What psychosocial hazards mean, and what an employer must do

Psychosocial hazards are the parts of work that can harm a person’s mental health, things like unmanageable workload, bullying, harassment, low job control, poor support, role confusion, and exposure to distressing material. Under Australia’s work health and safety laws, an employer has a legal duty to find these hazards, assess the risk they create, do what is reasonably practicable to control them, consult workers along the way, and review whether the controls are working. In short: the same duty you already have for physical safety now applies to psychological safety, and you are expected to be able to show what you did about it.

This guide is written for an employer who is learning these terms, not for a safety professional. It explains the words, the duty, and the practical steps, in plain English.

What is a psychosocial hazard?

A psychosocial hazard is anything in the design or management of work that can cause psychological harm. The hazard is in the work itself, not in the worker. The common examples regulators point to include:

1. High or unmanageable job demands (too much work, impossible deadlines, long hours)
2. Low job control (little say over how or when work gets done)
3. Poor support from managers or colleagues
4. Lack of role clarity (not knowing what you are responsible for)
5. Poor workplace relationships, including conflict
6. Bullying, harassment, and sexual harassment
7. Exposure to violence or aggression
8. Exposure to traumatic or distressing events or material
9. Poor organisational change management
10. Low recognition and reward

Here is the point that trips people up. A psychosocial hazard is about how work is structured and managed, not about how resilient an individual is. A worker burning out under a workload no one could sustain is a hazard in the work, not a weakness in the person. That distinction matters because it shapes what you are expected to do about it.

(The exact number of named hazards and the way they are grouped vary slightly between the model code and individual state guidance. Treat the list above as the common set rather than a fixed legal schedule.)

Why does this matter now?

It matters now because the rules changed from guidance into an enforceable duty, and Australian regulators have signalled they are moving from educating employers to actively enforcing. For years, managing psychological wellbeing at work was treated as a nice-to-have. That is no longer the position. Psychosocial hazards now sit under the same work health and safety framework as physical hazards, which means the same obligations to identify, assess, control, consult, and review, and the same exposure if you do not.

There are two practical pressures behind the urgency. First, regulators across several states have signalled a shift toward active inspection and enforcement on psychosocial risk, so the chance of being asked to “show your working” is rising. Second, Safe Work Australia data shows psychological injury claims take far longer off work and cost several times more than the median physical injury claim, which makes the financial stakes real, not theoretical. (Source: Safe Work Australia, workers’ compensation for psychological injuries; median payout around $67,400 versus around $16,300 for other injuries, and a median of about 35.7 weeks off work.)

Is any of this actually enforced? Increasingly, yes, and the direction of travel is clearly toward more enforcement rather than less. That is why a documented, defensible record of what you have done is becoming the practical priority for employers.

What does an employer actually have to do?

An employer has to work through a continuous loop: identify the hazards, assess the risk, control it so far as is reasonably practicable, consult workers throughout, and review whether it is working. Each word in that loop has a specific meaning, so here is what each one asks of you in practice.

Identify. Find the psychosocial hazards that genuinely exist in your workplace. This usually means looking at how work is designed, talking to workers, reviewing complaints, incidents, turnover, and absence patterns, and not assuming “we don’t have a problem” without checking.

Assess. Work out how serious each risk is: how likely is harm, how severe could it be, who is exposed and how often. This is what turns a long list of possible hazards into a ranked set of things to act on.

Control. Do what is reasonably practicable to eliminate or reduce each risk. The key idea here is the hierarchy of controls: the most effective fixes change the work itself (redesigning workloads, clarifying roles, fixing a broken reporting line), and these “higher-order controls” are what regulators expect. Lower-order measures that only help people cope, like an Employee Assistance Program, training, or wellbeing perks, are not enough on their own. They can support a response, but they do not by themselves discharge the duty, because they do not change the hazard.

Consult. Talk to your workers about psychosocial risks and the decisions that affect them. Consultation is a legal requirement in its own right, not an optional extra, and being able to show you did it is part of a defensible record.

Review. Check whether your controls actually worked, and adjust them when they did not. This is a loop, not a one-off project, so the duty continues as the work and the workforce change.

Two phrases you will meet a lot are worth knowing. “Reasonably practicable” means you are expected to do what is reasonable given what you know, the risk involved, and what is available to address it, not to achieve a perfect or risk-free workplace. “Reasonable management action carried out in a reasonable way” describes legitimate management decisions, such as performance management or restructures, that are not in themselves a psychosocial hazard when done fairly and reasonably. The difference between reasonable management action and a hazard that creates exposure for you usually comes down to how the action was carried out, which is, again, a matter of evidence.

Who is personally responsible?

Responsibility sits with the organisation as the employer, and it can also reach individual directors and officers personally. The organisation, often referred to in the law as the PCBU (the “person conducting a business or undertaking”), carries the primary duty. On top of that, people in senior leadership and governance roles carry a personal “due diligence” duty: they are expected to take reasonable steps to understand the psychosocial risks in the business and to make sure the organisation is actually managing them. That is why this is a board and executive issue, not only a human-resources one, and why being able to evidence due diligence at the leadership level matters.

What records should you keep?

Keep enough documentation to show, after the fact, that you identified the hazards, assessed the risk, acted on it, consulted your workers, and reviewed the result. If a regulator asks, or a claim is made, the question is not “did you care?” but “can you show what you did?” A practical, defensible record usually includes:

1. A risk register listing the psychosocial hazards you identified and how you rated them
2. Consultation records showing you talked with workers and what came out of it
3. An action tracker showing what you decided to do, who owns each action, and by when
4. Evidence that actions were actually completed and reviewed, not just listed
5. Leadership or board reporting showing officers were informed and engaged

A common fear among employers is the “can of worms” problem: you run a survey, surface a list of issues, and then feel exposed because you have written down problems you have not fixed yet. The answer is not to avoid looking. It is to make sure that whatever you find flows into a tracked plan with owners and dates, so the record shows a genuine, reasonable response in progress rather than a list of ignored warnings. A documented plan you are working through is a far stronger position than no record at all.

A simple way to think about where to start

If you are starting from a policy and not much else, the practical first move is to get an honest read of where you actually stand, then turn that into a prioritised plan you can evidence. A useful sequence for a smaller employer with no in-house WHS or HR specialist:

1. Map the psychosocial hazards that realistically apply to your workplace.
2. Get a candid view of which existing controls are adequate, which are partial, and which are missing.
3. Prioritise the gaps by risk, not by what is easiest to fix.
4. Build a short plan with named owners and review dates, and start tracking it.
5. Keep the consultation, the decisions, and the progress in a record you could hand to an inspector, an insurer, or your own board.

You do not need a large safety department to do this well. You do need a clear method and a record that holds up.

Where PsychSecure fits

PsychSecure is a managed service that supports employers to implement and maintain this psychosocial risk-management workflow and to create defensible documentation aligned with applicable WHS guidance. In plain terms, it helps you get from “we have a policy” to “we have an evidence-traced record of where we stand and a prioritised plan to close the gaps”, in a form designed to drop into your due-diligence file. It maps the hazards against your own evidence, grades your existing controls, and produces a prioritised plan with named owners and review points. Where an outside party wants independent assurance, you can engage your own suitably qualified adviser to review the record.

To be clear about what it is and is not: PsychSecure is decision-support and workflow automation. It is not legal advice, it is not a clinical diagnostic tool, and it does not by itself make your organisation compliant. The primary duty stays with you. What the service is designed to do is help you evidence that you took that duty seriously, quickly and in a form that holds up.

A next step, if it is useful

If any of this is hitting close to home and you would like a clearer picture of where your organisation stands, you are welcome to a 15 to 20 minute call. We will walk through what a defensible record looks like for an organisation like yours and answer your questions, with no pressure either way. If you are simply trying to understand the terms for now, we hope this guide has done that on its own.