Summary
In short
- As of 1 December 2025 enforceable psychosocial hazard duties apply across all Australian jurisdictions, with Victoria's regulations commencing without transitional provisions.
- New South Wales went further: the WHS Regulation 2025 explicitly requires the hierarchy of controls to be applied to psychosocial risk, a departure from the model regulations which excluded it.
- From 1 July 2026 section 26A of the NSW WHS Act requires PCBUs to comply with an approved Code of Practice or demonstrate an equivalent or higher standard, converting codes from guidance into a compliance benchmark.
- Controls must address the hazard itself. Offering counselling or a wellbeing app while leaving excessive demands unchanged does not satisfy a hierarchy-of-controls duty.
- ISO 45003 is voluntary guidance with no certification, and functions as the recognised method for demonstrating that reasonably practicable steps were taken.
- Analyse by team. Psychosocial risk varies enormously between teams under identical policies, and an organisation-wide average conceals the department that needs action.
What it is
What it is
What is a psychosocial hazard?
An aspect of work design, work organisation, management or interpersonal interaction with the potential to cause psychological or physical harm. Recognised categories include high job demands, low job control, poor support, inadequate role clarity, poor change management, remote or isolated work, bullying, harassment, aggression and exposure to traumatic material.
Is psychosocial risk assessment a legal requirement?
In Australia, yes and explicitly. Enforceable psychosocial hazard obligations now apply in every state and territory, completed on 1 December 2025 when Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 took effect with no transitional provisions. Elsewhere the duty arises through general risk assessment obligations, which regulators interpret as covering work-related stress and psychosocial conditions.
When to use it
When to use it, and when not to
This assessment addresses work-related psychosocial hazards. It is not a clinical instrument and it is not an engagement survey.
Use it for
- Systematic assessment of the recognised psychosocial hazard categories, at team level
- Following organisational change, restructure, staffing reduction or a shift in workload
- After a psychological injury claim, grievance pattern, or spike in absence or turnover in a team
- Roles with exposure to trauma, aggression, distressing material or remote and isolated work
- Where consultation or reporting indicates that demands, control or support have deteriorated
Not for
- Employee engagement surveys, which measure satisfaction rather than assessing hazard and risk
- Individual clinical assessment, which is a health matter for occupational health rather than a risk assessment
- The employee assistance programme, which is a support measure and not a control for a work design hazard
- Grievance and disciplinary processes, which address specific conduct rather than systemic exposure
- Wellbeing initiatives, which sit below the hierarchy and cannot substitute for higher controls
Standards
What it is built against
Psychosocial duties are explicit in Australia and implicit elsewhere, with an international guidance standard supplying the method.
| Clause | Requirement | Where it lands |
|---|---|---|
| Model WHS Regulations | PCBUs to identify psychosocial hazards and eliminate or minimise risk so far as reasonably practicable | Hazards assessed |
| NSW WHS Regulation 2025 | Hierarchy of control measures explicitly applied to psychosocial risk, from August 2025 | Outcome |
| NSW WHS Act s.26A | From 1 July 2026, comply with an approved Code of Practice or demonstrate an equivalent or higher standard | Header |
| Vic OHS (Psychological Health) Regs 2025 | Standalone psychosocial obligations from 1 December 2025, with no transitional provisions | Header |
| ISO 45003 | Guidance on managing psychosocial risk within an OH&S management system | Hazards assessed |
| ISO 45001 cl.6.1.2 | Hazard identification explicitly covering work organisation and social factors | Site specific factors |
| HSE Management Standards | Six domains: demands, control, support, relationships, role and change, with an assessment approach | Hazards assessed |
| OSHA General Duty Clause | US route where a recognised psychosocial hazard such as violence is not otherwise regulated | Header |
What it does not cover
- Engagement surveys, which measure how people feel rather than identifying hazards and assessing risk.
- Clinical assessment of individuals, which is occupational health activity with its own confidentiality.
- Employee assistance programmes, which are support rather than controls for a work design hazard.
- Grievance and conduct processes, which handle specific incidents rather than systemic exposure.
- Sexual and gender-based harassment prevention, which in Australia carries its own Code of Practice and proactive duties.
Filling it in
Filling it in well
Assess the work, not the person, and at the level where the variation actually exists.
Psychosocial risk varies enormously between teams operating under identical policies, and the difference is usually local: the immediate manager, the workload, the roster. An organisation-wide average will look acceptable while one department is failing badly, and that department is precisely what the aggregate conceals.
Job demands, job control, support, role clarity, change management, remote or isolated work, bullying, harassment, aggression and violence, exposure to traumatic content, and reward and recognition. Assessing against a named list rather than asking open questions produces findings that can be compared, tracked and controlled.
Can the demand be reduced, the work redesigned, the roster changed, the role clarified, the exposure limited? Record why each higher-order option was rejected before proposing training or support. Where the hierarchy is a regulatory requirement, that reasoning is the evidence, and where it is not, it is still what makes the assessment credible.
Every recognised category describes a job characteristic rather than a personal one. Nobody needs to disclose a condition for the assessment to work, and framing it around the work is both more accurate and far less intrusive than asking people about their mental health.
Audit findings
Common audit findings
Findings here concentrate on level of analysis and on the control decision.
| Finding | Clause | What fixes it |
|---|---|---|
| Assessment conducted only at organisation level. | ISO 45003 | Assess by team; the variation and the cause both sit locally. |
| Controls limited to support services where higher-order options existed. | NSW WHS Reg 2025 | Apply the hierarchy; redesign work before offering counselling. |
| Engagement survey presented as a psychosocial risk assessment. | ISO 45003 | A survey measures perception; an assessment identifies hazards and evaluates risk. |
| Assessment not conducted despite operating in a jurisdiction with an explicit duty. | Model WHS Regulations | Duties are now enforceable across all Australian jurisdictions. |
| Code of Practice not followed and no equivalent standard demonstrated. | NSW WHS Act s.26A | From July 2026 in NSW, falling short of the Code can itself constitute a breach. |
| Workers not consulted on hazards or controls. | ISO 45001 cl.5.4 | Consultation is a legal requirement and the only reliable source of what is actually happening. |
| No reassessment after restructure or staffing reduction. | ISO 45003 | Organisational change is itself a recognised hazard and a review trigger. |
| Exposure to traumatic material not assessed for the roles affected. | Model WHS Regulations | Assess it directly; it is a named category and is frequently omitted. |
| Controls implemented with no monitoring of effectiveness. | ISO 45001 cl.9.1 | Reassess the same domains after a period; movement is the evidence. |
| Findings aggregated so that individuals could be identified. | Privacy law | Report at a level that preserves anonymity, or the data stops being honest. |
Worked case
Case in point: the year psychosocial risk became enforceable everywhere
Australia's regulatory position moved decisively between 2021 and 2025. New South Wales published the first dedicated Code of Practice in 2021, the model WHS Regulations added explicit psychosocial duties in 2022, Western Australia followed the same year, and Tasmania, Queensland and the Commonwealth in 2023. The final piece landed on 1 December 2025, when Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 took effect with no transitional provisions.
New South Wales then went further than the model provisions. Its WHS Regulation 2025, commencing in August 2025, explicitly requires the hierarchy of controls to be applied to psychosocial risk, which the model regulations had excluded. From 1 July 2026, section 26A converts approved Codes of Practice into a compliance benchmark: a PCBU must follow the Code or demonstrate an equivalent or higher standard.
The practical consequence for a multi-jurisdiction employer is that a single national policy establishes a baseline and no longer satisfies every jurisdiction, because the control duty and the status of codes now differ between them.
Definitions
Definitions and key terms
- Psychosocial hazard
- An aspect of work design, organisation, management or interpersonal interaction with potential to cause psychological or physical harm.
- Job demands
- The physical, mental and emotional effort required, including workload, pace and hours. A recognised hazard category.
- Job control
- The degree of influence a worker has over how and when work is done. Low control is a recognised hazard.
- PCBU
- Person conducting a business or undertaking, the duty holder under Australian WHS legislation.
- Code of Practice
- Approved practical guidance. In NSW from July 2026, compliance with it or an equivalent standard becomes a duty.
- Hierarchy of controls
- The ranked sequence of control types, now explicitly required for psychosocial risk in several Australian jurisdictions.
- ISO 45003
- International guidance on psychosocial risk management. Voluntary, with no certification available.
- Traumatic content exposure
- Exposure to distressing material or events through work, a recognised category requiring specific controls.
FAQ
Frequently asked questions
Is psychosocial risk assessment legally required?+
In Australia, explicitly and in every jurisdiction. The national picture completed on 1 December 2025 when Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 took effect. Elsewhere the duty arises through general risk assessment obligations, which regulators interpret as covering work-related stress and psychosocial conditions, and through specific regimes such as workplace violence requirements.
Does offering counselling satisfy the duty?+
Not where the hierarchy of controls applies. New South Wales, Queensland, South Australia and the Commonwealth require higher-order controls such as redesigning work or modifying systems before relying on training or counselling. An assessment that identifies excessive demands and responds with an employee assistance programme has applied a lower-order control where a higher-order one was available.
What changes in New South Wales in July 2026?+
Section 26A of the WHS Act takes effect, requiring PCBUs to comply with an approved Code of Practice or demonstrate an equivalent or higher standard. This converts codes from advisory guidance into a compliance benchmark, meaning falling short of the Code can constitute a breach without the regulator needing to prove that harm occurred.
Do we need to ask people about their mental health?+
No, and the assessment works better if you do not. Every recognised hazard category describes a characteristic of the work: demands, control, support, role clarity, change management, exposure. Assessing those requires nobody to disclose a personal condition, and framing the assessment around the work is both more accurate and considerably less intrusive.
Why analyse by team?+
Because psychosocial risk varies enormously between teams operating under identical policies, and the difference is usually the immediate manager, the workload or the roster. An organisation-wide result will look acceptable while one department is failing, and the aggregate is precisely what hides it.
The agents
What the agents do with it
The assessment identifies hazards in the work. What fails is the organisation-level average and the control that offered support instead of change.
Holds the assessment by team against the recognised hazard categories, and tracks control decisions against the hierarchy rather than accepting support measures.
Watches absence, turnover and reporting patterns by team for movement that should trigger reassessment ahead of the cycle.
Connects aggression, violence and traumatic exposure findings to the incident and security records where those hazards materialise.
Builds manager capability where the assessment identifies support and role clarity as the dominant gaps, since the immediate manager is the largest modifiable factor.
This template lives in KnowHealth — employee wellbeing. Exposure monitoring, health surveillance, case management and return to work.
Meet KnowHealth→Sources
Sources
- ISO 45003:2021, psychological health and safety at work, guidelines for managing psychosocial risks
- Model WHS Regulations and Safe Work Australia model Code of Practice: Managing psychosocial hazards at work
- Work Health and Safety Regulation 2025 (NSW) and WHS Act section 26A
- Occupational Health and Safety (Psychological Health) Regulations 2025 (Victoria)
- HSE Management Standards for work-related stress (GB)