How to Run a Psychosocial Hazards at Work Risk Assessment: A Step-by-Step Guide for Australian Employers
You know the law changed. You have read that psychosocial hazards at work are now regulated workplace health and safety hazards across Australia, and that employers have to manage them. What most guidance skips is the practical part. Where do you actually start, and what do you do on Monday morning?
Here is the reassuring bit. You are not learning a brand new system. Managing psychosocial risk is the same four-step process you already apply to a slippery floor or a piece of machinery. Identify, assess, control at the source, review. The only real difference is the type of hazard you are looking at, and the honesty it takes to look at how the work is designed rather than at the people doing it. Manage the work, not just the worker.
This article is general information and not legal advice. For obligations specific to your organisation and state, check the regulator and seek professional advice.
What are psychosocial hazards, in plain terms?
Psychosocial hazards are aspects of how work is designed, organised and managed, and the social conditions around it, that can cause psychological harm. They are not about fragile individuals. They are about the work itself.
Safe Work Australia recognises 14 of them. The list includes high or low job demands, low job control, poor support, unclear roles, poorly managed change, low reward and recognition, poor organisational justice, exposure to traumatic material, remote or isolated work, a poor physical environment, violence and aggression, bullying, harassment, and conflict or poor workplace relationships. You do not need to memorise the list. You need a process that surfaces whichever of these are live in your workplace.
The business case is not abstract. According to Safe Work Australia, mental health conditions made up 12 per cent of serious workers compensation claims in 2022-23. Those claims ran to a median of 35.7 weeks lost, compared with 7.4 weeks for all serious claims, and a median payment of $67,400 compared with $16,300. A worker off for the better part of a year is a real operational cost, and the process below is how you get in front of it.
Step one: how do you identify psychosocial hazards?
You start with the data you already have. Most employers assume identification means running a big new survey. It can include that, but the fastest start is to read what is already sitting in your systems.
Pull together and look for patterns in:
Absence and sick leave records, especially spikes tied to one team or one manager
Staff turnover and exit interview notes
Complaints, grievances and any bullying or harassment reports
Incident and hazard reports, including near misses
Workers compensation and return-to-work data
Then talk to your people. Consultation with workers is a legal expectation and it is also where the real information lives. Ask teams about workload, deadlines, how much say they have over their work, and whether support is there when things get hard. What you are building is a shortlist of hazards that actually exist in your workplace, not a generic list copied from a template.
Step two: how do you assess the risk?
Once you have your shortlist, you assess each hazard the same way you would a physical one. You are weighing up how serious the risk is so you know what to tackle first.
For each hazard, consider:
Likelihood. How often are workers exposed to it? Daily, or once a quarter?
Severity. How much harm could it cause, and how lasting?
Number of people affected. One role, one team, or the whole site?
How hazards combine. This is the one people miss. High job demands on their own may be manageable. High demands plus low control plus poor support at the same time is a far higher risk than any of the three alone.
Write down your reasoning as you go. The output of this step is a prioritised view of your hazards, from most urgent to least, with a short note on why. Safe Work Australia's model Code of Practice, Managing psychosocial hazards at work, sets out this approach in detail and is worth reading alongside your own assessment.
Step three: how do you control the hazard at its source?
This is the step that matters most and the one most employers get wrong. The instinct is to send people to a resilience workshop or hand out an employee assistance number and call it managed. Those things have a place, but they treat the worker, not the work. If the workload is the hazard, a mindfulness session does not remove it.
Controlling at the source means changing the work. Depending on the hazard, that can look like:
Staffing against demand. Match the number of people to the actual volume of work, and plan for peaks instead of running permanently short.
Clear roles. Define who is responsible for what so people are not stuck in constant ambiguity or conflict.
Better rostering. Manage shift patterns, on-call load and recovery time so fatigue does not build.
Real reporting channels. Give workers a safe, simple way to raise a hazard and make sure something happens when they do.
Management training. Equip managers to spot early warning signs and to run work in a way that does not manufacture the hazard in the first place.
Higher-order controls that change the work sit above lower-order ones that ask the individual to adapt. Start at the top of that list and work down.
Bringing this into one system. Sentrient's incident and hazard reporting software captures psychosocial reports alongside physical ones, so a workload concern or a bullying report lands in the same place as a trip hazard. That gives you the reporting channel from step three and feeds the data trail you need for steps one and four. Sentrient is Melbourne-based, Australian built and owned, and trusted by more than 1,000 Australian organisations, and most customers are operational within about a week.
Step four: how often do you review?
Controls are not set and forget. You review them on a schedule, and you review them whenever something changes.
Review your controls:
On a set cycle, for example every 6 or 12 months
After any incident or serious report
After a restructure, a change in leadership, or a shift in workload or headcount
The point of review is to check whether your controls are actually working, and to catch new hazards that a change in the business has introduced. What you end up with is a living record that shows you identified risks, acted on them, and kept checking. That evidence trail is exactly what a regulator expects to see.
The four-step process at a glance
Why this matters now
The regulatory ground has moved. The model WHS regulations were amended from 2022 to explicitly name psychosocial hazards, according to Safe Work Australia. Victoria has gone further, with its OHS (Psychological Health) Regulations commencing on 1 December 2025 alongside a compliance code, according to WorkSafe Victoria. The direction of travel across the country is clear. Psychological safety is now treated with the same seriousness as physical safety, and the same process applies.
Running this four-step cycle supports your compliance obligations and helps you build a genuine record of due diligence. It does not guarantee compliance, and no tool or process can. What it does is give you a defensible, repeatable way to manage the work.
The four steps are simple to describe and harder to hold to over time, especially the discipline of controlling at the source rather than reaching for the coping workshop. Sentrient supports the whole cycle with policies, training, risk registers and reporting in one place, so the evidence builds as you work rather than in a scramble before an audit.
Ready to make a start? Book a free demo to see how psychosocial and physical hazards can be captured, assessed and reviewed in one system, or use this guide as your first-assessment checklist. For the full plain-English background, read our original guide to psychosocial hazards at work.
Frequently Asked Questions
1. Do I need a separate system for psychosocial hazards?
No. You use the same four-step risk process you already run for physical hazards. Identify, assess, control at the source, and review. The hazard type is different and the controls focus on work design, but the method and the evidence trail are the same one you know.
2. What data should I use to identify psychosocial hazards?
Start with information you already hold. Absence and sick leave records, staff turnover and exit interviews, complaints and grievances, incident and hazard reports, and workers compensation data all point to patterns. Then consult workers directly about workload, control and support to confirm what the numbers suggest.
3. What does controlling a hazard at the source actually mean?
It means changing the work rather than asking the worker to cope with it. If workload is the hazard, you adjust staffing or deadlines instead of only offering a resilience session. Higher-order controls that change work design sit above lower-order ones that rely on the individual adapting.
4. How often should I review my controls?
Review on a set cycle, such as every 6 or 12 months, and also whenever something changes. That means after any incident or serious report, and after a restructure, a leadership change, or a shift in workload. Review confirms your controls still work and catches new hazards early.
5. Does running this process guarantee we are compliant?
No process or tool can guarantee compliance. Running the four-step cycle and keeping records supports your obligations and helps demonstrate due diligence. For requirements specific to your organisation and state, check your regulator and seek professional advice. This article is general information, not legal advice.
Comments
Post a Comment