Violence and Harassment: 5 Governance Gaps Directors Keep Missing

On the Headline Podcast, Andreza Araujo and Dr. Megan Tranter keep returning to the same field test: if the first credible warning about violence or harassment disappears into silence, the organization does not have a complaint problem, it has a decision problem. The gap is not only between people and policy. It is between signal and ownership.

That is why this topic belongs in psychosocial risk governance, not only in HR case handling. ISO 45003 frames psychosocial risk as a management system issue, ILO C190 treats violence and harassment as unacceptable, and EU-OSHA's ESENER work pushes leaders to look at prevention, not only after-the-fact response. In A Ilusao da Conformidade, Andreza Araujo makes the same point from another angle: a site can look compliant while the people inside it still pay the price.

For the routing piece, see how to build a safety concern escalation ladder. For the review rhythm, see how to run a board safety dashboard review in 20 minutes. If leaders do not control the path from concern to decision, the rest of the system becomes theater.

Why violence and harassment is a governance issue

Violence and harassment are often described as conduct problems, but that frame is too small. Directors do not control every interaction on the floor, yet they do control the rules, the reporting path, the response clock, and the escalation line. When those pieces are vague, the site teaches people to stay quiet until the harm is already visible.

The right question is not whether the organization has a policy. The right question is whether the policy changes who owns the next move when a credible signal appears. That is where the leadership gap starts, because a document can exist while the work still rewards delay.

Gap 1: The policy exists, but the reporting route is not credible

A policy that no one trusts is not a control. It is a poster. When workers cannot tell where a concern goes, who sees it first, or how quickly they will hear back, they learn that reporting is a moral gesture rather than an operational path. In practice, that means the first report comes late, and the second one may never come.

Use the escalation ladder to make the route visible, then test whether people can name the next owner without checking a slide deck. If the answer is no, the policy is still ceremonial.

Gap 2: The manager owns the complaint, but not the risk

When a manager treats a complaint as a private HR matter, the risk stays trapped in the wrong lane. Violence and harassment touch workload, supervision, access control, shift design, contractor behavior, and sometimes customer interface. One person can receive the report, but one person rarely owns every lever that can reduce exposure.

That is why psychosocial risk needs cross-functional ownership. HR helps with process and privacy. EHS helps with hazard structure. Operations changes the work itself. Directors need to see whether those three functions are aligned, because a single owner who cannot move the job is not actually in control.

Gap 3: Silence is mistaken for safety

Many leadership teams call the site calm when the real signal is silence. That mistake is expensive because silence can mean fear, resignation, or the belief that nothing will change. Amy Edmondson's work on psychological safety is useful here, since people do not speak early when the first reply tends to be vague, slow, or punitive.

If you want the practical voice route behind this gap, read Anonymous Hotline vs Named Reporting vs Field Voice Rounds. The channel matters, but only if the organization answers quickly enough for the next person to trust it.

Gap 4: Retaliation risk is checked too late

Leaders often ask whether retaliation is prohibited, but the better question is whether it is prevented after the first response. People watch not only what the policy says. They watch whether the messenger loses shifts, status, desirable work, or informal protection after raising the issue. If that happens, the site has already taught the next person to stay quiet.

That is why retaliation control needs follow-up, not just a statement. The check should happen after the concern is routed, after the first decision is made, and again after the work changes. A one-time reminder does not protect voice when the local culture still rewards punishment by inconvenience.

Gap 5: The closeout never reaches the work

A closeout that stays in email is not a closeout. Directors should ask what changed in the task, the supervision pattern, the access rule, or the customer boundary after the case closed. If nothing changed in the work, then the organization may have closed the file while leaving the condition intact.

This is also where field evidence matters. For a broader view of what leaders should verify, see Psychosocial Hazard Taxonomy Explained. The category of risk matters less than the proof that the control actually changed the job.

What directors should ask in the monthly review

Directors do not need a long script. They need a disciplined one. The review should answer who owns the response, how fast the first acknowledgement arrives, whether retaliation risk is checked after the first reply, and what changed in the work once the case was closed.

1. Who owns the next decision, and can that person move the work?
2. How long does the average concern wait before a meaningful reply?
3. What changed in supervision, access, or task design after the last case?
4. How do we know the messenger was not penalized after speaking?

Those four questions shift the conversation from compliance language to control language. That shift is the difference between a board that reviews status and a board that reviews risk.

Policy, protocol, and governance are not the same thing

Many teams collapse three different layers into one. Policy sets the direction. Protocol gives the route. Governance proves the route is actually used and that the work changes when the route produces a decision. If those layers are blurred, leaders end up congratulating themselves for publishing a document that never touched the field.

Use this separation when you brief the board or the executive team. Once the layers are separated, the question becomes much clearer. Is the site missing a rule, missing a route, or missing evidence that the route changes the work?

FAQ

Is violence and harassment only an HR issue?
No. HR plays a part, but the risk is also shaped by supervision, work design, access control, contractor behavior, and the speed of leadership response.

What is the fastest sign that governance is weak?
If workers cannot explain who owns the next move after a concern is raised, governance is weak. The signal is there, but the system is not moving it.

How does this connect to psychosocial risk?
Violence and harassment are psychosocial hazards because they affect health, trust, and work conditions. ISO 45003 and ILO C190 both point leaders toward prevention, not just reaction.

What should the board look for first?
The board should look for response time, ownership, retaliation follow-up, and proof that the work changed after closure. If those are missing, the policy is not doing enough.

Violence and harassment stop being abstract as soon as the organization can name the owner, show the route, and prove the work changed. That is the standard leaders should hold, and it is the standard the crew will remember.