No HR or safety team? Where a small business starts with psychosocial risk

If you run a small business, a cafe, a trades firm, a 15-person agency, you have probably heard that you now have to manage psychosocial risk, and you may have quietly assumed that rule was written for big companies with a safety department and an HR team. It was not. The duty applies to small employers too. The good news is that the law is meant to be proportionate to the size and nature of your business. A five-person cafe is not expected to do what a thousand-person logistics company does. You are expected to do what is reasonable for a workplace like yours.

This guide is for the owner who has no HR person, no safety officer, and no spare hours, and who just wants to know where to actually start. It explains the duty in plain English, sets out the genuine first moves in order, and is honest about what you can do yourself and where a hand is worth it. It is general information to help you get going, not legal advice.

What the duty actually is, in one paragraph

Australian work health and safety law treats psychosocial hazards, the parts of work that can harm mental health, the same way it treats physical safety hazards. The hazards are things like an unmanageable workload, bullying or harassment, low control over how the work gets done, poor support, role confusion, and exposure to distressing situations or aggressive customers. Your duty is a simple loop to remember: find the hazards that apply to your workplace, judge how serious they are, do what is reasonably practicable to control them, talk with your workers about it, and review whether it is working. The same duty you already have for physical safety now covers psychological safety, and you are expected to be able to show what you did.

”Reasonably practicable” is the phrase that protects a small business

The phrase that matters most for you is “reasonably practicable”. It means you weigh the level of risk against what it would take to reduce it: the time, the cost, the effort, and whether a solution is even available. You are not expected to eliminate every risk at any cost, or to run the same machinery a large corporation runs. For a small business, a sensible, proportionate, written response to the hazards that genuinely apply to your workplace is the standard, not a thick compliance manual you will never keep current. Proportionate and recorded beats elaborate and abandoned.

The first moves, in order

Here is a practical path you can start this week. You do not need a consultant to take the first pass, though you can bring in your own suitably qualified adviser where the stakes are higher.

1. List the hazards that genuinely apply to your workplace. Sit down for half an hour and write down where the pressure actually sits. A cafe might list aggressive customers, understaffed shifts, and a split between full-timers and casuals who feel out of the loop. A trades firm might list tight deadlines, lone work on remote sites, and the way a bad job rolls downhill onto the crew. Work from your real workplace, not a generic checklist.

2. Rate each one for how likely and how serious. For every hazard, ask two questions. How likely is this to cause harm, and how bad would the harm be? Something both likely and serious goes to the top of your list. Something rare and minor goes to the bottom. This is a basic risk rating, and a plain dated table is enough. The point is to show you thought about what you found rather than ignoring it.

3. Decide what you can reasonably do about the top few. Start with your highest-rated hazards and pick controls. The most effective controls change how the work is designed and run, things like fixing a roster that leaves one person alone on a closing shift, setting realistic deadlines, or changing how a difficult customer situation is handled. An Employee Assistance Program, a wellbeing app, or a one-off training session can support people, but on their own they generally do not remove the hazard, so they should sit alongside a real change to the work, not stand in for it.

4. Talk it over with your workers. Consultation is a duty in its own right, and for a small business it is also the easy part: you already talk to your team. Raise the hazards you have spotted and the changes you are weighing, and ask whether you have read it right and whether the fix would actually help. In a small firm this can be a short team meeting or a quick round of one-to-ones. Note the date, who was there, what was raised, and what changed as a result. A dated consultation note is exactly the kind of record an inspector can ask to see, and it carries weight partly because it is hard to fake after the fact.

5. Write down who is doing what, by when. A plan with no owner and no date is an intention, not a control. For each thing you have decided to do, name who is responsible and set a date and a point to check back. In a small business that owner is often you, and that is fine; what matters is that it is written down and followed through, not left in your head.

6. Keep the record in one place and review it. Pull the list of hazards, your ratings, your chosen controls, the consultation note, and the action list into one simple, dated record rather than scattered scraps. Then put a reminder in your calendar to revisit it, because the duty is an ongoing loop, not a one-off project, and it keeps running as your work and your team change. A short, current record you actually maintain is worth far more than a polished document that goes stale.

That is the whole shape of it. None of these steps needs a clinical assessment or a legal opinion to begin. They need the decisions, the conversation, and the follow-through to be written down, kept current, and linked together so they read as one continuous record.

Two dates worth knowing about now

Two things in the calendar are pushing small employers to get started rather than wait. Victoria’s psychological health regulations commenced on 1 December 2025, extending psychosocial WHS regulation further across the country. And the People at Work survey platform, a free government tool many small employers have leaned on, is winding down: new registrations close on 1 June 2026, new surveys close on 1 July 2026, and the platform closes on 2 October 2026. If you were planning to lean on that tool, factor in that it is going away.

What you can do yourself, and where a hand helps

For a lot of small businesses, the first pass through the six steps above is genuinely something you can do yourself in an afternoon, and doing it yourself is far better than doing nothing while you wait for the perfect setup. Where help earns its keep is in two places. The first is keeping the record current, which is where most small employers fall behind, not at the start when the motivation is fresh, but three months later when the action list has gone stale and nobody can show whether anything happened. The second is when a customer, an insurer, a tender, or a board wants outside assurance that your assessment was done properly, where a review by your own suitably qualified adviser can add weight.

Where PsychSecure fits

PsychSecure is a managed service built for exactly this small-business situation: an owner with no HR or safety team who needs a proportionate, defensible record without standing up a compliance function. It supports you to map the hazards that apply to your workplace, grade the controls you already have as adequate, partial, or absent, build a prioritised plan with named owners and review points, and keep the consultation note, the action tracking, and the evidence in one maintained record designed to drop into your due-diligence file. Its eyebrow says it plainly: assess, control, respond.

To be clear about what it is and is not. PsychSecure is decision-support and workflow automation. It is not legal advice, it is not a clinical diagnostic tool, and it does not by itself make your business compliant. The duty stays with you. What the service is designed to do is help you implement the process and evidence that you took the duty seriously, in a proportionate form that holds up. Where you want outside assurance, you can engage your own suitably qualified adviser to review it.

A note on what this is and is not

This guide is general information to help small Australian employers understand the psychosocial risk-management duty and make a sensible start. It is not legal, clinical, or WHS advice, and it does not guarantee any compliance or regulatory outcome. How the duty applies, and what counts as reasonably practicable, depends on the size and nature of your business and the rules in your state, so confirm anything that matters for your business against the current rules that apply to you, and bring in your own qualified adviser for genuinely contested questions. Material here is aligned with applicable WHS guidance as we understand it.

A next step, if it is useful

If you would rather not build and maintain this on your own, you are welcome to a short call, usually 15 to 20 minutes. We will walk through what a proportionate, defensible record looks like for a business your size, show you a sample, and answer your questions, with no pressure either way. If you were simply trying to work out where to start, then the six steps above are a genuine first path, and we hope this has helped you take it.