Most workplaces we walk into have a workplace violence and harassment policy. It's usually a single page, signed by the owner, posted near the time clock. Often it's dated five or six years ago.
That page is not a program. And a policy that hasn't been reviewed in five years isn't compliant, no matter how well it's written.
Let's talk about what the Occupational Health and Safety Act actually requires, because it asks for more than a signature on the wall.
The policy and the program are two different things
The Act requires both, and people blur them together.
The policies (section 32.0.1) are your statements: one for workplace violence and one for workplace harassment. If you regularly employ more than five workers, they must be in writing and posted in a conspicuous place, or made readily accessible electronically.
The programs are how those statements actually work on a Tuesday afternoon. They're the reporting routes, the investigation process, the risk controls and the summoning of help.
Those are not the same thing. A policy says you won't tolerate harassment. A program tells a worker exactly who to call when their supervisor is the one doing it.
Review at least annually
Section 32.0.1 requires the policies to be reviewed "as often as is necessary, but at least annually."
This is the requirement most employers miss. Not because they disagree with it, but because nothing on the calendar reminds them. The policy gets written during a COR push or after an incident, and then it sits.
Basically, what this means is simple: put a date in the calendar every year. Pull the policies and programs. Ask your committee or representative what's changed. Record that the review happened, even if the answer is "no changes needed."
Violence: assess the risk, then reassess it
Section 32.0.3 requires employers to assess the risks of workplace violence that may arise from the nature of the workplace, the type of work, or the conditions of work. The results go to the committee or representative.
And it doesn't stop there. You must reassess as often as necessary to make sure the policy and program still protect workers.
Here's where this really comes into play. A crew that starts working alone at night. A new contract that puts your workers inside occupied homes. A site in an area with a history of theft. Each of those changes your risk. The assessment has to change with it.
There's also a duty that surprises people. Under section 32.0.5, if a worker can be expected to encounter a person with a history of violent behaviour, and the risk is likely to expose them to physical injury, the employer must share the information needed to protect them, and no more personal information than is reasonably necessary.
Harassment: the program has specific contents
Section 32.0.6 spells out what a workplace harassment program must include:
- how workers report harassment to the employer or supervisor
- how they report it to someone else if the employer or supervisor is the alleged harasser
- how incidents and complaints will be investigated and dealt with
- how information will be kept confidential, except where disclosure is needed to investigate, take corrective action, or is required by law
- how both the worker and the alleged harasser (if a worker) will be told the results of the investigation and any corrective action.
Section 32.0.7 then requires an investigation appropriate in the circumstances, with the results given in writing to both parties.
The second bullet is the one that fails most often. Small companies route every complaint to the owner. When the owner is the problem, the program has no exit.
Harassment now explicitly includes online
The Act's definitions of workplace harassment and workplace sexual harassment now say plainly that it includes conduct "virtually through the use of information and communications technology."
That means group chats, text messages, social media comments and video calls. If your policy still reads as though harassment only happens in the lunchroom, it's out of date. Update the definitions, and make sure your reporting routes cover messages that arrive at 10 p.m.
Run the annual review now
You don't need to wait for the anniversary. This month, sit down with your committee or representative and work through four questions:
- When were our violence and harassment policies last reviewed? Is that written down?
- Has anything about our work changed since our last violence risk assessment?
- If a worker's complaint is about their own supervisor or the owner, where does it go?
- Does our policy cover harassment through texts, chats and social media?
If any answer is "I'm not sure," you've found the work. Do it now, record it, and put next year's date in the calendar before you close the file.