Psychosocial Risk Management: How to Run a Psychosocial Risk Assessment in Five Steps

Quick answer: Psychosocial risk management is the structured process of identifying, assessing and controlling the workplace factors that can cause psychological harm. To run a psychosocial risk assessment, you follow five named steps. Identify the hazards, assess likelihood and impact on a risk matrix, evaluate the controls you already have, decide what extra controls you need, then document and communicate what you found. The step that separates real risk management from a wellbeing gesture is rating each hazard on the matrix and controlling it at the source, then writing it down.

If you are a WHS or HR lead who has just been told to "do a psychosocial risk assessment" and handed no template, this guide walks you through it. Psychosocial risk management is not a mood survey or a poster campaign. It is the same lifecycle you already use for physical hazards, applied to the things that harm people's mental health. You identify, you assess, you control, you review, and you keep the evidence. Done well, it is repeatable. You can run it this quarter, run it again next year, and show anyone who asks exactly what you did and why.

This article is general information, not legal advice. For advice about your specific obligations, speak to a qualified WHS professional or lawyer.

Why does psychosocial risk deserve the same rigour as a physical hazard?

Because the harm is real and it is expensive. Safe Work Australia reports that a mental health claim takes a median of 35.7 weeks off work, almost five times the median for other injuries, with median compensation of about $67,400. Source: Safe Work Australia. A sprained ankle heals faster than a person worn down by months of harassment or relentless work pressure.

The law caught up with this. The model WHS Regulations were amended in June 2022 to require managing psychosocial risks. New South Wales commenced its provisions on 1 October 2022 and Queensland on 1 April 2023. Source: Safe Work Australia and SafeWork NSW. The duty is not to eliminate every source of stress. It is to manage the risk so far as is reasonably practicable, using a proper process. That process is what the rest of this guide covers.

What are the five steps of a psychosocial risk assessment?

Here is the whole process on one page. Each step produces something concrete, which is the point. If a step does not leave you with a record, you have not really done it.

Step	What you do	What you end up with
Step 1. Identify hazards	Gather the psychosocial hazards present in your workplace using data you already hold and a structured survey.	A list of named hazards, grounded in evidence rather than assumption.
Step 2. Assess likelihood and impact	Rate each hazard on a risk matrix for how likely the harm is and how severe it would be.	A prioritised risk rating for every hazard, so the worst ones surface first.
Step 3. Evaluate existing controls	Check what you already do about each hazard and how well it actually works.	A clear view of where current controls hold and where they leak.
Step 4. Determine additional controls	Decide what further controls you need, aiming to fix the cause at the source rather than manage the symptom.	A prioritised action plan with owners and target dates.
Step 5. Document and communicate	Record the findings, the ratings, the controls and the review dates, then tell the people affected.	An audit-ready record and a workforce that knows what changed and why.

The table looks tidy. The work is not always tidy. But the sequence holds every time, and that is what makes it repeatable.

Step 1. How do you identify psychosocial hazards without guessing?

You use data you already hold, and you add one structured survey. Most employers are sitting on more signal than they realise.

Start with what is already in your systems.

• Absence and turnover data. Clusters of sick leave or resignations in one team are worth a closer look.

• Incident reports and complaints. Patterns matter more than single events.

• Exit interviews. People leaving are often the most honest source you have.

• Performance trends. A team that was steady and is now slipping is telling you something.

Then add a survey built for the job. People at Work is a free, government-backed psychosocial risk assessment survey tool. Source: People at Work. It asks employees about factors like job demands, role clarity and support, and it gives you a benchmarked read on where the pressure sits. For a first assessment, a survey of this kind plus the data above is a solid foundation. You are not diagnosing individuals. You are mapping conditions.

Common hazards that surface include harassment and bullying, high work pressure, low role clarity, poor support and exposure to distressing material. Worth noting, the most common causes of accepted mental health claims are harassment and workplace bullying at 33.2 per cent and work pressure at 24.2 per cent. Source: Safe Work Australia. If your data points the same way, you are looking in the right place.

Step 2. How do you rate a psychosocial hazard on a risk matrix?

This is the step people skip, and skipping it is what turns a real assessment into a wellbeing gesture. A list of hazards is not a risk assessment. A list of hazards with a rating is.

For each hazard, you make two judgements.

• Likelihood. How likely is it that this hazard causes harm, given who is exposed and how often.

• Impact. If harm occurs, how severe would it be, from minor and short-lived through to serious and lasting.

Plot the two on a risk matrix and you get a rating, usually low, medium, high or extreme. The rating does the work you cannot do by instinct. It tells you what to fix first. A hazard that is very likely and highly harmful jumps the queue ahead of one that is rare and mild. Without the matrix, the loudest problem wins attention rather than the most dangerous one.

Rate consistently. If two assessors would score the same hazard differently, agree the scale before you start.

Step 3. What does evaluating existing controls actually involve?

You rarely start from zero. Before you add anything, look hard at what you already do and whether it works in practice.

For each rated hazard, ask three plain questions.

1. What control is meant to be in place right now.

2. Does it happen in reality, or does it live only in a policy document.

3. Does it reduce the risk, or does it just look reassuring.

A bullying policy that no one has read is not a control. A manager check-in that happens once a year is weaker than one that happens monthly. Being honest here is uncomfortable and it is where the value is. You want the gap between the control you claim and the control you have, because that gap is your risk.

Step 4. How do you choose controls that fix the cause, not the symptom?

You aim as high up the hierarchy as you reasonably can. Controlling a psychosocial hazard at the source beats teaching people to cope with it.

Think in that order.

• Eliminate or reduce the hazard. Redesign the workload, fix the roster, deal with the behaviour, clarify the role. This changes the conditions.

• Support and buffer. Training, supervision and clear reporting lines. These help, but they sit lower because they manage exposure rather than remove it.

• Individual support. Employee assistance and return-to-work support. Necessary, but never the first and only answer.

A resilience workshop offered to a team drowning in unrealistic deadlines treats the symptom and leaves the cause running. Fixing the deadline is the control at the source. Turn your choices into a plan with named owners and target dates, or the plan will not survive contact with a busy quarter.

Step 5. Why is documenting and communicating the step that proves it happened?

Because a control you cannot evidence is a control a regulator will treat as absent. This step is where psychosocial risk management becomes defensible.

Record, in one place, the hazards you found, the ratings you gave, the controls you evaluated and added, the owners, and the dates you will review. Then close the loop with your people. Tell the affected teams what came out of the assessment and what is changing. Communication is not a courtesy. It builds the trust that makes the next survey honest, and it shows the workforce that raising something leads somewhere.

Set the review date now, not later. Psychosocial risk is not static. New projects, restructures and leadership changes all shift the picture, so the assessment is a cycle, not a one-off.

Where the Risk Management System fits

Running this once in a spreadsheet is doable. Running it every quarter across several teams, keeping the ratings consistent, tracking who owns each control and proving it all a year later is where manual methods buckle.

The Sentrient Risk Management System is built for that repeatability. It keeps a psychosocial risk register, runs structured assessments, tracks controls and review dates, and produces audit-ready reporting. Sentrient is Melbourne-based, Australian built and owned, and supports more than 1,000 organisations across Australia and New Zealand. To be clear about scope, the software does not fix root causes and it does not replace leadership. What it does is make the process repeatable and the evidence retrievable, so the five steps above hold up under pressure.

Conclusion

Psychosocial risk management is not mysterious. It is five named steps you can run this quarter and repeat next year. Identify the hazards from data you already hold plus a survey, rate each one on a matrix, check the controls you have, add the controls you need at the source, then document and communicate. The matrix and the record are what lift the work from a gesture to genuine risk management. Everything else follows from doing those two things honestly.

If you want a running start, book a walkthrough of how a structured risk register handles the five steps end to end. Book a free Sentrient demo and see the assessment cycle, controls tracking and audit-ready reporting in one place.

For the fuller background on treating mental health risks like any other workplace risk, read the original guide on psychosocial risk management.

Frequently asked questions

1. What is psychosocial risk management in simple terms?

It is the structured process of finding the workplace factors that can harm mental health, rating how serious each one is, putting controls in place and keeping a record. It follows the same lifecycle you already use for physical hazards, applied to psychological risk instead of physical.

2. Do I legally have to do a psychosocial risk assessment?

The model WHS Regulations were amended in June 2022 to require managing psychosocial risks, with New South Wales commencing on 1 October 2022 and Queensland on 1 April 2023. Source: Safe Work Australia and SafeWork NSW. Obligations vary by state, so confirm your specific duty with a qualified professional.

3. What tool can I use to identify psychosocial hazards?

People at Work is a free, government-backed psychosocial risk assessment survey tool that benchmarks factors like job demands, role clarity and support. Pair it with data you already hold, such as absence, turnover, incident reports and exit interviews, for a well-rounded first assessment.

4. Why is the risk matrix step so important?

A list of hazards is not a risk assessment until each hazard carries a rating. The matrix scores likelihood against impact, which tells you what to fix first. Without it, the loudest problem wins attention rather than the most dangerous one, and priorities get set by instinct.

5. How often should I review a psychosocial risk assessment?

Treat it as a cycle, not a one-off. Set a review date during the assessment itself, and revisit sooner whenever conditions change, such as a restructure, a new project or a change in leadership. Psychosocial risk shifts with the workplace, so the record needs to keep pace.