Psychosocial risk management: what employers should be reviewing now

Most Australian employers have something in place for psychosocial risk: a policy, an employee assistance program, an engagement survey. Fewer can show, on the documents, how the work itself was examined, what hazards were identified, who was consulted, which controls were chosen and why, and what happened when those controls were tested. That second set of records is the material a regulator, an insurer or a board risk committee may seek.

The organising idea is prevention through work design. Psychosocial hazards arise from how work is designed, organised, managed and supervised, and from the conditions in which it is performed. Support offered after harm is relevant, but it is not a substitute for controlling the source of the risk. This guide deals with steady-state operations; change programs are covered in managing psychosocial risk during organisational change, prevention systems in sexual harassment prevention, and complaints in early triage and fair process.

Australian WHS and OHS laws protect psychological as well as physical health, but the architecture is not uniform. Regulations, codes, terminology and enforcement practice differ, and model provisions have no legal effect until a jurisdiction adopts them. Two broad tracks help planning; check the local law and code before drawing conclusions.

In jurisdictions that have adopted the model WHS laws, and in the Commonwealth scheme, the duty rests on the person conducting a business or undertaking. The approach in the Model Code of Practice: Managing psychosocial hazards at work and the model WHS Regulations is to identify reasonably foreseeable psychosocial hazards, eliminate psychosocial risks so far as is reasonably practicable and otherwise minimise them, maintain the controls, and review them when required. Commonwealth duty holders should read that with Comcare's guidance.

Victoria operates a separate framework. Duties sit under the Occupational Health and Safety Act 2004, which speaks of employers and employees rather than PCBUs and workers, and the Occupational Health and Safety (Psychological Health) Regulations 2025 commenced on 1 December 2025. Victorian employers should work from those instruments and from WorkSafe Victoria's guidance and its compliance code rather than importing model-WHS wording. Multi-state employers can run one operating discipline, but legal descriptions and duty-holder language must match each jurisdiction. Regulator contacts are listed by Safe Work Australia.

A psychosocial hazard is an aspect of work design, work organisation, management, or the social or physical work environment that may cause psychological or physical harm. A psychosocial risk is the likelihood and severity of that harm arising from exposure. Stress is the response a person has to exposure — a mechanism, not the hazard and not, by itself, an injury.

Two consequences follow. The object of control is the hazard, not the worker's response, so framing psychosocial hazards as individual resilience misdirects the analysis. Harm can also arise from a single serious exposure or from cumulative exposure such as sustained high demands with low control.

Regulator material across Australian jurisdictions describes a recognisable hazard set. Reviews often concentrate on harmful behaviours and give less attention to work-design and management hazards, where much routine exposure sits. Hazards also interact, so they are best read together.

• High or unsustainable job demands — workload, pace, emotional demands, and prolonged under-utilisation.
• Low job control — limited say over how, when and in what order work is performed.
• Poor support — inadequate supervisor or peer support, information, tools, training or staffing.
• Lack of role clarity — unclear, conflicting or frequently changing responsibilities.
• Poor change management — insufficient consultation, information or transition support.
• Inadequate recognition, and poor organisational justice — inconsistent or opaque decisions.
• Traumatic events or exposure to distressing material, including through records, calls or footage.
• Remote or isolated work, and poor physical environments including noise, heat or unsafe premises.
• Violence and aggression, including from customers, clients, patients or the public.
• Bullying, harassment including sexual harassment, discrimination, and conflict or poor workplace relationships.

Hazard identification works best when it triangulates, because each source has a blind spot: consultation with workers and their representatives, observation of how the work actually runs, and administrative data. Useful sources include rostered against actual hours, overtime and leave balances, caseload allocation, after-hours contact records, incident and hazard reports, complaint and exit-interview records, absence and turnover patterns, and claims data.

Low report volumes are a weak indicator. Under-reporting is common where workers doubt reports lead to change, where the channel runs through the person whose conduct is in issue, or where exposure has been normalised. Data shows where to look; it does not establish that risk is low.

Consultation is legally required where the applicable WHS or OHS law requires it, and it is an important source of information about how work is really performed — one to be read together with observation and data. It should run across the cycle: identifying hazards, assessing risk where required, deciding controls and reviewing whether they work. Health and safety representatives have participation rights that go beyond being informed.

A survey is not consultation. It can support consultation, but consultation involves sharing relevant information, giving workers a reasonable opportunity to express views and contribute to decisions, taking those views into account and advising them of the outcome, in the terms the applicable law prescribes.

Record who was consulted, when, what was raised, what was decided and what feedback was given. Where an issue does not lead to change, explaining why sustains participation better than silence. Contractors and labour hire workers can be missed by default, and should be included where the applicable duties and consultation arrangements require it.

Risk assessment is a means, not an end. Model WHS guidance indicates a separate formal assessment may not be needed where the risks and effective controls are already known and can be implemented promptly — if a team is short-staffed on a known roster gap, resource the roster rather than schedule a workshop. WorkSafe Victoria's compliance code likewise recognises that current knowledge may already exist, while identifying circumstances in which employers should carry out a risk assessment; the legal position is not identical everywhere. Assessment earns its place where hazards are complex or interacting, where the right control is contested, or where exposure is significant and the causes unclear.

Where assessment is undertaken, the useful variables are duration, frequency and severity of exposure, how hazards interact, and who is exposed. A brief peak in demand may present a lower risk where demands are controlled and adequate resources, support and recovery are provided, but duration alone is not determinative and a short, intense exposure may still cause harm. Consider groups facing heightened exposure — night-shift workers, new starters, isolated workers or those in insecure work.

No scoring method is universally prescribed, and there is no generally applicable requirement to use a numeric matrix; check any binding jurisdictional or organisational requirement. A simple, consistent method that records reasoning beats an elaborate one producing a score nobody acts on. Record the hazard, the evidence, who was consulted, the reasoning, the control decision, the owner and the review trigger.

Controls should address the source of the risk and the design of the work where it is reasonably practicable to do so. Changing rosters, staffing, workload allocation, task design, service models, physical layout, escalation authority and supervision alters exposure. Policies, training, reporting channels, employee assistance and resilience programs can support a system, but ordinarily do not, by themselves, control excessive demands, unclear roles, aggression exposure or unfair decision-making.

Individual adjustments complement organisational controls rather than substituting for them. Consider and implement necessary, lawful and reasonably practicable individual measures or adjustments as applicable, while continuing to address the broader work-design exposure; obligations under discrimination law are not resolved here. Do not request health information beyond what is necessary and lawful.

Controls need implementation detail: an owner, a date, resources, the operational change required, communication to affected teams and a verification method. Where a preferred control is not reasonably practicable now, record the interim control, the reason and the revisit date.

These rows can be adapted into a working register. Each runs: review area, evidence, warning signs, control question, review trigger.

• Job demands — rostered versus actual hours, overtime, leave balances. Signs: chronic overtime, unused leave. Question: can demand or staffing change rather than training be added? Trigger: sustained overrun, vacancies.
• Job control — decision rights, scheduling discretion, system constraints. Signs: escalation of routine decisions, workarounds. Question: which decisions can move to the people doing the work? Trigger: process change, restructure.
• Support and role clarity — position descriptions, supervision ratios, handovers. Signs: new-starter turnover, conflicting instructions. Question: are roles and authority consistent? Trigger: role redesign, manager change.
• Aggression and violence — incident reports, security records, lone-work logs. Signs: unreported incidents, no debrief. Question: can the interaction or environment be redesigned? Trigger: serious incident, site change.
• Traumatic exposure — exposure volumes, rotation records, supervision logs. Signs: no rotation, rising absence. Question: can exposure be limited or rotated? Trigger: caseload change, incident, staffing shortfall.
• Organisational justice — promotion, pay and discipline records, complaint themes. Signs: unexplained decisions, grievance clustering. Question: are criteria and review pathways visible? Trigger: pay round, policy change.
• Bullying, harassment and conflict — complaint and triage records, investigation outcomes. Signs: repeat respondents, avoidance. Question: what design or supervision factor allows recurrence? Trigger: report, adverse finding.
• Remote, hybrid and isolated work — after-hours contact data, check-in records. Signs: out-of-hours traffic, workers unseen for long periods. Question: are contact expectations observed? Trigger: arrangement change.

Where more than one organisation influences the same work, duties can overlap. Under model WHS laws, where duty holders share a duty in relation to the same matter, s 46 requires them, so far as is reasonably practicable, to consult, cooperate and coordinate with each other, and each retains responsibility to the extent of its capacity to influence and control the matter. Victoria does not have an equivalent general provision in the same terms: at a high level, OHS duties can extend to independent contractors and their employees in relation to matters over which the employer has control, consultation obligations under the Victorian Act apply to employees and health and safety representatives, and labour-hire and host responsibilities depend on the legal and practical arrangement.

Practically, agree in advance who identifies hazards, who sets rosters and demands, who acts on reports, and who supervises and debriefs. Contractual allocation of responsibility does not of itself displace a statutory duty. Labour hire and contracted workers belong inside the reporting channel and the incident data, and inside consultation arrangements where the applicable duties require it.

Monitoring should be planned rather than opportunistic, combining leading indicators — control implementation status, consultation activity, roster and demand measures, time to act on hazard reports — with lagging indicators such as incidents, complaints, absence, turnover and claims. Movement across several measures, read with what workers say, is more informative than report volume alone.

Privacy discipline matters once this data is assembled. Report at an aggregation that does not identify individuals, apply minimum group sizes, restrict access, and collect only what is needed. Do not promise anonymity the process cannot protect: a free-text comment or a small-team result can identify a person. Where personal or health information is handled, apply the requirements binding the organisation under the Privacy Act 1988 (Cth) or the applicable regime. Not every employer is covered by that Act, and the employee-records exemption is limited in scope: it does not remove State or Territory privacy and health-records laws, confidentiality obligations, surveillance laws or other duties.

Officers in model-WHS jurisdictions have due-diligence obligations and Victorian officers have their own statutory responsibilities; describe them by reference to the applicable law. Leaders should see hazards identified, controls in place and whether they operate, open matters with owners and dates, and what changed since the last report. Verification means testing controls in the field, not a completion percentage.

A regional service centre reports rising absence and turnover among counter staff. Identification draws on consultation with the team and the elected health and safety representative, observation of two peak shifts, and data on queue times, incidents, overtime and leave. The picture is high demand at predictable peaks, customer aggression largely unreported because the form takes fifteen minutes and sits outside the operational system, no recovery time between difficult interactions, and one supervisor covering two sites.

Because hazards interact, a documented assessment records exposure duration and frequency, the absence of debriefing, and the effect of lone coverage. Controls chosen in consultation add a second peak counter position and a floating supervisor, replace the form with a two-minute in-system report, require a step-away and debrief after any aggressive interaction, and authorise staff to end an interaction and call security.

Verification is built in: reporting volume, use of the step-away protocol, overtime movement, and follow-up consultation at eight weeks. Triggers are recorded — any serious incident, changed hours or staffing, or reporting falling below the post-change baseline. At eight weeks reports have risen and severity fallen, and the escalation instruction is amended after staff report slow security response.

A forty-person advisory team working three days remote reports uneven experience: some report sustained overload, others isolation and unclear priorities. Identification uses a short pulse survey, facilitated discussions in each sub-team, and a review of after-hours message data, allocation records and leave patterns. The survey alone suggested a manager problem; the discussions and data show allocation is informal, priorities shift without notice, and after-hours contact has become an expectation.

Formal assessment is limited to the interaction between workload, role clarity and after-hours contact, because the isolation issue has a known control. Controls include a visible allocation register with capacity limits, one accountable owner per matter, a contactability standard confirming non-urgent out-of-hours messages need no response, team-set collaboration days, and one-to-ones with an escalation path independent of the direct manager.

Verification follows the controls: after-hours message volume, monthly sampling of register accuracy, and a repeat pulse at three months reported only in groups large enough to preserve confidentiality. At three months the register is being bypassed for urgent work, so the process is revised rather than declared effective.

There is no general Australian rule that a psychosocial risk assessment must be reviewed annually. Model WHS and Victorian regulations both impose event-based review requirements, but their triggers and wording differ, so the applicable instrument governs. The common logic is to review controls when they are not effective, before a change that may give rise to a new or different risk, when a new hazard is identified, when consultation indicates review is needed, and when a health and safety representative requests review in the circumstances the applicable law recognises. Incidents, adverse findings, claims activity and regulator engagement are also review events.

A scheduled cadence — annually for the framework, more often for high-exposure areas — can be sensible assurance practice. It is a governance choice, not a statutory deadline, and should not displace trigger-based reviews.

Australian Workplace Strategies works on the operating system behind psychosocial risk rather than on isolated documents. Our psychosocial safety and WHS practice supports hazard identification, consultation design, risk assessment where warranted, control selection focused on work design, and verification. Our workplace advisory and compliance practice covers policy architecture, manager capability and the interface with complaints and investigations.

Where an organisation wants hazards, controls, evidence, actions and review triggers in one auditable place, our GRC technology practice and the Strobe platform support that record. AWS is not a law firm and does not provide legal advice; jurisdiction-specific instruments should be checked and legal advice obtained where a matter requires it.