What’s the real issue?
Having a psychosocial health and safety policy is not the same as managing psychosocial risk and regulators increasingly treat the gap as a breach. The most common mistake we see is treating this as an HR document rather than a WHS obligation owned by senior leadership exactly the “Band-Aid solution” the Model Code of Practice warns against.
A well-worded policy counts for little if you have not:
- Identified the hazards in your workplace
- Assessed the risk they create
- Redesigned how work is done to control them
- Consulted your people, and
- Checked whether your controls actually work
The numbers are hard to ignore
Psychosocial claims are the fastest-growing area of workers’ compensation in Australia: in 2023-24, mental health conditions were about 12 per cent of serious claims (a 161 per cent rise over the decade), with a median payout near $67,400 four times the overall median and 35.7 weeks off work.
What this looks like in practice
A de-identified, composite example of what we see regularly:
- A mid-sized Queensland organisation restructured a division and made roles redundant. It had the paperwork a WHS policy, a harassment policy, an EAP so leadership felt covered.
- The change was announced Monday, consultation ran Tuesday, decisions were locked in by Friday: about 48 hours of “consultation” on a major change to people’s livelihoods.
- Rumour outran communication, staff reported acute distress, and one complained to the regulator about job insecurity and poor support.
It had no real risk assessment of the change and no leader owning its psychological safety. Its controls ignored the hazard’s source: the design and pace of the change.
What does the law say, and how must it be applied?
You must eliminate psychosocial risk so far as is reasonably practicable, and where you cannot, minimise it. A policy is evidence of intent, not a control.
The core duty
- Under section 19 of the Model WHS Act (adopted everywhere except Victoria), your organisation (a PCBU) must ensure, so far as is reasonably practicable, that workers are not exposed to risks to their psychological health.
- A psychosocial hazard (Regulations, s 55A) arises from the design or management of work, the environment, or workplace interactions bullying, high job demands, low job control, poor support and job insecurity among them.
- The Regulations require a four-step cycle identify, assess, control, review with genuine consultation throughout and a due diligence duty on officers such as directors.
Fix the work, not just the worker
The hierarchy of controls (Regulation 36) is where most go wrong. Eliminate the hazard, or minimise it through work and organisational design, systems of work and the environment. Policies and training sit lower; personal measures are a last resort training reinforces the message, it is not your first control. Victoria’s Psychological Health Regulations (from 1 December 2025) prohibit relying predominantly on training where a higher-order control is reasonably practicable best practice everywhere.
Regulators are enforcing this
- A government department had notices upheld because its misconduct investigations were not timely and its alternative-duties process lacked safeguards.
- A regulator’s prohibition notice halted a large university redundancy, lifting only once consultation and communication improved.
- A Comcare case study found an agency in breach for failing to address immediate risk, despite a plan to fix it over months.
Good intentions and future plans do not discharge a present duty.
What are the risks and pain points for employers?
Enforcement is shifting from education to action. SafeWork NSW has run compliance blitzes with psychosocial hazards as a priority, and a prohibition notice can stop a restructure in its tracks. The mistakes we see are predictable:
- Policy without ownership. Endorsed by HR alone, never translated into controls.
- No genuine risk assessment. Hazards aren’t systematically identified, so controls are generic.
- Individual-level controls only. Leaning on EAP, resilience training and “R U OK?” days for problems rooted in work design.
- Token consultation. Squeezing major change into a day or two.
- Set and forget. No monitoring, no review before significant change.
Psychosocial harm also correlates with physical injury and drives up workers’ compensation costs.
Our top five tips: what every employer should do
- Put a senior leader in charge, not just HR. Psychosocial risk is a WHS obligation owned at the top. In our experience, nothing changes until an accountable executive or officer signs on, resources the work and reports on it treating it exactly like physical safety.
- Run a real psychosocial risk assessment. Identify all reasonably foreseeable hazards using your own data: complaints, investigations, near misses, workers’ compensation trends and health and safety committee minutes. Assess how long, how often and how severely people are exposed, and how hazards combine.
- Fix the work, not just the worker. Apply the hierarchy of controls. Start with work and organisational design and the physical environment: reporting lines, staffing levels, rosters, role clarity, span of control, workloads, and the layout and security of the workplace. Use training to reinforce, never as your only control.
- Consult genuinely, and give it real time. Involve workers and health and safety representatives in identifying hazards and designing controls. For significant change or redundancies, build a realistic consultation timeline; two days is not enough for a complex change and will draw regulator attention.
- Monitor and review. Check whether your controls are working through inspections, data and ongoing consultation, and review before major change, when a new hazard appears, or after an incident.
Frequently asked questions
- What is a psychosocial hazard?
Anything arising from the design or management of work, the working environment, plant, or workplace interactions that may cause psychological harm bullying, sexual harassment, high job demands, low job control, poor support, job insecurity and workplace violence among them.
- Is having a psychosocial health and safety policy enough?
No. A policy is a starting point, not a control. The law requires you to identify hazards, assess and control the risk through the hierarchy of controls, consult workers and review whether the controls work. Regulators have acted against organisations that had policies but failed to manage the actual risk.
- What does “so far as is reasonably practicable” mean here?
Doing everything reasonably able to be done to eliminate or minimise the risk, weighing the likelihood and degree of harm against the availability and cost of controls. It is a demanding standard, and cost alone rarely justifies doing nothing.
- Why does work design come before training in the hierarchy of controls?
Because higher-order controls redesigning the work, systems and physical environment remove the hazard at its source, whereas training only helps people cope with a hazard that is still present. Training is the last control, not the first.
- How much consultation is enough during a restructure or redundancies?
Enough for workers to genuinely understand the change, raise concerns and have them considered before decisions are locked in. Compressing consultation on a complex change into a day or two has been found insufficient and has drawn regulator intervention, including a prohibition notice halting a restructure.
- Can a workplace investigation itself create psychosocial risk?
Yes. Investigations that drag on, lack clear timeframes, provide no updates, or reassign people to lesser duties without safeguards can expose participants to psychosocial hazards. Regulators have upheld notices on this basis, so investigations must be timely, well-communicated and fair.
- What can regulators actually do?
Enter and investigate, require documents, issue improvement and prohibition notices, accept enforceable undertakings, issue infringement notices in most jurisdictions, and prosecute. A prohibition notice can stop a restructure or work activity immediately.
- Do these obligations apply to Queensland councils and not-for-profits?
Yes. The duties apply to virtually every PCBU, including local government, community organisations and not-for-profits, regardless of size.
How Harrisons can help
Get psychosocial risk wrong and one mishandled restructure can cost you a prohibition notice, a stalled change program and a five-figure psychological injury claim. It does not have to.
We help Australian employers manage psychosocial risk properly, not just on paper:
- Psychosocial hazard identification and risk assessments tailored to your workplace
- Work redesign so your controls sit high on the hierarchy, not at the bottom
- Senior leadership ownership and officer due diligence built into how you operate
- Genuine consultation and monitoring, especially around change, restructures and investigations
Get in touch with our team today and book a psychosocial risk health-check — a straightforward first step that shows you exactly where your real exposure sits, and what to do about it.
This article provides general information for Australian employers and is not legal advice. Workplace laws change and how they apply depends on your specific circumstances. For advice tailored to your organisation, contact Harrisons.
Claire Harrison is the Founder and Managing Director of Harrisons, a flourishing HR consulting business that sprouted in 2009 from Claire’s passionate belief that inspiring leaders and superstar employees are the key success factor to any business. With over 20 years’ experience, Claire has worked as a HR Director of multi-national organisations, as a Non-Executive Board Director, and a small business owner. Claire’s corporate career includes working with companies such as BHP, Westpac, Fonterra and Mayne Nickless.
