⚡ Quick Answer: Buy an off-the-shelf POSH module when you are a single-language office population, carry no sector-specific risk, and need completion evidence on the record this quarter. Build custom when your own Internal Committee members and reporting route have to be named inside the course, when frontline staff need vernacular, or when factory-floor, hospital, field-sales or night-shift realities make a generic office module unusable. Most Indian employers land on a hybrid: a bought legal core plus one custom scenario and a localised reporting-process module. Whichever way you go, the deciding factor is usually not the course at all — it is whether your LMS can produce a defensible record of who completed what, when, and which version they saw.
Key takeaways
- The Act never says "annual training" — it asks for workshops at regular intervals. What makes it feel annual is the reporting: the Internal Committee has to state each year how many awareness programmes were carried out, and a zero in that box is a visible number.
- Off-the-shelf wins on speed and legal-core accuracy — a specialist publisher updates the statutory content when the law moves, so you do not have to notice the change yourself.
- Custom wins wherever the course must be about your workplace rather than a workplace: your IC members by name, your reporting route, your shop floor, your languages.
- The hybrid is not a compromise but the honest answer for most mid-size Indian employers — bought legal core, custom scenario, custom reporting-process module.
- Your Committee needs different training from your staff — orientation and capacity-building for its members is a separate duty, and an all-staff module does not discharge it.
- The evidence trail decides more disputes than the content does: completion with a timestamp, an assessment score, and a record of which version of the content the learner saw.
Search for a POSH training module and page one is entirely people selling you one. That is what happens when a compliance obligation meets a content market — but it does mean there is almost nowhere to read an honest answer to the question most HR and L&D leads are actually asking: do we buy this off a shelf, or do we build it? Both answers are right, for different organisations. Here is how to tell which one you are.
What the law actually requires — and what it does not
The training obligation under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 is narrower and stranger than the marketing around it suggests.
The Act asks employers to organise workshops and awareness programmes at regular intervals to sensitise employees, and — separately, in the same breath — orientation programmes for the members of the Internal Committee. Two things follow that most buyers miss. It does not say annually. And employee awareness and Committee training are two distinct duties, not one course you can buy once and assign to everybody. The rules made under the Act go further and point employers toward material published by State Governments, which is worth knowing before you commission anything.
The annual rhythm comes from the reporting side. The Internal Committee prepares a report each calendar year, and one of the things that report has to state is how many awareness programmes were carried out. Whatever cadence you choose, once a year somebody writes down how many you ran. That box is why POSH training is annual in practice though the statute never says so — and it is also why the same information tends to surface again in a company's own annual reporting.
Enforcement expectations have been tightening rather than loosening, with courts and administrators pressing employers on whether Committees genuinely exist and function rather than merely appearing on paper. The practical direction of travel is toward employers being asked to evidence what they did, not just assert it.
None of this is legal advice, and none of it is a substitute for checking your own position. Specific thresholds, timelines and consequences change, and they are exactly the things you should confirm with your own counsel rather than with an article. We build and run learning systems, not legal opinions. What matters for this decision is the shape of the obligation, because it tells you which parts of a POSH course are generic and which can only ever be yours.
The split that actually matters
A POSH module is two courses wearing one jacket.
The legal core — the statutory definitions, quid pro quo and hostile work environment, the complaint timeline, the inquiry process, protection against retaliation. Identical for every employer in India, and the part that changes when the law changes. There is no advantage in writing it yourself and real risk in maintaining it yourself.
The organisational layer — who your Presiding Officer is, your external member's name, which email or phone number a complaint actually reaches, what happens on your night shift, in your warehouse, at a client site. No vendor knows this, so it cannot be bought. It is also the part employees most need: "report it to your Internal Committee" is not actionable unless they know who that is.
Almost every disappointing POSH rollout is the same failure — an excellent legal core delivered to people who finished it still not knowing who to call.
Cost, effort and risk, side by side
We do not publish rates for our own work, and any table giving a single number for "custom course" is selling something. What is useful is the relative shape of each option.
| Dimension | Off-the-shelf | Custom build | Hybrid |
|---|---|---|---|
| Cost profile | Per-learner licence, recurring, scales with headcount | One-off build cost, then near-zero per learner | Small licence + one-off build for the custom parts |
| Time to deploy | Days — buy, upload, assign | Weeks, driven by SME availability and review cycles | Deploy bought core first, add custom modules after |
| Legal defensibility of content | Strong; publisher maintains statutory accuracy | Only as strong as your reviewer | Strong core, your risk only on your own material |
| Evidence trail | Depends entirely on your LMS, not the course | Depends entirely on your LMS, not the course | Same — this is an LMS question, always |
| Update burden when law or IC changes | Publisher updates the law; you still cannot edit IC names | You update everything, but you can update anything | Publisher handles law; you re-record one short module |
| Completion rates | Typically lower — generic scenarios read as someone else's workplace | Typically higher when scenarios are recognisable | Highest in practice; the custom scenario carries attention |
| Localisation | Limited to the languages the publisher ships | Any language you are willing to pay to produce | Buy English core, build vernacular for frontline |
Vernacular and frontline delivery
This is where most off-the-shelf POSH catalogues quietly stop being fit for purpose, and it is the biggest single reason Indian employers end up building.
An English-medium, text-heavy, office-set module delivered to a factory workforce, a housekeeping team, a delivery fleet or a hospital's support staff does not fail because it is bad. It fails because it was never addressed to them. If a meaningful part of your workforce reads slowly or not at all in the language you bought, the design has to change and not just the audio track: shorter segments, spoken narration carrying the meaning rather than annotating it, situations from their actual shift, and an assessment that is not quietly testing reading speed instead of understanding.
There is a compliance angle worth raising with your counsel too. If a substantial group of employees cannot follow the training you delivered, the count in your annual report can look complete while the underlying duty — actually sensitising employees — has not really been met for them. The pointer toward State Government material is genuinely useful here, since several states publish regional-language resources you can build on.
- 1Count your populations, not your headcount
One office population in one language is a buying decision. Two or more distinct populations — office plus plant, corporate plus field force, day staff plus night shift — is where off-the-shelf starts to strain.
- 2Check whether your sector generates its own scenarios
Hospitals, factories, BPO night operations, field sales and construction carry risk patterns a generic office module does not depict. If learners cannot recognise the setting, they will not map the rule onto their own day.
- 3Decide whether your IC has to be named in-course
If the answer to "who do I complain to" is a name and a channel, you need at least one module you control — and you will have to re-record it whenever the Committee's membership turns over. Plan for that, because it will.
- 4Separate the Committee's own training from everyone else's
Orientation and capacity-building for Committee members is a separate duty from employee awareness. An all-staff module does not cover it, and this part is usually bought or delivered live rather than built.
- 5Check what your LMS can prove before commissioning anything
Run one throwaway module through the live tenant and read the report. If it cannot show completion with a timestamp, a score and a content version, fix that before spending on content.
Buy off-the-shelf when
- One office-based population, one language, no shift work
- No sector-specific risk pattern a generic module would miss
- You need completion evidence on the record this quarter
- Budget is operating expenditure and headcount is stable
- You have no internal SME time for review cycles
- This is your first cycle and you need a baseline to improve on
Build custom when
- Your IC members and reporting channel must be named in-course
- Frontline staff need vernacular or low-literacy design
- Factory floor, hospital, field sales or night shift changes the scenarios
- You are doing culture work, not delivering a legal read-out
- Headcount is large enough that per-learner licensing compounds
- You want to own the source files and update without a vendor
What your LMS must record to answer the question later
The content is half the compliance artefact. The other half is the record — an LMS responsibility no course can discharge for you. At minimum: completion with a date and time per learner, not a pass or fail flag; the assessment score, because "attended" and "understood" are different assertions; the content version the learner consumed, so that when your Internal Committee changes mid-year you can still show what each cohort was told; the assignment history, showing who was required to take it and whether anyone was missed; and a retention period covering whatever limitation periods your counsel identifies, with an export you can hand over rather than a screenshot. Your Committee has to count the awareness programmes it ran. Being able to substantiate that count per person is a different capability from having run them.
Re-record the reporting module, not the whole course
The most common maintenance trap is building POSH training as one monolithic course with the Internal Committee's names baked into the middle of it. Committee membership turns over — people leave, roles change, terms end — so this content will date faster than anything else in the course. Build the reporting-process content as its own short module with its own SCORM package. When the Committee changes you republish two minutes of content and reassign one item, instead of re-versioning an hour-long course and losing the clean line between what the old cohort saw and what the new one sees.
Frequently asked questions
Is POSH training legally mandatory in India every year?
Not in those words. The Act asks employers to organise workshops and awareness programmes at regular intervals rather than on a yearly clock. The annual rhythm comes from the reporting side: the Internal Committee prepares a report each calendar year, and part of that report is how many awareness programmes were carried out. In practice that makes at least one cycle a year the working standard. Confirm your own obligations with your counsel rather than with an article.
Can we edit an off-the-shelf POSH course?
It depends entirely on what you buy. Some publishers ship a locked package you can only assign as-is; others hand over source files or allow a review-and-amend cycle before it goes live. This is worth settling before purchase rather than after, because the single most valuable edit — naming your own Committee members and reporting channel — is the one a locked package will not let you make. Ask the question explicitly during evaluation.
Should managers and frontline staff get the same POSH course?
Usually not, for two different reasons. Managers carry obligations most staff do not — recognising a complaint when it is raised informally, not retaliating, and escalating properly — which a general awareness module tends to skim. Frontline staff often need a different language, literacy level and set of scenarios altogether. A single course pitched to satisfy both usually under-serves both.
How long does POSH rollout usually take?
Buying and assigning an existing module is the fastest path by a wide margin — it is essentially procurement plus an upload. A custom build is materially longer, and the constraint is almost never production; it is your own subject-matter experts' availability and the number of review cycles your legal or HR reviewers want. If you have a fixed deadline, that review loop is the thing to plan around.
Is an off-the-shelf POSH module enough on its own?
For a small single-site office team it often is, provided you supplement it with your own Internal Committee details — which the module cannot contain. It is usually not enough on its own in three situations: where a significant part of the workforce needs a language or literacy level the publisher does not ship, where the sector's real scenarios look nothing like the module's office setting, and for the Committee's own training, which is a separate duty from employee awareness.
How do we train frontline or non-English-speaking staff on POSH?
Translate the design, not just the script. Shorten segments, let spoken narration carry the meaning rather than annotate on-screen text, use situations from the actual shift or site rather than a meeting room, and make sure the assessment is not accidentally testing reading speed. Several State Governments publish regional-language material that is worth reviewing before you commission anything new.
What records should our LMS keep for POSH training?
Completion with a timestamp per learner, the assessment score, the version of the content that learner consumed, the assignment history showing who was required to take it, and a retention period aligned to whatever limitation periods your counsel identifies — with an export you can hand over. The version record matters more than people expect: when your Internal Committee changes mid-year, it is the only clean way to show which cohort was told which reporting route.
Where we sit on this
We work on both sides of this decision, which is why the article can end without pushing you one way.
We build custom POSH courses to a client's brief — their scenarios, their languages, their Committee and reporting route named in-course. We also maintain an off-the-shelf POSH course for organisations that need the legal core quickly. What matters about the second one is how it is used: the client's own Internal Committee reviews it first, we make whatever changes that review calls for, and only then does it go live in their LMS portal. That review step is deliberate. It is what turns a generic module into one the Committee has actually stood behind, and it is the reason we would rather ship an amended course than a fast one.
And we run the LMS your course lands in — the part of this decision people underweight. Whether you buy, build or do both, the artefact that answers a question a year from now is not the course. It is the record: who completed it, when, with what score, on which version of the content, retained as long as it needs to be. That requirement is identical whichever way build-vs-buy resolves, and it is worth settling first.
Related reading: our course development work, how to package and publish a SCORM course, why a SCORM course shows “incomplete”, the 2026 compliance training software buyer’s guide, and an eLearning RFP template with a scoring rubric if you are going out to vendors.
This article describes compliance practice in general terms and is not legal advice. Requirements, thresholds and timelines change and vary by circumstance — verify your own obligations with qualified counsel before acting on anything here.