POSH Act 2013 — Internal Committee and Annual Reporting

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act 2013 is India's most commonly violated employment law by startups. Key requirements: every employer with 10 or more employees must constitute an Internal Committee (IC). The IC must have at minimum 4 members: a Presiding Officer (senior woman employee), 2 internal members (from amongst employees committed to the cause of women or with legal or social work experience), and 1 external member (an NGO representative or advocate). The external member must be paid a fixed fee per sitting. The employer must submit an annual report to the District Officer with the number of complaints received, disposed of, and pending. Failure to constitute an IC: fine up to ₹50,000 and doubling of fine for repeat violation; cancellation of business licence is possible under state government power.

IT Act 2000 — Privacy Obligations

Section 43A of the IT Act requires companies that handle "sensitive personal data or information" (SPDI — which includes passwords, financial information, health data, biometric data) to maintain "reasonable security practices." The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 require a published Privacy Policy on the company website. Failure to maintain reasonable security practices and a resulting wrongful loss to the data subject creates civil liability without any cap — a company can be held liable for full actual damages. The DPDP Act 2023, when fully implemented, will create additional obligations including breach notification within 72 hours to the Data Protection Board.

Companies Act Policies and Board Resolutions

The Companies Act 2013 requires board-approved policies for: Vigil Mechanism/Whistleblower Policy (mandatory for listed companies and those accepting public deposits; strongly recommended for all companies with independent directors); CSR Policy (mandatory for companies meeting the CSR threshold: net worth ≥ ₹500 Cr, or turnover ≥ ₹1,000 Cr, or net profit ≥ ₹5 Cr); Risk Management Policy (mandatory for listed companies; best practice for unlisted). Board resolutions must be passed for any material policy, and these resolutions must be reflected in board meeting minutes maintained under Section 118.

Draft → Legal Review → Approve → Publish → Train → Acknowledge → Review

Draft: Policy owner (HR for HR policies, CTO for IT policies, CFO for finance policies) creates the initial draft based on templates, regulatory requirements, and company-specific needs. Use a standard policy template with consistent sections: Purpose, Scope, Definitions, Policy Statements, Responsibilities, Consequences of Non-Compliance, Review Date.

Legal Review: Any policy with compliance implications (POSH, Privacy, IP Assignment, Anti-Bribery) should be reviewed by legal counsel before approval. Budget 1–2 hours of lawyer time per policy for review. Legal review is the most commonly skipped step — and the one that creates liability when a policy has unintended compliance gaps.

Approve: Policies should be formally approved by the appropriate authority: HR policies by the CEO and/or board; IT and security policies by the CEO or CTO; finance policies by the CFO with board notification. Approval should be documented — a board resolution for major policies, or a signed approval email thread for operational policies. The approval date and approver's name must be recorded on the policy document itself.

Publish: Policies should be accessible to all employees in a central, searchable location. Options: Corpfy Knowledge Hub (most common for India startups), Corpfy Knowledge Hub, intranet, or a shared Google Drive folder. The publish location should be announced to all employees via email or HRIS notification. New employees should receive access to the policy library as part of onboarding.

Train: Policies require active training, not passive publication. POSH training is legally required annually for all employees and specifically for IC members. Data security training should be conducted for all employees handling customer data. Expense policy training should be part of employee onboarding. Track training completion — "we published the policy" is not the same as "employees know and follow the policy."

Acknowledge: Employees must formally acknowledge reading and understanding each material policy. Acknowledgement creates a legal record that the employee was informed of the policy. Capture acknowledgements via Corpfy Contract Management, an HRIS e-signature module, or a Google Form with timestamped responses. Maintain acknowledgement records for at least 3 years (employment law disputes can arise long after an employee leaves).

Review: Each policy should have a defined review cadence: POSH policy annually (mandatory); IT security policies annually; HR operational policies every 2 years; financial policies annually or when regulatory changes occur. Assign a policy owner who is responsible for triggering the review. A policy that has not been reviewed in 3+ years is often worse than no policy — it may reference outdated regulations or internal structures that no longer exist.

SOC 2 (Trust Services Criteria)

SOC 2 auditors assess controls against Trust Services Criteria (TSC). Key policy-to-control mappings:

• Access Control Policy → CC6 (Logical and Physical Access Controls): Documents who has access to what systems, under what conditions, and how access is provisioned/deprovisioned
• Incident Response Policy → CC7 (System Operations): Defines how security incidents are identified, classified, escalated, and resolved
• Acceptable Use Policy → CC6.7: Governs employee use of systems and data to prevent unauthorised access or misuse
• Change Management Policy → CC8: Controls how changes to systems and code are approved, tested, and deployed
• Vendor Management Policy → CC9.2: Documents how third-party vendors are assessed for security risk
• Business Continuity / Disaster Recovery Policy → A1 (Availability): Defines RTO/RPO targets and recovery procedures

ISO 27001 (Information Security Management System)

ISO 27001 Annex A controls map to policies as follows:

• Information Security Policy (top-level) → A.5.1: The overarching IS policy signed off by management
• Access Control Policy → A.9: Covers user access management, access rights provisioning, privileged access
• Password Policy → A.9.4.3: Password complexity, rotation, multi-factor authentication requirements
• Data Classification Policy → A.8.2: How information is classified (Public, Internal, Confidential, Restricted) and handled accordingly
• Incident Management Policy → A.16: Incident reporting, response, and post-incident review procedures
• BYOD Policy → A.6.2.1: Mobile device management requirements for personal devices used for work

Acknowledgement Methods

Corpfy Contract Management: Sends the policy document as an attachment with an e-signature request. Employee signs electronically, and both parties receive a signed PDF with a certificate of completion. Legally robust and creates a clear audit trail. Cost: included in Corpfy Contract Management Business Pro (₹2,000–4,000/month for the team). Best for: high-stakes policies like POSH acknowledgement, IP assignment, and Code of Conduct. HRIS modules: Platforms like Corpfy HR & Payroll, Keka, and greytHR have built-in policy acknowledgement workflows that send policies to employees via the HRIS and record sign-off with timestamps in the system of record. Best for: companies with 50+ employees on an HRIS who want acknowledgement integrated into the employee experience. Google Form with timestamp: A simple Google Form asking "I confirm I have read and understood the [Policy Name] as of [Date]" with a required checkbox and timestamped submission record. Free, quick to implement, and adequate for early-stage startups. Limitation: does not attach the policy version the employee read — store the policy version alongside the form response.

Audit Trail Requirements

For any policy where non-compliance could result in legal action (POSH, IP Assignment, Code of Conduct), maintain: the version of the policy that was acknowledged, the date of acknowledgement, the employee's name and ID, and the method of acknowledgement. Store these records for a minimum of 3 years post-employment (the standard limitation period for most employment disputes in India). During an audit, the auditor will test acknowledgement by sampling 10–20 employees and checking whether records exist for each. Missing acknowledgement records for policies tested during SOC 2 or ISO 27001 audit will result in a non-conformity finding.

Corpfy Knowledge Hub

Strong policy management for companies already using Atlassian tools. Supports page templates for consistent policy structure, version history, review date reminders via page properties, and space-level permissions for draft vs published policies. Lacks native e-signature acknowledgement (requires integration with Corpfy Contract Management or HelloSign). Cost: ₹2,000–5,000/month. Best for: engineering-led companies with Corpfy Product Backlog.

Corpfy Knowledge Hub

The most popular choice for India startups at seed and pre-Series A. Policy database with version tracking, owner assignment, review date properties, and filter views by category or status. Policy acknowledgements require a workaround (Google Form or embedded typeform). Cost: ₹1,000–2,000/month team plan. Best for: startups that already centralise documentation in Corpfy Knowledge Hub and want to avoid introducing a separate tool.

PolicySpark / Workiva

Purpose-built policy management platforms with workflow (draft → review → approve → publish), e-signature acknowledgement, revision history, and compliance framework mapping. Workiva is used by mid-market and enterprise companies preparing for SOC 2 or regulatory compliance. Cost: ₹20,000–60,000/month. Best for: Series B+ companies with dedicated compliance or GRC functions.

SharePoint

Effective for companies in the Microsoft ecosystem. Document libraries with version control, metadata for policy category and owner, access permissions, and integration with Teams for policy update announcements. Acknowledgement via Microsoft Forms or Corpfy Contract Management connector. Cost: included in Microsoft 365 Business subscription. Best for: companies standardised on Microsoft 365 who want to leverage existing licensing.

How Auditors Test Policies

During a SOC 2, ISO 27001, or statutory audit, auditors do not just check that policies exist — they test whether policies are operational. Testing methods include: Inquiry — asking employees whether they know the policy and can describe its key requirements; Observation — watching whether actual practices match the policy (e.g., are employees actually using MFA as required by the Password Policy?); Inspection — examining evidence of policy compliance (access provisioning records, training completion logs, acknowledgement records); Re-performance — the auditor independently verifying a sample of transactions against the policy (e.g., checking whether expense claims above ₹5,000 have manager approval as required by the Expense Policy).

Common Policy Audit Gaps

• Policy exists but has never been acknowledged by employees — no acknowledgement records available
• Policy review date has passed and no review has been conducted — policy is "expired"
• Policy references roles or processes that no longer exist in the company
• Policy lacks version number and effective date — auditor cannot confirm which version was in force during the audit period
• POSH policy has no evidence of annual training delivery — no attendance records or training completion certificates

Building Your Policy Evidence Folder

Create a dedicated "Policy Evidence" folder in your VDR or document repository with: the current approved version of each policy; the board resolution or approval email approving the policy; training attendance records or LMS completion reports for each policy training session; employee acknowledgement records (Corpfy Contract Management certificates or form responses); and the review history showing when each policy was last reviewed and by whom. This folder is your first response to any auditor's request for policy evidence — having it pre-assembled saves days of scrambling during a live audit.

Corpfy's Policy Management dashboard is a living policy library — pre-built templates for the 12 core policies every funded startup needs, with version control, employee acknowledgement tracking, and audit-ready evidence export. Your ISO 27001 auditor, SOC 2 auditor, and enterprise customer security team all ask for the same policies — Corpfy generates them in the format each expects.

What you get in the dashboard