Psychosocial hazards at work and what the law requires of your business

Every Australian business now has a legal duty to manage the psychosocial hazards its workers face. These are the aspects of work design, management and workplace behaviour that can cause psychological harm: excessive job demands, low control over how work is done, bullying, harassment, poor support, and remote or isolated work, to name a few.

This is not a soft or optional area of workplace wellbeing. The Work Health and Safety Act 2011 (Cth) (the WHS Act) defines health as including psychological health, and the regulations made under it impose specific, enforceable duties on businesses to deal with psychosocial risks. A business that ignores them faces the same enforcement machinery as one that ignores a physical safety hazard: fines running into the millions, prosecution of individual directors, and civil claims from injured workers.

This article sets out who owes those duties, the three-step process the law requires (identify, assess, control), what the penalties look like if you get it wrong, and where a lawyer can help.

Who owes the psychosocial hazard duties

The central duty falls on every person conducting a business or undertaking, known as a PCBU. That includes companies, partnerships, sole traders who employ staff, and not-for-profits. There is no turnover or headcount threshold: the duty applies to a two-person operation as much as to a two-hundred-person one. Under s 19 of the WHS Act, a PCBU must ensure, so far as is reasonably practicable, the health and safety of its workers and of other people affected by the work.

Two other groups carry personal responsibility:

• Officers: Directors and senior managers must exercise due diligence to make sure the business complies with its WHS duties. This is a personal obligation under s 27 of the WHS Act, so a director cannot simply point to the business as the wrongdoer.
• Workers and other people at the workplace: They must comply with reasonable safety instructions and cooperate with the business on health and safety matters.

The duty is not absolute. It is qualified by "reasonably practicable", which s 18 of the WHS Act defines by reference to the likelihood of the hazard occurring, the degree of harm that might result, what the business knows or ought to know about the hazard and possible controls, the availability and suitability of those controls, and whether the cost of a control is grossly disproportionate to the risk. That phrase, "reasonably practicable", is the yardstick against which every step in this article is measured, and it is the ground on which prosecutions are fought.

What counts as a psychosocial hazard

The Work Health and Safety Regulations 2011 (Cth) (the WHS Regulations) define the terms precisely. A psychosocial hazard is a hazard that arises from or relates to the design or management of work, a work environment, plant at a workplace, or workplace interactions or behaviours, and that may cause psychological harm, whether or not it also causes physical harm. A psychosocial risk is the risk to health or safety that flows from such a hazard.

Safe Work Australia groups the common psychosocial hazards into a practical list. As a self-assessment starting point, work through these categories:

• Job design and demands: high job demands, low job control, lack of role clarity, and poor support.
• Fairness and change: poor organisational change management, inadequate reward and recognition, and poor organisational justice.
• Workplace interactions: bullying, harassment including sexual and gender-based harassment, violence and aggression, and conflict or poor workplace relationships.
• Circumstances and environment: remote or isolated work, exposure to traumatic events or material, and a poor physical environment.

The harm these hazards cause is real and measurable. Stress itself is not an injury, but stress that is frequent, prolonged or severe can produce psychological harm such as anxiety, depression, post-traumatic stress disorder and sleep disorders, or physical harm including musculoskeletal injuries, chronic disease and fatigue-related injuries. The data explains why regulators treat this seriously: Safe Work Australia reports that mental health conditions accounted for 9% of all serious workers' compensation claims in 2021-22, a rise of almost 37% since 2017-18, and that these claims lead to significantly more time off work and higher compensation paid than other injury types.

Step 1: Identify the hazards

The duty to identify comes first. Regulation 34 of the WHS Regulations requires a duty holder managing risks to health and safety to identify reasonably foreseeable hazards, and the same obligation applies to psychosocial hazards through the specific psychosocial risk provisions.

Identification is a practical exercise, not a paperwork one. The people who know the work best are the workers doing it, so the starting point is consultation: surveys, focus groups, feedback sessions and regular one-on-ones. Data held by the business can point to problems too, including absenteeism and turnover patterns, performance issues, incident reports, and complaints history. Exit interviews with departing staff are a cheap and honest source of information about what is wrong.

Two features of psychosocial hazards make identification harder than finding a frayed ladder. First, hazards can be embedded in how work is designed rather than visible at a workplace. A team that is permanently understaffed, a rostering system that gives workers no predictability, or a manager promoted without training are hazards that do not announce themselves. Second, hazards interact and combine. Safe Work Australia warns that psychosocial hazards may interact to create new, changed or higher risks, so hazards should not be considered in isolation. High workload becomes a much higher risk when workers cannot take breaks, have no one to help, or fear reporting problems.

Step 2: Assess the risk

Once hazards are identified, the risk they create must be assessed. Regulation 55C of the WHS Regulations requires a PCBU to manage psychosocial risks in accordance with Part 3.1 of the regulations, the general risk management process, and to implement the control measures required by regulation 55D.

Regulation 55D sets out what a proper assessment must weigh. The PCBU must have regard to all relevant matters, including:

• the duration, frequency and severity of worker exposure to the psychosocial hazards;
• how the hazards may interact or combine;
• the design of work, including job demands and tasks;
• the systems of work, including how work is managed, organised and supported;
• the design, layout and environmental conditions of the workplace and of workers' accommodation;
• workplace interactions or behaviours; and
• the information, training, instruction and supervision provided to workers.

Duration, frequency and severity are the heart of the assessment. The same hazard carries very different risk depending on exposure. A worker who works almost entirely remotely in isolation faces a far greater risk of harm from remote or isolated work than one who works from home one day a fortnight. A worker exposed to aggressive behaviour from clients is at greater risk if they have no support system, no training in de-escalation, and no control over the situation, than a worker who has all three. The assessment should also weigh the s 18 factors: the likelihood of harm, the degree of harm that might result, what the business knows or ought to know, and whether the cost of a control is grossly disproportionate to the risk.

The assessment does not need to be a scientific exercise, but it does need to be genuine, proportionate to the size of the business, and written down. A dated record of the assessment, the reasoning behind it, and the controls chosen is the document a regulator, insurer or court will ask for first.

Step 3: Control and review

With the risk assessed, the PCBU must control it. Section 17 of the WHS Act requires risks to be eliminated so far as is reasonably practicable, and if elimination is not reasonably practicable, minimised so far as is reasonably practicable. The WHS Regulations set out a hierarchy of control measures, and the same hierarchy applies to psychosocial risk.

Elimination is often more achievable for psychosocial hazards than people assume. Redesigning a job to remove an unnecessary peak workload, splitting a role whose demands are unmanageable, or stopping a practice that exposes workers to regular client aggression may eliminate the hazard entirely rather than just manage it. Where elimination is not reasonably practicable, controls include substituting the hazard for something less harmful, isolating workers from it, and implementing engineering controls, followed by administrative controls such as clear policies, better rostering, training for managers and workers, and reliable reporting and support pathways.

Two further duties round out the process. Regulation 37 requires controls to be maintained so they remain effective, and regulation 38 requires review and revision of controls when a control is not working, when work changes, when new workers are exposed, or after an incident. A policy that exists only in a folder and is never enforced is not a control; it is evidence of a failure to comply.

The code of practice sets the benchmark

Safe Work Australia has published a model Code of Practice: Managing psychosocial hazards at work, and the Commonwealth approved its own version, the Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024, which has been in force since 1 November 2024. States and territories have approved the model code in their own jurisdictions.

The code matters for two reasons. Practically, it walks through exactly how to identify, assess, control and review psychosocial risks, with examples drawn from real workplaces. Legally, under s 275 of the WHS Act, an approved code of practice is admissible in proceedings as evidence of whether a duty has been complied with, and a court may rely on it in deciding what was reasonably practicable. In short, if a business departs from the code, it needs a good, documented reason, because the code is what a court will measure the business against.

What happens if you get it wrong

The consequences of failing to manage psychosocial risks are the same as for any WHS failure. Under the WHS Act:

• A Category 1 offence, engaging in reckless or negligent conduct that exposes a worker to a risk of death or serious injury or illness, carries a maximum penalty of $15 million for a body corporate and, for an individual, up to $3 million or 15 years' imprisonment.
• A Category 2 offence, failing to comply with a duty where the failure exposes a person to a risk of death or serious injury or illness, carries up to $2.09 million for a body corporate.
• A Category 3 offence, failing to comply with a duty without that exposure element, carries up to $700,000 for a body corporate.

These are the current amounts under the Commonwealth Act, and each state and territory sets its own comparable penalties under its own WHS legislation. Industrial manslaughter offences, which apply where conduct causes a death, carry penalties of up to $18 million for a body corporate under the Commonwealth Act.

Officers should note that their personal exposure is not theoretical. A director or senior manager who fails to exercise due diligence can be prosecuted in their own right, and the penalties for officers run into the millions. Beyond fines, a business that gets this wrong faces improvement and prohibition notices from the regulator, prosecution and conviction records, civil claims from workers who suffer psychological injury, and rising workers' compensation premiums. The Safe Work Australia data on time off work and claim costs shows that psychological injuries are among the most expensive claims a business can generate.

A practical compliance checklist

For a business starting out, the steps are:

• Nominate someone with real authority to own psychosocial risk, and make sure the board or owners are briefed on it.
• Consult workers and their representatives about where the pressure points are.
• Work through the code of practice hazard list and identify which hazards exist in your workplace, including in the design of jobs and rosters.
• Assess each hazard for the duration, frequency and severity of exposure, and for how hazards combine.
• Choose controls using the hierarchy, eliminating the hazard where reasonably practicable and documenting why any residual risk is acceptable.
• Record the assessment, the controls, and the review dates, and keep the records.
• Train managers to recognise and respond to psychosocial hazards, and give workers confidential ways to report concerns.
• Review the assessment whenever work changes, after incidents, or when a control stops working.

When to get legal help

A WHS lawyer can help at several points. Before a problem arises, a lawyer can review a psychosocial risk assessment and the policies that support it against the code of practice, and advise on what "reasonably practicable" means for a particular business and budget. When the regulator comes knocking with a notice, an investigation or a prosecution, a lawyer can manage the response, protect officers' positions, and build the defence, which will often turn on whether the business genuinely assessed the risk and acted on it. A lawyer can also advise on civil claims from workers who say they were psychologically injured at work, where the risk assessment records will be central evidence.

The record is the thing an inspector will ask for first

The step most businesses miss is not the identification or the training, but the written assessment that ties the two together. It is common to find a workplace that has run surveys and bought an employee assistance program, yet has no document showing which psychosocial hazards it identified, how it weighed the duration, frequency and severity of exposure, and why the controls it chose were reasonably practicable. When a worker lodges a claim or an inspector arrives, that gap becomes the case against the business.

The first action to take this week is to work through the hazard list in the code of practice, rate each hazard that exists in your workplace for duration, frequency and severity, and record the controls and review dates in a dated document. A written, reasoned assessment is the single best evidence that your business took the duty seriously, and it is the document a court will look at if the duty is ever tested.