Every Australian business, from a sole trader working alone to a national company, carries legal duties for the health and safety of the people who work for it. Those duties come from the work health and safety (WHS) laws that most states and territories adopted from 2012, replacing a patchwork of older occupational health and safety regimes with one national model framework. Western Australia was the last state to join, when its Work Health and Safety Act 2020 (WA) commenced on 31 March 2022, and Victoria continues to run its own separate Occupational Health and Safety Act 2004 (Vic).
Getting WHS wrong can cost far more than a fine. A serious breach can mean criminal prosecution of both the business and its directors, personal liability for officers, improvement and prohibition notices that halt work, and civil claims from injured workers. There is also a positive case for compliance: fewer injuries, lower workers' compensation premiums and less downtime.
This guide sets out who the WHS duties fall on, what the law actually requires of each duty holder, the penalties for non-compliance, and the practical steps a small or medium business can take to stay on the right side of the regulator.
Who the WHS duties fall on
The model WHS laws attach duties to three groups, and most businesses will find themselves in more than one of them.
- Person conducting a business or undertaking (PCBU): any business or undertaking, conducted alone or with others, whether or not it is run for profit. This covers companies, sole traders, partnerships and unincorporated associations. There is no size threshold: a one-person operation is a PCBU.
- Officers: directors and other people who make, or participate in making, decisions that affect the whole or a substantial part of the business, such as a chief executive or senior manager.
- Workers: defined broadly to include employees, contractors and subcontractors and their employees, labour hire workers, outworkers, apprentices and trainees, students on work experience and volunteers.
The trigger is simple. If you conduct a business, you are a PCBU and the primary duty applies to you regardless of your headcount or turnover. Under s 5 of the Work Health and Safety Act 2011 (Cth) (the Act), the only people who do not conduct a business or undertaking are individuals engaged solely as a worker in, or as an officer of, that business or undertaking.
One practical point worth checking early: the model laws apply in all states and territories except Victoria, and each jurisdiction implements them with its own Act, regulations and penalty amounts. A business with sites in more than one state should confirm which WHS Act applies to each site rather than assuming one set of paperwork covers everything.
The primary duty of care
The central obligation sits with the PCBU. Under s 19 of the Work Health and Safety Act 2011 (Cth), a person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers engaged or caused to be engaged by the person, and must ensure that the health and safety of other persons is not put at risk from the work carried out as part of the business or undertaking.
The duty is wider than most business owners assume. It reaches contractors, subcontractors, labour hire workers and volunteers, not just employees. It also reaches people who are not workers at all, such as customers, visitors, delivery drivers and members of the public who could be harmed by the work. So far as is reasonably practicable, the duty includes:
- providing and maintaining a work environment without risks to health and safety;
- providing and maintaining safe plant and structures;
- providing and maintaining safe systems of work;
- the safe use, handling and storage of plant, structures and substances;
- providing adequate facilities for the welfare of workers at work; and
- providing the information, instruction, training and supervision needed to protect people from risks arising from the work.
The phrase "reasonably practicable" does the heavy lifting in this area of law. Section 18 of the Act defines it as what is reasonably able to be done, taking into account and weighing up the likelihood of the hazard occurring, the degree of harm that might result, what the person knows or ought reasonably to know about the risk and how to control it, the availability and suitability of ways to eliminate or minimise the risk, and the cost of those measures, including whether the cost is grossly disproportionate to the risk.
Two consequences follow. First, the standard is not absolute safety: a business is not expected to do the impossible, and cost can be weighed once the risk and available controls have been properly assessed. Second, because the test asks what you knew or ought to have known, ignorance is no defence. The more serious and foreseeable the harm, the more the law expects you to do, and a business cannot plead that it simply never thought about a risk that a reasonable operator in its industry would have identified.
The duty of officers
Directors and senior managers carry their own duty under s 27 of the Act. If a PCBU has a duty, each of its officers must exercise due diligence to ensure the PCBU complies with it. This duty is personal to each officer and cannot be delegated: appointing a WHS manager or a safety consultant does not discharge it.
Under s 27(5), due diligence includes taking reasonable steps to:
- acquire and keep up-to-date knowledge of work health and safety matters;
- understand the nature of the business's operations and the hazards and risks associated with them;
- ensure the business has available for use, and actually uses, appropriate resources and processes to eliminate or minimise risks;
- ensure there are processes for receiving and considering information about incidents, hazards and risks, and for responding to that information in a timely way;
- ensure the business has, and implements, processes for complying with its duties, such as reporting notifiable incidents, consulting workers, complying with notices and providing training; and
- verify that those resources and processes are actually provided and used.
The last element is the one that catches officers out. Due diligence is not satisfied by signing off a policy once a year. The Act requires officers to verify that the safety resources and processes are real and working, which means asking for evidence, testing systems and following up on what they find.
Officers should also understand that their liability does not depend on the company being convicted. Under s 27(4), an officer can be prosecuted for a breach of the duty even if the PCBU has not been convicted of an offence. "The company will wear it" is not a strategy that protects a director.
The duties of workers
Workers also owe duties, set out in s 28 of the Act. While at work, a worker must take reasonable care of their own health and safety, take reasonable care that their acts or omissions do not adversely affect the health and safety of other people, comply, so far as they are reasonably able, with reasonable instructions given by the PCBU to allow it to comply with the Act, and co-operate with any reasonable policy or procedure relating to health or safety at the workplace that has been notified to them.
In practice this means compliance is a shared effort: workers are expected to follow the safety procedures, use the equipment provided and report hazards, and a worker who disregards a clear safety instruction may themselves face consequences. But the heavier load sits with the PCBU and its officers. Under s 16 of the Act, more than one person can hold the same duty, and each duty holder must comply to the required standard even if another duty holder also has the duty. A worker's failure to follow a procedure does not excuse the business's failure to train, supervise and enforce that procedure.
Consultation is a duty, not a suggestion
The WHS laws treat consultation as a compliance obligation in its own right, not a management nicety. Under s 47 of the Act, a PCBU must, so far as is reasonably practicable, consult with workers who carry out work for the business and who are, or are likely to be, directly affected by a matter relating to work health or safety. Genuine consultation means giving workers a reasonable opportunity to express their views on the matter, taking those views into account, and advising workers of the outcome in a timely way.
There is a related duty that matters for businesses that use contractors or labour hire. Under s 46, when more than one person has a duty in relation to the same matter, each duty holder must, so far as is reasonably practicable, consult, cooperate and coordinate activities with the others. A head contractor cannot simply assume a subcontractor has handled site safety, and a host business cannot assume a labour hire provider's safety paperwork covers its workplace. The laws also make provision for health and safety representatives and committees, so workers who want a structured voice in safety decisions have a mechanism to get one.
The consequences of non-compliance
Failure to comply with a WHS duty is a criminal offence under the model laws, graded into three categories. The current indexed maximums under the Commonwealth Act are set out in Schedule 4:
- Category 1: engaging in conduct with negligence, or recklessly, that exposes a person to a risk of death or serious injury or illness. An individual acting as a PCBU or officer faces up to $3,000,000 or 15 years imprisonment, or both. A body corporate faces up to $15,000,000.
- Category 2: failing to comply with a duty where the failure exposes an individual to a risk of death or serious injury or illness. Up to $418,000 for an individual, and $2,090,000 for a body corporate.
- Category 3: failing to comply with a duty, without the exposure element. Up to $140,000 for an individual and $700,000 for a body corporate.
These are the Commonwealth Act's figures and they are indexed over time, and each state and territory sets its own penalty amounts in its own Act. The amounts will differ slightly from jurisdiction to jurisdiction, so check the figures in the state where your workers are based rather than relying on a single national number.
Fines are only part of the picture. Regulators can issue notices that require problems to be fixed, including prohibition notices that stop dangerous work immediately, and failure to comply with a notice is itself an offence. Officers can be prosecuted personally. An injured worker may be entitled to workers' compensation through their state or territory scheme, and a worker harmed by a serious breach may pursue a common law negligence claim against the business. A workplace death can bring an even more serious investigation, with the regulator and, in some cases, the police examining how the incident occurred.
A practical WHS compliance checklist
For a small or medium business, sensible compliance comes down to a manageable set of actions:
- Know your duty holders: Identify who in the business is a PCBU, who the officers are, and who the workers are, including contractors, labour hire and volunteers. Document it.
- Appoint a WHS owner: Give one person day-to-day responsibility for safety, and make clear that this does not shift the officers' personal duty.
- Assess the risks: Walk the premises, plant, substances and work systems and identify what could hurt someone. For each risk, consider ways to eliminate it first, and only settle for measures that merely reduce the risk where elimination is not reasonably practicable.
- Write policies that match the real risks: Generic policy templates are a common failure point. Your policies should reflect the actual hazards in your business, the current law in your state, and who is affected, including visitors and subcontractors.
- Train and record: Induct new workers, refresh training when work changes, and keep records of who was trained and when.
- Consult and record: Give workers a genuine opportunity to raise safety issues and record what was discussed and what changed as a result.
- Report and respond: Report notifiable incidents, such as a death, a serious injury or illness or a dangerous incident, to your regulator, and investigate near misses so they do not become injuries.
- Review after change: Update your risk assessments and policies after any change to the workplace, new equipment, a new type of work, an incident or a worker complaint, and review them on a regular cycle regardless.
When a WHS lawyer can help
A WHS lawyer can review your policies and risk assessments against the current law in your state, help design a consultation process that meets the statutory standard, and advise directors on what due diligence looks like in practice for their particular business. The more valuable role is often reactive: if a regulator issues a notice, investigates an incident or begins a prosecution, a lawyer who knows the WHS regime can manage the regulator relationship, advise on what must be disclosed, and in some cases negotiate an enforceable undertaking as an alternative to prosecution. Given the penalty levels involved, the cost of advice before an incident is trivial compared with the cost of defending a prosecution after one.
The officer duty is the part most businesses miss
Most small and medium business owners know they have to keep the workplace safe. What they most often miss is that the directors and senior managers personally owe a separate duty to verify that safety is actually working, and that this duty survives even if the company escapes conviction. A folder of policies does not discharge it, because the law asks what you did to check the controls were being used, not what you intended to happen.
The first action to take this week is to sit down with your co-directors and ask one question: what evidence do we hold, in records rather than in memory, that our safety controls are working on the ground? If the answer is that you would struggle to produce it, that gap between the policy and the practice is where your personal liability sits.