Psychosocial risk assessment is now a regulatory requirement, not a discretionary wellbeing initiative. Australian employers must systematically identify, assess, and control psychosocial hazards using the same rigorous approach applied to physical workplace risks. This guide explains the legal framework, assessment methodologies, and practical implementation steps required for compliance.

The landscape has shifted decisively. Mental health conditions now account for 12% of all serious workers' compensation claims in Australia, a 161% increase over the past decade. The median time lost for these claims is 35.7 weeks, nearly five times that of physical injuries. Median compensation sits at $67,400 per claim, more than four times the amount for other workplace injuries. These figures represent not just human suffering but a category of risk that regulators, insurers, and courts treat with increasing seriousness.

Psychosocial risk assessment provides the foundation for managing this risk. Without systematic identification of hazards, assessment of their severity, and implementation of appropriate controls, organisations cannot demonstrate the due diligence that WHS legislation requires.

The Australian Regulatory Framework

The Work Health and Safety Act

The Work Health and Safety Act, adopted in most Australian jurisdictions, imposes a primary duty on Persons Conducting a Business or Undertaking (PCBUs) to ensure, so far as is reasonably practicable, the health and safety of workers. Health explicitly includes psychological health. This duty has always encompassed psychosocial hazards, but recent regulatory developments have made the requirements more specific and the enforcement more active.

The WHS Regulations require PCBUs to manage risks to health and safety by identifying hazards, assessing risks, implementing control measures, and reviewing those measures. These obligations apply to psychosocial hazards just as they apply to physical hazards such as machinery, chemicals, or working at heights.

The Model Code of Practice

Safe Work Australia's Model Code of Practice: Managing Psychosocial Hazards at Work provides the practical guidance courts will reference when determining what constitutes reasonable and practicable action. While a Code of Practice is not law itself, it represents authoritative guidance on meeting legal obligations. Failure to follow an approved Code without implementing equivalent or better measures creates significant legal exposure.

The Model Code identifies 17 common psychosocial hazards:

1. Job demands

2. Low job control

3. Poor support

4. Lack of role clarity

5. Poor organisational change management

6. Inadequate reward and recognition

7. Poor organisational justice

8. Traumatic events or material

9. Remote or isolated work

10. Poor physical environment

11. Violence and aggression

12. Bullying

13. Harassment including sexual harassment

14. Conflict or poor workplace relationships

15. Job insecurity

16. Fatigue

17. Intrusive surveillance

This list is not exhaustive. Organisations must identify the specific hazards present in their workplace through systematic assessment processes.

The Commonwealth Code of Practice 2024

The Commonwealth Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024, effective from November 2024, applies to Commonwealth entities regulated by Comcare. It introduces several enhancements to the Model Code, including explicit identification of job insecurity, fatigue, and intrusive surveillance as distinct hazard categories, along with a new Part 8 establishing ten principles for responding to reports, complaints, or incidents involving psychosocial hazards.

The Commonwealth Code emphasises that PCBUs must follow the hierarchy of controls when managing psychosocial risks, implementing controls from highest to lowest level of protection.

Victorian Regulations 2025

Victoria, as the only jurisdiction not operating under the harmonised WHS framework, introduced the Occupational Health and Safety (Psychological Health) Regulations 2025, which commenced on 1 December 2025. These regulations create specific statutory obligations for Victorian employers to identify psychosocial hazards, implement control measures following a modified hierarchy, and review controls when specified triggers occur.

The Victorian Regulations introduce a key constraint: information, instruction, or training cannot be the exclusive or predominant risk control measure unless other measures are not reasonably practicable. This codifies the principle that individual-focused interventions like resilience training cannot substitute for addressing hazards at their source through work design, systems, and environmental changes.

WorkSafe Victoria's Compliance Code provides detailed interpretive guidance. A breach of the Compliance Code is not itself a breach of the Act, but an employer who complies with the Code will be taken to have complied with the relevant duties. Conversely, failure to follow the Code may be used as evidence in proceedings.

ISO 45003: The Global Standard

ISO 45003:2021 is the first international standard providing guidelines for managing psychosocial risk within occupational health and safety management systems. Published in June 2021, it complements ISO 45001 and provides a framework applicable to organisations of all sizes and sectors.

ISO 45003 categorises psychosocial hazards into three domains: aspects of how work is organised (including workload, job demands, job control, and role clarity), social factors at work (including workplace culture, relationships, and communication), and work environment, equipment, and hazardous tasks (including physical conditions and exposure to traumatic content).

While ISO 45003 is a guideline rather than a certifiable standard, compliance can be assessed by third parties, and alignment with the standard demonstrates commitment to international best practice. Many organisations use ISO 45003 as their framework for psychosocial risk management, with the Australian Codes of Practice providing jurisdiction-specific detail.

Understanding Psychosocial Hazards and Risks

Definitions

A psychosocial hazard is anything in the design or management of work, the work environment, or social interactions at work that has the potential to cause psychological or physical harm. The emphasis is on potential: a hazard exists whether or not it has yet caused harm to any individual.

A psychosocial risk is the likelihood and severity of harm to health arising from exposure to a psychosocial hazard. Risk depends on factors including the duration of exposure, frequency of exposure, severity of the hazard, and interaction with other hazards. Risk assessment determines which hazards require immediate attention and what level of control is appropriate.

This distinction matters for compliance. The duty is to identify hazards and then assess and control the associated risks. An organisation that identifies hazards but fails to assess and control the risks has not met its obligations. An organisation that only responds to incidents after harm has occurred has failed at the first step.

How Psychosocial Hazards Cause Harm

Research using the Job Demands-Resources (JD-R) model, developed by Demerouti and Bakker and extensively validated in occupational health research, explains the mechanism by which psychosocial hazards cause harm. Job demands (such as high workload, emotional labour, or role conflict) require sustained effort and deplete workers' resources. Job resources (such as autonomy, supervisor support, or skill development opportunities) help workers meet demands and promote engagement.

When demands consistently exceed resources, workers experience strain that manifests initially as fatigue, stress, and reduced performance. Prolonged strain leads to burnout, characterised by exhaustion, cynicism, and reduced professional efficacy. Chronic stress exposure contributes to anxiety disorders, depression, and physical conditions including cardiovascular disease and musculoskeletal disorders.

A 2021 meta-analysis by Lesener and colleagues published in the Journal of Occupational Health Psychology synthesised 72 longitudinal studies and confirmed that job demands predict burnout over time, while job resources predict engagement. The effects operate independently, meaning organisations must both reduce excessive demands and enhance supporting resources.

Importantly, psychosocial hazards rarely occur in isolation. The Model Code emphasises that hazards may interact or combine to create new, changed, or higher risks. A worker facing high job demands might cope adequately with good supervisor support, but the combination of high demands and poor support creates compounding risk greater than either factor alone.

The Cost of Unmanaged Psychosocial Risk

Safe Work Australia data documents the escalating burden of psychological injury claims:

Claim volume: Mental health conditions accounted for 17,600 serious workers' compensation claims in 2023-24, representing 12% of all serious claims. This represents a 161% increase over the past decade and continues to grow at approximately 14.7% annually.

Time lost: The median time lost for mental health claims is 35.7 working weeks, compared to 7-8 weeks for physical injuries. This extended absence reflects both the severity of psychological injury and the complexity of recovery and return to work.

Cost per claim: Median compensation for mental health claims reached $67,400 in 2023-24, more than four times the median for all injuries. In NSW, average costs have escalated from $146,000 per claim in 2019-20 to $288,542 in 2024-25.

Total system cost: Psychological claims now represent approximately 12% of claim volume but account for 38% of total workers' compensation costs. Several state treasurers have publicly warned that rising psychological injury claims threaten the sustainability of compensation schemes.

Return to work outcomes: Workers with mental health claims experience significantly poorer return-to-work outcomes (79.1% compared to 91.6% for all claims) and are more likely to report stigmatisation by employers and colleagues.

Beyond compensation costs, unmanaged psychosocial risk drives presenteeism (reduced productivity while at work), absenteeism, turnover, and reduced engagement. Research by Deloitte Access Economics estimated the total cost of mental health conditions in Australian workplaces at $39 billion annually when accounting for productivity losses, compensation costs, and health system impacts.

The Risk Assessment Process

Step 1: Hazard Identification

Hazard identification must be systematic, ongoing, and draw on multiple information sources. Point-in-time surveys alone are insufficient because they capture only a snapshot and may miss hazards that fluctuate with work cycles, staffing changes, or project phases.

Data sources for hazard identification include:

Worker consultation. Direct consultation with workers and their representatives provides insight into actual working conditions that organisational data may not capture. The WHS Act requires consultation on matters affecting health and safety. Effective consultation uses multiple methods: team discussions, one-on-one conversations, anonymous reporting channels, and formal committee structures.

Surveys and questionnaires. Validated psychosocial risk assessment tools provide systematic measurement of hazard exposure across the workforce. People at Work, developed collaboratively by Australian WHS regulators and academic researchers, is a free, validated tool that measures exposure to psychosocial hazards and provides benchmarking against industry norms. The Copenhagen Psychosocial Questionnaire (COPSOQ), Psychosocial Safety Climate (PSC-12) survey, and various jurisdiction-specific tools (such as Queensland's Psychosocial Risk Assessment Tool) offer alternatives with different features.

Research by Dollard and colleagues at the University of South Australia has validated the Psychosocial Safety Climate construct, finding that organisational climate predicting whether management prioritises psychological health predicts individual-level outcomes including burnout, engagement, and psychological distress.

Workplace observation. Direct observation of work processes, interactions, and conditions reveals hazards that workers may have normalised or that surveys do not capture. Walk-throughs should examine workflow design, communication patterns, management practices, and physical environment factors.

Incident and complaint data. Reports of bullying, harassment, conflict, or stress-related incidents indicate hazards requiring assessment. Patterns in complaints, even where individual matters are resolved, may reveal systemic issues. WorkSafe Victoria data indicates that in 2023-24, the most frequently reported psychosocial hazards were bullying, poor support, and aggression or violence.

HR and organisational data. Absenteeism patterns, turnover rates, exit interview themes, workers' compensation claims, use of EAP services, performance management data, and grievance frequencies all provide indicators of potential psychosocial hazards. Sudden changes in these metrics warrant investigation.

Work design analysis. Examination of job descriptions, reporting structures, workload distribution, rostering patterns, and performance management systems can identify structural hazards before they cause reported harm.

Step 2: Risk Assessment

Once hazards are identified, risk assessment determines their priority for control. The assessment must consider:

Likelihood of harm. How probable is it that exposure to this hazard will result in harm? This considers both the frequency of exposure and the proportion of exposed workers likely to experience adverse effects.

Severity of potential harm. What is the potential severity of harm if it occurs? Psychological injury can range from temporary stress to chronic conditions requiring extended treatment and permanent impairment.

Duration of exposure. How long are workers exposed to the hazard? Prolonged exposure generally increases risk.

Frequency of exposure. How often does exposure occur? Daily exposure to a hazard creates different risk than occasional exposure.

Interaction with other hazards. Are multiple hazards present simultaneously? The Model Code emphasises that hazards can combine to create elevated risk.

Effectiveness of existing controls. What measures are already in place, and how well are they working? Assessment should evaluate residual risk after accounting for current controls.

Risk assessment methodologies vary. Some organisations use risk matrices similar to those applied to physical hazards, rating likelihood and consequence to derive a risk score that guides prioritisation. The Fine-Kinney method, adapted for psychosocial risks, incorporates survey responses to score risks based on actual worker experience. The Benchmark Dose (BMD) method, adapted from toxicology, identifies critical exposure levels at which harm probability increases significantly.

Research by Burr and colleagues published in the Scandinavian Journal of Work, Environment & Health applied the BMD approach to psychosocial factors, identifying thresholds for job control, demands, and social support below or above which depression and anxiety risk increases substantially. This approach provides evidence-based benchmarks for determining when exposure levels require intervention.

Whatever methodology is used, risk assessment must be documented. Documentation demonstrates due diligence and provides a baseline against which control effectiveness can be evaluated.

Step 3: Control Implementation

The hierarchy of controls applies to psychosocial hazards. Higher-order controls addressing hazards at source are more effective and must be considered before relying on lower-order controls that depend on individual behaviour.

Elimination. Can the hazard be removed entirely? Examples include eliminating unnecessary tasks that create excessive demands, redesigning roles to remove exposure to traumatic content, or restructuring reporting lines to eliminate conflict of interest.

Substitution. Can a less hazardous alternative be substituted? This might include replacing high-pressure performance metrics with balanced scorecards, substituting collaborative processes for competitive individual targets, or using technology to reduce exposure to aggressive customers.

Isolation. Can workers be separated from the hazard? Physical separation may not be applicable to most psychosocial hazards, but time-based separation (such as limiting exposure duration to traumatic content) or organisational separation (such as creating specialist teams with enhanced support for high-demand work) may be possible.

Engineering controls. Can the work environment or systems be redesigned to reduce risk? Examples include implementing communication technologies that support collaboration without requiring constant availability, designing workflows that provide adequate time for task completion, creating physical spaces that support both focused work and informal interaction, or configuring technology systems with boundaries that limit after-hours contact.

Administrative controls. Can policies, procedures, training, and supervision arrangements reduce risk? These controls are appropriate when higher-order controls are not reasonably practicable or as supplementary measures. Examples include clear role descriptions and escalation pathways, policies establishing expected working hours and availability, manager training in recognising and responding to psychological distress, procedures for workload review and redistribution, and documented processes for raising and addressing concerns.

Personal protective measures. Individual-level supports help workers manage residual risk but cannot substitute for addressing hazards at source. Employee Assistance Programs, mental health literacy training, resilience building programs, and peer support networks fall into this category.

The Victorian Regulations 2025 make explicit what was previously implied: information, instruction, or training cannot be the exclusive or predominant control measure unless other measures are not reasonably practicable. Organisations must be able to demonstrate that they have considered and implemented higher-order controls before relying primarily on individual-level interventions.

Step 4: Review and Improvement

Control measures require ongoing monitoring to verify effectiveness. The Code of Practice requires review when:

• Work processes, structures, or systems change

• New information about hazards becomes available

• A worker reports a psychosocial hazard or psychological injury

• An incident occurs involving psychosocial hazards

• A Health and Safety Representative requests review

• Monitoring indicates controls are not achieving intended outcomes

Review should assess whether hazards have changed, whether controls remain appropriate, whether controls are being implemented as designed, and whether modifications are needed.

Leading indicators for monitoring include worker feedback, participation rates in consultation processes, uptake of support services, and patterns in communication or leave data. Lagging indicators include incident reports, complaints, compensation claims, turnover, and absenteeism. Relying solely on lagging indicators means controls are only evaluated after harm has occurred.

Continuous improvement requires regular assessment of the overall psychosocial risk management system, not just individual controls. Are hazard identification processes capturing emerging risks? Are risk assessments being updated as circumstances change? Are controls being implemented consistently across the organisation? Are workers aware of and using available support systems?

Common Assessment Pitfalls

Confusing Surveys with Risk Assessment

Surveys measure hazard exposure but do not constitute risk assessment. Risk assessment requires interpreting survey results to determine likelihood and severity of harm, considering how hazards interact, evaluating existing controls, and prioritising actions. An organisation that administers a survey but takes no action based on results has not conducted risk assessment.

Comcare guidance explicitly states that assessment tools alone will not manage risks: they are often a first step in a coordinated approach. Other important steps include securing senior management support, strong communication and consultation with workers, data analysis and interpretation, acting on the findings, and continually monitoring progress.

Treating Assessment as a Point-in-Time Activity

Psychosocial hazards are dynamic. Workloads fluctuate, team compositions change, organisational restructures alter reporting relationships, and external pressures vary with market conditions. A risk assessment conducted once becomes outdated quickly. Effective assessment incorporates multiple data sources monitored continuously, with formal reassessment triggered by changes in work or when new information emerges.

Focusing on Individual Vulnerability Rather Than Hazards

Risk assessment must identify hazards in work design, systems, and environment, not characteristics of individual workers. Framing the problem as some workers being unable to cope deflects attention from controllable workplace factors and may constitute discrimination against workers with mental health conditions.

This does not mean individual factors are irrelevant to control selection. Workers with pre-existing conditions, those new to roles, or those facing external stressors may require additional support. But the assessment process must first identify what hazards exist before considering how different workers might be affected.

Assuming Similar Workplaces Have Similar Risks

Industry benchmarks and generic risk profiles provide starting points but cannot substitute for workplace-specific assessment. Two organisations in the same industry may have very different hazard profiles based on leadership practices, work design choices, resourcing levels, and organisational culture. The assessment must examine actual conditions in the specific workplace.

Under-Resourcing the Assessment Process

Effective psychosocial risk assessment requires time, expertise, and genuine commitment to act on findings. Rushed assessments, surveys with poor response rates, or processes led by staff without appropriate training produce unreliable results. Organisations should consider whether internal resources are sufficient or whether external expertise is needed for assessment design, data analysis, or control implementation.

Documentation Requirements

Documentation demonstrates compliance, enables monitoring, and supports continuous improvement. Records should include:

Hazard identification records. What processes were used to identify hazards? What data sources were consulted? What hazards were identified? When was identification conducted?

Risk assessment records. How were identified hazards assessed? What methodology was used? What factors were considered? What risk levels were determined? Who was involved in the assessment?

Control implementation records. What controls were selected? Why were those controls chosen? How were higher-order controls considered? What is the implementation status of each control? Who is responsible for implementation?

Consultation records. When was consultation conducted? Who was consulted? What matters were raised? How were worker views considered in decisions?

Review and monitoring records. When were controls reviewed? What triggered the review? What was the outcome? What modifications were made?

Incident and complaint records. What reports have been received? How were they investigated? What actions were taken?

Documentation should be accessible for regulatory inspection and sufficiently detailed to demonstrate the reasoning behind decisions. Electronic systems that provide audit trails, version control, and linkages between related records simplify compliance demonstration.

How ReFresh Supports Psychosocial Risk Assessment

Managing psychosocial risk assessment manually, through spreadsheets, disconnected surveys, and fragmented documentation, creates compliance gaps that regulators increasingly identify. ReFresh provides purpose-built infrastructure for the complete risk assessment cycle.

Systematic hazard detection. ReFresh enables organisations to capture psychosocial hazard data through multiple channels: structured risk surveys designed specifically for psychosocial hazards, confidential incident reporting, and ongoing risk intake. Rather than relying on annual engagement surveys that measure outcomes rather than hazards, ReFresh provides continuous visibility into emerging issues before they escalate to injury.

Structured risk assessment. ReFresh provides standardised risk matrices and a formal psychosocial risk register that meets the requirements of ISO 45003, Safe Work Australia Code of Practice, and jurisdiction-specific regulations including the Victorian Regulations 2025. When assessing psychosocial hazards, the platform ensures that factors the Code requires, such as duration, frequency, severity, and hazard interactions, are systematically considered and documented.

Compliance-mapped control libraries. ReFresh includes a control library mapped directly to regulatory requirements. For each identified hazard, organisations can select controls with clear traceability to the risks they address. The platform tracks implementation status, assigns ownership, sets deadlines, and links controls to the evidence demonstrating their effectiveness. This addresses a critical compliance gap: the ability to demonstrate not just that controls exist, but that they operate effectively.

Evidence collection and documentation. The platform maintains evidence against requirements, providing complete audit trails suitable for regulatory scrutiny. All key actions are versioned and time-stamped. Consultation records, risk assessment decisions, control implementation progress, and review outcomes are linked in a single system rather than scattered across emails, spreadsheets, and document folders.

Effectiveness reviews. ReFresh supports structured effectiveness reviews that verify controls are working as intended. When the Victorian Regulations require review in response to reports, incidents, or changed circumstances, the platform prompts the review process and documents outcomes. Task assignment with clear ownership ensures follow-through rather than controls that exist on paper but not in practice.

Governance and board reporting. ReFresh aligns psychosocial risk management with ISO 45003 and WHS requirements, producing board-ready reports that demonstrate compliance status across frameworks. For officers with due diligence obligations, this visibility provides assurance that systems exist and are operating effectively.

Multi-jurisdiction support. For organisations operating across Australian states or internationally, ReFresh supports configuration for different regulatory frameworks while maintaining consistent core processes. As requirements evolve, including the recent Victorian Regulations commencement, the platform updates to reflect current obligations.

The distinction between fragmented compliance activities and systematic risk management determines both legal exposure and actual harm prevention. ReFresh provides the structured system that transforms psychosocial risk assessment from a periodic compliance exercise into ongoing, defensible risk management.

Implementation Pathway

Phase 1: Foundation (Weeks 1-2)

Establish governance. Secure executive sponsorship and clarify accountability. Assign responsibility for psychosocial risk management within existing safety governance structures. Determine reporting lines to senior leadership and the board.

Confirm regulatory scope. Identify which jurisdictions apply, which Codes of Practice and regulations are relevant, and what specific requirements must be met. For multi-state organisations, map the applicable requirements across locations.

Assess current state. Review existing policies, procedures, and systems for managing psychosocial risk. Identify what hazard identification and risk assessment processes currently exist. Evaluate documentation adequacy and compliance gaps.

Phase 2: Assessment Design (Weeks 3-4)

Select assessment methodology. Determine which tools and data sources will be used for hazard identification. Consider validated survey instruments like People at Work alongside workplace-specific data sources. Plan for consultation with workers and their representatives.

Design consultation processes. Establish how workers will be consulted throughout the assessment process, not just surveyed. This includes mechanisms for raising concerns, providing input on hazard identification, and contributing to control selection.

Configure systems. Implement or configure risk management systems to support the assessment process. This includes establishing the psychosocial risk register, defining risk rating criteria, and preparing documentation templates.

Phase 3: Assessment Execution (Weeks 5-8)

Conduct hazard identification. Deploy surveys, conduct workplace observations, analyse organisational data, and consult with workers. Collate findings into a comprehensive hazard inventory.

Perform risk assessment. For each identified hazard, assess likelihood and severity of harm, considering duration and frequency of exposure, interaction with other hazards, and effectiveness of existing controls. Document assessment methodology and findings.

Prioritise actions. Based on risk assessment results, prioritise hazards requiring immediate attention versus those requiring systematic longer-term action. Communicate findings to leadership and workers.

Phase 4: Control Implementation (Weeks 9-16)

Select controls. For prioritised hazards, identify appropriate controls following the hierarchy. Document why selected controls are appropriate and how higher-order controls were considered.

Implement controls. Assign ownership for control implementation. Set deadlines and monitor progress. Address barriers to implementation.

Collect evidence. Document implementation of controls and begin collecting evidence of effectiveness. Establish baseline measures against which improvement will be assessed.

Phase 5: Monitoring and Review (Ongoing)

Establish monitoring processes. Define leading and lagging indicators to be tracked. Set review triggers aligned with regulatory requirements. Schedule periodic reassessment.

Conduct reviews. When triggers occur or scheduled reviews are due, reassess hazards and control effectiveness. Document review outcomes and any modifications made.

Report to leadership. Provide regular reporting on psychosocial risk status, control effectiveness, and areas requiring attention. Ensure board receives appropriate oversight information.

Continuous improvement. Use review findings to refine assessment processes, improve controls, and enhance overall system maturity.

Conclusion

Psychosocial risk assessment is no longer optional. The regulatory framework requires systematic identification, assessment, and control of psychosocial hazards using the same rigorous approach applied to physical safety risks. The consequences of failure include not just legal liability but genuine harm to workers and substantial organisational costs.

Effective assessment requires multiple data sources, validated methodologies, and genuine commitment to act on findings. It requires consultation with workers, not just surveying them. It requires controls that address hazards at source, not just programs that ask workers to build resilience. And it requires ongoing monitoring and review, not point-in-time compliance exercises.

The organisations that will navigate this landscape successfully are those that build psychosocial risk management into their core safety systems rather than treating it as a separate wellbeing initiative. They will invest in appropriate tools and expertise. They will maintain documentation that demonstrates due diligence. And they will create workplaces where psychological health is protected with the same systematic attention given to physical safety.

The regulatory expectation is clear. The evidence base is established. The tools exist. What remains is implementation.

This article provides general information about workplace health and safety requirements and should not be relied upon as legal advice. Requirements vary by jurisdiction and may have changed since publication. Consult relevant codes of practice, regulatory guidance, and qualified advisors for specific circumstances.