Since Australia's positive duty amendments took effect, employers carry a proactive legal obligation under the Sex Discrimination Act: take reasonable and proportionate measures to eliminate, as far as possible, sexual harassment, sex-based harassment, discrimination, and related conduct - not just handle complaints well after the fact.
That is a meaningfully different standard from "have a reporting channel and respond to what comes in." Prevention-focused obligations require evidence of a system, not a policy document sitting in a handbook.
What "reasonable and proportionate" tends to require in practice
Guidance from the Australian Human Rights Commission and subsequent regulatory commentary points toward several recurring elements: leadership accountability, risk identification specific to the actual workplace rather than a generic template, a functioning and genuinely accessible reporting mechanism, consistent response and consequence management, and ongoing monitoring rather than a one-time policy rollout.
Software supports two of those directly - the accessible reporting mechanism, and consistent response and consequence management. It cannot, by itself, satisfy risk identification, leadership accountability, or culture change, and any vendor implying otherwise is overselling.
Part 9.4AAA: the policy has specified content
Part 9.4AAA of the Corporations Act 2001 requires certain Australian entities - public companies, large proprietary companies, and corporate trustees of registrable superannuation entities - to have a whistleblower policy in place, and it is not satisfied by any document that happens to use the word "whistleblower." A compliant policy needs to cover the protections available to eligible whistleblowers, how and to whom a disclosure can be made (including to a company officer, senior manager, auditor, actuary, or a regulator such as ASIC or APRA directly), how the company will support whistleblowers and protect them from detriment, how investigations will be conducted, how fair treatment of any employee mentioned in a disclosure is ensured, and how the policy is made available.
The Act's protections also extend beyond current employees: former employees, officers, contractors, suppliers, associates, and in some cases their relatives can qualify as eligible whistleblowers. A system that architecturally requires a company login to file a report quietly excludes a category of people the law is written to protect - which is why the anonymous, no-login reporting path is structural here rather than a UX preference.
What an HR director should be able to produce
Asked by a board, a regulator, or an external auditor: a documented, accessible reporting channel; a record of response times against internal or regulatory benchmarks; and evidence that similar complaints receive similar consequences. Storing category, severity, department, and outcome as structured data - rather than buried in free-text case notes - is what makes that evidence producible on short notice.