Psychosocial Hazards:
The Compliance Gap Most
Small Businesses Don't Know They Have

Psychosocial hazards are work-related factors that can cause psychological or physical harm. They are not soft HR matters — they are a legal compliance obligation under WHS legislation in every Australian state and territory.

• Review the 14 hazard categories and identify which are most relevant to your workplace
• Understand that "we're fine" is not a compliant response — you need documentation
• Read the relevant Code of Practice for your state (links included in kit)

Each state has its own legislation and regulator, but the obligations are essentially the same: identify, assess, control, and review psychosocial risks. Psychosocial hazards must be treated with the same rigour as physical hazards — the "so far as is reasonably practicable" duty applies.

• NSW: Work Health and Safety Act 2011 (NSW) — WHS Reg 2017, Part 3.1A (psychosocial)
• VIC: Occupational Health and Safety Act 2004 — s.21 employer duty of care
• QLD: Work Health and Safety Act 2011 (QLD) — WHSR 2011 amendments 2023
• SA: Work Health and Safety Act 2012 (SA)
• WA: Work Health and Safety Act 2020 (WA) — WHS Reg 2022
• TAS/NT/ACT: National model WHS laws and Psychosocial Hazards Code of Practice

All states except Victoria have adopted the Safe Work Australia Psychosocial Hazards Code of Practice. Victoria has its own WorkSafe Victoria guidance. Your compliance process must reference the correct document for your state.

• Identify your state regulator's specific guidance materials
• Check whether your state has additional psychosocial-specific regulations (e.g. NSW WHS Reg 2017 Part 3.1A)
• Note any industry-specific guidance from your regulator

Primary: your employees. Your duty to manage psychosocial risks applies first and most comprehensively to all employees — full-time, part-time, and casual. Document your worker list and roles.

• List all employees by role and work arrangement
• Note anyone in high-exposure roles (customer-facing, isolated, high-demand positions)
• Document the employment relationship for each (to establish duty of care clearly)

Walk through all 14 hazard categories and assess which are present in your workplace, at what level of risk, and for which workers. Use both data (incident reports, sick leave, turnover) and direct worker input.

• Complete the Psychosocial Risk Register (template included) — rate each hazard category for likelihood and consequence
• Review your incident and near-miss records for psychosocial indicators
• Review sickness absence and turnover data for patterns
• Review any complaints, grievances, or bullying reports from the past 2 years
• Consider your work design: shift patterns, workload distribution, supervision arrangements

For each identified hazard, implement the highest-order control reasonably practicable. The hierarchy of controls applies to psychosocial hazards just as it does to physical ones.

• Eliminate: Can you redesign the work to remove the hazard? (e.g. reduce excessive workload by redistributing tasks)
• Substitute: Can you replace a high-risk work arrangement? (e.g. change shift patterns to reduce fatigue)
• Engineering/Administrative: Procedures, supervision structures, rostering policies, complaints processes
• Document each control against the corresponding hazard in your risk register — with responsible person and review date

Consultation is a legal requirement, not optional. You must consult workers when identifying hazards and determining controls. This must be documented — verbal conversations alone are not sufficient.

• Use the Worker Consultation Framework template (included) to structure and record the process
• Identify your consultation mechanism: Health and Safety Representative (HSR), toolbox talk, team meeting, or individual discussions
• Record who was consulted, when, on what hazard categories, and what outcomes were agreed
• Workers must have a genuine opportunity to contribute — consultation must happen before decisions are finalised

If you can't show it, you can't prove it. Documentation is what separates a compliant business from one that is vulnerable to a non-compliance action or incident investigation. The six key documents in this kit cover everything you need.

• Psychosocial Hazard Policy (signed and dated)
• Psychosocial Risk Register — completed and reviewed
• Worker Consultation Record — showing genuine engagement
• Management Accountability Checklist — signed by supervisors
• Incident Response Procedure — in place before any incident occurs
• EAP Referral Process documentation (even if you use a free EAP)

Psychosocial risk management is not a one-off exercise. Hazards change as your work, team, and business circumstances change. You need a monitoring system that catches emerging issues early.

• Schedule regular check-ins with workers on workload, support, and workplace relationships
• Monitor sickness absence, turnover, and complaints data quarterly for patterns
• Ensure your incident reporting process explicitly captures psychosocial incidents (not just physical ones)
• Use the Risk Register review schedule to trigger formal reassessment at minimum annually

Your psychosocial duties extend beyond your direct employees to non-employees whose work is influenced or directed by you. These obligations use different Act references and must be documented separately from your employee risk management process.

• WHS Act states (non-VIC): Duties under s.19(1) and s.19(3)(a) — PCBU must manage risks to all persons at the workplace or whose work activities are influenced/directed by the PCBU
• Victoria (OHS Act 2004): s.21(2)(e) — employer duty to persons other than employees affected by the undertaking
• Document each non-employee category, the control measures applied, and how psychosocial risks unique to their work type are managed
• Labour hire workers: both the host business AND the labour hire company have separate, concurrent duties

A compliant psychosocial risk management system is a living document. You must review it when circumstances change — and at minimum annually.

• Trigger reviews after: any psychosocial incident or near-miss, a workplace change (new roles, restructure, new processes), a significant change in team composition or working arrangements, a regulatory inspection or non-compliance notice
• Re-consult with workers after any significant change to risk controls
• Update the Risk Register to reflect the current state — not last year's
• Ensure management accountability is re-confirmed and documented annually

Your goal: a psychosocial risk management system that you can place in front of any safety regulator and demonstrate exactly what you've done, why, and when.