record a real task, with an owner and a schedule, and keeping it in step with the internal one.
The record is the proof
A POSH process is only as good as the record it leaves. The policy, the committee and the inquiries all matter, but they are proved by what is written down, and the part of the record the authority reads is the part on its own portal. A workplace with a strong internal process and an empty external record has left the proof unwritten.
The reporting trail is not glamorous. It is a set of entries made on time, kept current, and owned by someone who will still be there next year. That is what makes it reliable, and it is what the government will look at first.
We do not guess. We investigate. When we review POSH compliance, we ask for both records, the internal register and the portal entries, and we put them side by side. The gap between them, if there is one, is usually the first finding.