WorkSafe Victoria has published Compliance Code: Psychological Health (Edition 1, September 2025) to support the Occupational Health and Safety (Psychological Health) Regulations 2025, which took effect on 1 December 2025. The Code is published as an 11-part series on the WorkSafe Victoria website, covering introduction, hazard identification, risk assessment, control measures and review.

The Code provides the most detailed guidance any Australian regulator has published on what effective psychosocial risk management looks like in practice.

Legal status: deemed compliance

The Compliance Code is not legally binding. A breach of the Code is not, in itself, a breach of the Occupational Health and Safety Act 2004 (Vic) or the 2025 Regulations. However, an employer who complies with the Code will, to the extent it deals with their duties or obligations under the Act or the Regulations, be taken to have complied with those duties or obligations.

This is the practical significance. Compliance with the Code is deemed compliance with the law. For employers, following the Code is the most straightforward path to demonstrating they have met their obligations.

WorkSafe Victoria will regard the contents of the Code as information about psychosocial hazards and ways of controlling them of which employers ought reasonably to know. This means the Code sets the standard against which WorkSafe will assess what is reasonably practicable. An employer who is unfamiliar with the Code's content cannot claim ignorance of what was available. Failure to observe the Code may also be used as evidence in proceedings for an offence under the Act or the Regulations.

A WorkSafe inspector may cite the Code in the direction or condition of an improvement notice or prohibition notice. A health and safety representative may cite it in a provisional improvement notice.

Structure of the Code

The Code follows a four-step risk management process: identify psychosocial hazards, assess the risks, control the risks, and review the controls. For each step, it provides practical guidance on what employers must do and how to do it.

Step 1: Identify hazards. The Code sets out how employers should identify psychosocial hazards through consultation with workers, review of organisational data including incident reports and complaints, analysis of work design and systems of work, and consideration of how hazards interact and combine. It notes that an absence of reported incidents does not mean hazards are not present but may indicate a reluctance to report.

Step 2: Assess the risks. The Code guides employers through assessing the nature and severity of harm, the likelihood of it occurring, the duration and frequency of exposure, and how multiple hazards may interact. The assessment informs the selection and prioritisation of control measures.

Step 3: Control the risks. The Code provides detailed guidance on implementing controls in accordance with the Regulations' control measure structure: eliminate the risk where reasonably practicable, then reduce the risk by altering the management of work, plant, systems of work, work design or the workplace environment. Information, instruction or training cannot be the exclusive or predominant control unless alteration measures are not reasonably practicable.

Step 4: Review the controls. The Code explains the circumstances that trigger a review and what a review should involve. It specifies that a procedure should be in place to monitor and maintain controls, and that the effectiveness of controls should be assessed over time.

Hazard-by-hazard guidance

The Code's practical value lies in its hazard-by-hazard approach. For each psychosocial hazard, it describes what the hazard looks like, provides questions employers should ask to identify whether the hazard is present, and sets out specific examples of control measures.

The hazards covered include bullying, sexual harassment, aggression and violence, exposure to traumatic events and traumatic content (including vicarious trauma), high job demands, low job control, poor support, lack of role clarity, poor organisational change management, poor organisational justice, remote or isolated work, poor workplace relationships, and gendered violence.

For each hazard, the Code provides concrete control measure examples. For high job demands, the Victorian Government Solicitor's Office notes the Code recommends measures such as developing internal processes for managing peak demand periods and unplanned absences, and providing adequate support and encouraging regular breaks for work involving high concentration or emotionally demanding content.

For management of work, the Code recommends reviewing current processes to eliminate unnecessary administrative tasks, arranging rosters so employees can vary tasks that require high concentration, providing clear management reporting structures, and ensuring employees have the necessary qualifications and experience for their roles.

The Code also emphasises that psychosocial hazards rarely occur in isolation. Employers need to consider how hazards combine and interact. The cumulative impact of multiple psychosocial hazards poses a greater risk than any individual hazard alone. For example, an employer who identifies poor workplace relationships may, on further investigation, find that high job demands and poor support are contributing factors that need to be addressed together.

What the Code does not require

The Regulations do not require prevention plans or routine reporting to WorkSafe Victoria. Earlier draft regulations proposed both, but the final version removed these requirements. WorkSafe Victoria encourages employers to use the prevention plan template available on the WorkSafe Victoria website, noting that while not mandatory, a documented prevention plan is one of the clearest ways to demonstrate compliance.

Practical value for all jurisdictions

While the Compliance Code applies only in Victoria, its hazard-by-hazard structure and detailed control measure examples are relevant to employers in any Australian jurisdiction. The psychosocial hazards it covers and the risk management process it describes are consistent with the model Code of Practice published by Safe Work Australia and adopted across the harmonised jurisdictions. Employers managing psychosocial risk in any state or territory will find the Victorian Code a useful reference for what structured, hazard-specific risk management looks like in practice.

For the full context on the Victorian Regulations, and for the state-by-state breakdown of psychosocial compliance requirements, see the linked articles.

Disclaimer: This article provides general information on psychosocial compliance in Australian workplaces. It does not constitute legal advice. Organisations should consult qualified professionals for advice specific to their circumstances. Regulatory references are sourced from WorkSafe Victoria, K&L Gates, and the Victorian Government Solicitor's Office and are current as of the date of publication.