Psychosocial compliance under Comcare
Harrison Kennedy
Three features set the Commonwealth framework apart from every state and territory. The first is the audience: Comcare does not cover the whole federal workforce, only Commonwealth agencies, the specific private-sector organisations that hold self-insurance licences under the scheme, and parts of the ACT public sector. The second is the reference document: the Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024 (F2024L01380) is the authoritative national source for the 17 psychosocial hazard categories that every other jurisdiction now works from. The third is the penalty ceiling: industrial manslaughter provisions effective July 2024 carry maximum penalties of $20,400,000 for corporations and 20 years imprisonment for individuals, the most severe tier in the national framework.
For Commonwealth-covered employers, there is no ambiguity about who the regulator is, what the hazards are, or what the ceiling of enforcement looks like. This page sets out who is covered by Comcare, the law that applies, the 17-hazard framework anchored by the 2024 Code of Practice, and what the industrial manslaughter provisions mean for senior officers. The financial picture of failing to meet the duty is set out separately on the cost of psychosocial non-compliance, the cost of psychological injury claims, and the cost of officer liability.
Who is covered by Comcare
Comcare is the Commonwealth regulator for work health and safety and the Commonwealth workers' compensation insurer. Both functions sit within the same statutory authority, which is distinct from the state regulator model where the safety regulator and the workers' compensation insurer are usually separate entities.
Comcare coverage applies to three groups:
Australian Government agencies and departments. Commonwealth departments and agencies, statutory bodies, and the Defence civilian workforce. Examples include the Australian Taxation Office, Services Australia, and the Department of Home Affairs.
Non-government national employers licensed to self-insure under the Comcare scheme. Typically large national businesses that have opted out of state workers' compensation schemes and into the federal one. Historical licensees have included Telstra, Australia Post, Linfox, and some of the major banks; the live list changes over time as licences are granted or expire.
The ACT public sector, for some functions. The ACT has historically used Commonwealth arrangements for parts of its public sector.
A typical private business operating only in NSW, Victoria, Queensland, or another state is covered by its home state's regulator and Code of Practice, not Comcare. This is the most common point of confusion. "Federal" in the sense of operating across state borders does not mean Comcare applies. A national retailer or a multi-state professional services firm is governed by state regulators unless it holds a Comcare self-insurance licence.
Commonwealth-covered organisations that operate across multiple states have a simpler regulatory picture than multi-state private employers: one regulator, one framework, one Code of Practice. That simplicity comes with a correspondingly high standard of expected performance.
The WHS Act, regulations, and Code of Practice that apply under Comcare
Psychosocial compliance under the Commonwealth scheme is governed by the Work Health and Safety Act 2011 (Cth), the Commonwealth WHS Regulations, and the Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024.
The WHS Act 2011 (Cth) establishes the primary duty of care. Every PCBU covered by the scheme must ensure, so far as is reasonably practicable, the health and safety of workers. "Health" under the Act explicitly includes psychological health. The Act is structurally aligned with the model WHS Act used across most Australian jurisdictions.
The Commonwealth WHS Regulations adopted the model psychosocial risk provisions in April 2023. The regulations require duty holders to identify reasonably foreseeable psychosocial hazards, eliminate risks where reasonably practicable, and otherwise minimise them using the hierarchy of controls. The duty structure matches the model framework.
The Code of Practice 2024 (F2024L01380) is the distinctive instrument. Registered on the Federal Register of Legislation and approved by the federal Minister for Employment and Workplace Relations, it is an approved Code of Practice under section 274 of the WHS Act. Codes of Practice are admissible in court proceedings as evidence of what is known about a hazard, risk, or control, and an inspector may reference the Code when issuing an improvement or prohibition notice. The Code applies to PCBUs covered by the Commonwealth scheme and serves as the practical guidance for meeting the psychosocial duty.
The 2024 Code is also the national source for the 17-hazard framework. It expanded on the original model Code (July 2022), which listed 14 psychosocial hazard categories, by adding three further hazards. The next section walks through the structure.
The 17 psychosocial hazards: the national reference framework
The Commonwealth Code of Practice 2024 recognises 17 psychosocial hazard categories, organised into two appendices within the Code itself.
Appendix A, Job characteristics, design and management (10 hazards): job demands, low job control, poor support, lack of role clarity, poor organisational change management, inadequate reward and recognition, poor organisational justice, traumatic events or material, remote or isolated work, and poor physical environment.
Appendix B, Harmful behaviours (4 hazards): violence and aggression, bullying, harassment including sexual harassment, and conflict or poor workplace relationships and interactions.
Additions in the Commonwealth Code 2024 (3 hazards): fatigue, job insecurity, and intrusive surveillance. These three were not included in the original Safe Work Australia model Code and were added in 2024. Fatigue captures cumulative exhaustion risks from roster design, extended hours, and sustained cognitive demand. Job insecurity covers the psychological harm associated with precarious employment, contract uncertainty, and ongoing restructuring. Intrusive surveillance addresses the hazard created by disproportionate or opaque monitoring technologies, a category that reflects the post-pandemic expansion of remote worker monitoring tools.
The Code explicitly states that how hazards are categorised matters less than ensuring coverage. A PCBU is required to identify all reasonably foreseeable psychosocial hazards in its workplace, not a selected subset. An organisation whose hazard register omits one of the 17 categories because "it doesn't apply to us" needs to have documented the reasoning, not simply the conclusion. Intrusive surveillance, for example, is often assumed not to apply; in practice, many organisations have deployed monitoring tools during remote work arrangements that would meet the Code's definition.
For Commonwealth-covered employers, the 2024 Code is the reference document against which compliance will be assessed. For any organisation in any jurisdiction, the Commonwealth Code's 17-category framework is the most comprehensive current statement of what counts as a psychosocial hazard in the Australian context.
Industrial manslaughter under the Commonwealth framework
The Commonwealth framework introduced industrial manslaughter provisions effective July 2024. Maximum penalties are set at the highest tier in the national framework: $20,400,000 for corporations and 20 years imprisonment for individuals.
The offence applies where a PCBU or a senior officer's conduct causes the death of a worker, and the conduct constitutes a gross breach of the duty of care. The legal threshold is deliberately high, requiring more than ordinary failure to comply. But the offence sits on the statute books, carries the most severe penalties in any Australian WHS framework, and applies to every Commonwealth-covered employer.
The connection to psychosocial compliance matters. Where an employer's failure to manage psychosocial hazards contributes to a worker's death, including death by suicide in circumstances where workplace factors are a substantial cause, industrial manslaughter charges are available to the prosecutor. The causal chain from hazard to death must be established, and the conduct must be shown to constitute a gross breach, but the offence exists and has been structured to cover psychosocial cases as well as physical safety failures.
For Commonwealth boards and senior officers, the practical implication is significant. The same psychosocial hazard, if left unmanaged and leading to a worker death, can trigger either a standard Category 1 prosecution under the WHS Act or an industrial manslaughter prosecution, depending on the evidence. The latter carries personal consequences at the highest level the national framework provides. The full personal-exposure picture for officers covers defence cost, D&O implications, and the wider indirect cost layer.
What Comcare expects from organisations
Comcare expects organisations to identify psychosocial hazards, assess the risks they pose, implement controls following the hierarchy of controls, and review whether those controls are working. This is the four-step risk management cycle embedded across the national WHS framework, mirrored in state regulator expectations and anchored in the 2024 Code. The Psychosocial Compliance Internal Audit Checklist walks through what evidence each step needs to produce.
When a Comcare inspector attends a workplace, the questions are consistent with those asked by regulators in every other Australian jurisdiction:
What psychosocial hazards have you identified?
How did you assess the risks those hazards pose?
Can you show the records of your hazard identification and risk assessment?
What controls have you implemented, and how do they follow the hierarchy of controls?
Who is responsible for each control?
When were the controls last reviewed for effectiveness?
How do you know the controls are actually working?
The Commonwealth-specific reference point is the 2024 Code of Practice. An inspector will expect to see hazard identification mapped against the 17 categories, risk assessments that consider the interaction of multiple hazards, and controls that reflect the hierarchy of controls rather than relying exclusively on personal-tier measures like Employee Assistance Programs. An organisation that can articulate its compliance posture directly against the Code's structure is in a materially stronger position than one relying on generic safety documentation. Running this manually is itself a substantial operational cost.
What this means for Commonwealth-covered employers
The combination of a single authoritative regulator, the national reference Code of Practice, and the most severe penalty ceiling in the national framework puts Commonwealth-covered employers in a clear regulatory position. What is required is documented, structured, and published. The question is whether the organisation has built the systematic response the Code anticipates.
Systematic psychosocial compliance under Comcare looks the same as it does elsewhere. Hazards are identified through a documented process that covers all 17 categories, not assumed to be absent. Risks are assessed with evidence and with recognition that hazards interact, not considered in isolation. Controls are selected against the hierarchy of controls and mapped to the specific hazards they address. Evidence is generated, stored, and retrievable. Effectiveness is measured, and the whole loop runs continuously.
The alternative is reactive compliance: waiting until an incident, a complaint, or a Comcare inspection forces a response. In a framework with the national reference Code on the books, industrial manslaughter provisions in effect, and the highest penalty ceiling in Australia, reactive compliance is harder to defend here than in any other jurisdiction.
For a more detailed walkthrough of what systematic psychosocial compliance looks like in practice, see our definitive guide to psychosocial compliance in Australia. Commonwealth-covered organisations should also understand how state regulators are enforcing in parallel: New South Wales has the most aggressive enforcement posture nationally, Queensland has had industrial manslaughter on its statute books since 2017, Victoria operates under a different statutory framework, and Western Australia publishes its own state-specific Code of Practice. The cost of psychosocial non-compliance covers the financial side: penalties, claims costs, and operational impact. For the specific process of identifying and assessing hazards against the 17-category framework, see our guide to conducting a psychosocial risk assessment.
Check your Commonwealth compliance readiness
Most Commonwealth-covered organisations have some of the pieces in place: a wellbeing program, an EAP, an engagement survey cycle, a respectful workplace policy. Few have all the pieces, structured in the way a Comcare inspector expects to see them when working against the 2024 Code of Practice and the 17-category hazard framework.
A 5-minute psychosocial compliance readiness survey will give you a sense of where your organisation stands against the current Commonwealth requirements, including the 17-hazard framework and the industrial manslaughter provisions. If you would prefer a conversation, Harrison runs 20-minute compliance gap walkthroughs: no pitch, just a structured look at current posture against what Comcare is now asking for.