What to do after your psychosocial survey: the next step for Australian employers

The short answer: a psychosocial survey is the start of your duty, not the end of it. Once you have results, you are expected to triage what the survey found, decide which hazards to control first, choose controls that change how the work is done (not just add a wellbeing perk), record those decisions, consult your workers about them, assign owners and dates, and then review whether the controls worked. The survey produces information. What an inspector or a claim looks for is what you did with it. This guide walks you through that “what next”, in plain language, with the records to keep at each step.

If you have just run a survey through People at Work, a pulse tool, or your own questionnaire, and you are staring at the results wondering what you are actually supposed to do now, this is written for you.

First, why finishing the job matters more than starting it

Running the survey can quietly increase your exposure if you stop there. Once you have asked workers about hazards and they have told you, you are on notice. You now know about risks you may not have formally known about before. Doing nothing with that knowledge is harder to defend than never having surveyed at all. This is the “can of worms” worry many employers have, and it is a real one, but the answer is not to avoid surveying. The answer is to have a plan for acting on what you find before the results land.

So the goal after a survey is straightforward to state: turn the findings into a documented set of decisions and actions, and keep a record that shows you took the duty seriously. That record is what gives you something to point to if a regulator asks, or if a claim is made.

A note on language as you go. Australian workplace safety law uses specific words, and using them correctly genuinely matters, both because the obligations attach to those words and because workers and regulators respond to them. You will see “reasonably practicable”, “hierarchy of controls”, “consultation”, and “due diligence” through this guide. We explain each as it comes up.

Step 1: Make sense of the results (triage)

Start by sorting what the survey surfaced. Most surveys will hand you a mix: a few sharp, clearly serious issues, a larger band of moderate concerns, and some low-level noise. Your first job is to separate them.

For each hazard the survey raised, ask two questions. How likely is this to cause harm, and how serious would that harm be? A hazard that is both likely and serious goes to the top of the list. A hazard that is unlikely and minor goes to the bottom. This is a basic risk rating, and you do not need a consultant to do the first pass, though you can bring in your own suitably qualified adviser where the stakes are high.

The common psychosocial hazards you are rating against include things like unreasonable workload, low job control, poor support from managers, bullying or harassment, role ambiguity, poor change management, and exposure to traumatic content or aggression. Map each survey finding to the hazard it represents, so you are working with named hazards rather than a wall of free-text comments.

Record to keep at this step: a risk register. This is simply a list of each identified hazard, a short description of what the survey told you, and your likelihood-and-severity rating. It does not need to be elaborate. A clear, dated table is enough to show you assessed what you found rather than ignoring it.

Step 2: Decide what you can reasonably do about each one

Once hazards are rated, you decide on controls. The legal standard here is “reasonably practicable”, which means you weigh the level of risk against what it would take to reduce it: time, cost, effort, and the availability of solutions. You are not expected to eliminate every risk at any cost. You are expected to do what is reasonable given the risk in front of you.

The part that trips up most employers is the type of control. There is an order of preference, often called the hierarchy of controls, and for psychosocial hazards the higher-order controls are the ones that change how the work is designed and managed. A wellbeing app, an Employee Assistance Program, or a resilience workshop sits near the bottom of that order. They can help people cope, but they do not remove the hazard. If your survey said workload is crushing people, the higher-order control is to look at the workload, the staffing, the deadlines, or the way work is allocated, not only to offer counselling for the stress it causes.

This is the single most common gap regulators and advisers point to: a policy, an EAP, and some training, with nothing that addresses the design of the work itself. When you choose controls, push yourself to name at least one higher-order action for your most serious hazards.

Record to keep at this step: for each priority hazard, the control or controls you have chosen, and a short note on why they are reasonable given the risk. If you considered a higher-order control and decided it was not reasonably practicable right now, write down why. That reasoning is itself part of a defensible record.

Step 3: Consult your workers before you lock it in

Consultation is a legal duty, not a courtesy, and it is also where the survey’s value compounds. You are expected to consult workers (and their representatives, where they have them) about hazards that affect them and about the measures you propose to manage those hazards.

Practically, this means taking your draft controls back to the people the survey heard from, or to a representative group, and asking whether the plan makes sense, whether you have read the problem correctly, and whether the proposed fix would actually help. Workers often know which lever matters most, and consulting them improves the control and creates a record that you did it.

Handle this carefully so it does not feel like a box-tick or invite a flood of complaints you cannot action. Be clear about what you are doing, what you can change in the near term, and what will take longer. Honesty about constraints reads better than silence.

Record to keep at this step: a consultation log. Dates, who was consulted, in what forum (team meeting, survey debrief, health and safety committee, written feedback), what was raised, and how it changed the plan. This is one of the records inspectors most often want to see, because consultation is hard to fake after the fact.

Step 4: Assign owners, dates, and turn the plan into tracked actions

A plan with no owner and no date is not a control, it is an intention. For each action you have decided on, name the person responsible and set a target date and a review point. Then track it the way you would track any other piece of work that has to get done.

This is where most documentation falls apart, not at the assessment stage but in the months after, when the spreadsheet goes stale and no one can show whether the actions actually happened. The record that holds up is a live action tracker: each control, its owner, its due date, its current status, and what evidence shows it was done.

Record to keep at this step: an action tracker showing status over time, not just a one-off plan. The difference between “we wrote a plan” and “we worked the plan and here is the trail” is exactly the difference a regulator or an insurer is looking for.

Step 5: Review whether the controls worked, and tell your leadership

Controls are not set-and-forget. After a reasonable period, check whether each one made a difference. Did workload measures actually reduce the load? Did the reporting channel get used? Sometimes a re-survey or a pulse check tells you; sometimes it is incident data, turnover, or simply asking. Where a control did not work, you adjust, and you record that you reviewed and adjusted. That review loop is part of the duty: identify, assess, control, consult, review.

Your officers (directors and senior managers) carry a personal due-diligence duty, which means they are expected to actively understand the risks and verify that the organisation is managing them, not just sign off from a distance. So the review should roll up into something leadership actually sees: a short, plain report of where the hazards stand, what has been done, and what is outstanding. That leadership reporting both discharges part of the officer duty and gives your board or owners the line of sight they are expected to have.

Record to keep at this step: a dated review note for each control, and a leadership-reporting summary that shows the issue reached the people accountable for it.

What “defensible documentation” actually looks like

Putting the five steps together, here is the evidence trail that a sound post-survey process leaves behind. If you can produce these, you can show your working:

1. A risk register listing each identified hazard, its description, and its rating.
2. A controls decision record showing what you chose and why it is reasonable, including any higher-order controls.
3. A consultation log showing you involved workers in the hazards and the proposed measures.
4. A live action tracker with owners, dates, status, and completion evidence.
5. Dated review notes showing you checked whether controls worked and adjusted where they did not.
6. A leadership-reporting summary showing the matter reached your officers.

None of this requires a clinical assessment or legal opinion to start. It requires that the decisions, the consultation, and the follow-through are written down, kept current, and linked together so they read as one continuous record rather than scattered files.

Where PsychSecure fits

PsychSecure is a managed service that supports employers to implement and maintain exactly this post-survey workflow and to create defensible documentation aligned with applicable WHS guidance. In practice that means we help you take survey findings and turn them into a graded risk register, a controls plan with higher-order actions surfaced rather than buried, a consultation log, an action tracker with named owners and review points, and a leadership-ready summary, kept in one maintained record that is built to drop into your due-diligence file.

It is decision-support and workflow automation. It is not legal advice, it is not a clinical diagnostic tool, and it does not by itself make your organisation compliant. The primary duty stays with you. What PsychSecure does is help you evidence that you took it seriously and keep that evidence current after the survey, which is the part most tools and most generic guidance leave you to figure out alone.

If you have a survey result in hand and you want to see what the maintained record looks like, a 15 to 20 minute call will walk you through a sample and confirm whether it fits your organisation.

A short FAQ

How long after a survey should we act? Promptly. There is no universal fixed deadline, but the longer a known serious hazard sits without a documented response, the harder it is to defend. Prioritise the most serious findings first and show movement.

Do we have to fix everything the survey found? No. You act on what is reasonably practicable, weighing the risk against the effort to control it. The point is to show a reasoned, recorded process, not perfection.

Is an EAP enough? On its own, generally no. An EAP helps people cope with harm but does not remove the hazard. For serious findings, regulators and advisers expect to see controls that change the work itself, with the EAP as support rather than the main answer.

What if surfacing problems creates claims? Acting on what you find, and recording that you acted, is your strongest position. Doing nothing with known hazards is the weaker one. Consultation and a clear action trail reduce, rather than increase, your exposure.

Do we need an external adviser? Not always for the first pass. Engaging your own suitably qualified adviser adds independent assurance on the record, which can matter for a board, an insurer, or a higher-stakes situation. Many employers run the core process internally and bring in independent review where the stakes warrant it.