Managing psychosocial risks follows the same process you use for any other workplace health and safety risk.
There's nothing mysterious or complicated about it. If you can manage risks from machinery, chemicals, or working at heights, you can manage psychosocial risks.
The four steps are:
This is the risk management process required under Australian WHS law and it's outlined in Safe Work Australia's Code of Practice on Managing Psychosocial Hazards at Work.
Identify Psychosocial Hazards
Find out what's happening in your workplace
The first step is identifying which psychosocial hazards are present in your workplace. You can't manage risks you don't know about.
How to identify psychosocial hazards:
- Workers know what's happening on the ground—they're your best source of information
- Use surveys, focus groups, toolbox talks, or one-on-one conversations
- Ask open questions: "What makes your job stressful?" or "What would make this work easier?"
Consider all 14 psychosocial hazards:
Key point: Don't wait for complaints to identify hazards. Be proactive.
Assess the Risks
Determine which risks need action first
Once you've identified psychosocial hazards, the next step is assessing the level of risk they create.
What you're assessing:
Likelihood
How often are workers exposed to this hazard? How many workers are affected?
Severity
If harm occurs, how serious would it be? Could it result in psychological injury, or just minor stress?
Duration
Is the exposure ongoing or temporary? Are workers exposed for hours, days, weeks, or longer?
Interactions
Are multiple hazards occurring together? Is one hazard making another worse?
Example:
High job demands (e.g., long shifts with tight deadlines) might be manageable if workers have good support, adequate resources, and control over how they work. But if they're also experiencing poor support and lack of control, the combined risk is much higher.
Prioritize your response:
Focus on the hazards that create the highest risk:
- Those affecting the most workers
- Those with the potential for serious harm
- Those that are frequent or prolonged
You don't need to fix everything at once—but you do need to address the highest risks first.
Control the Risks
Eliminate or minimise hazards at their source
This is where you take action to eliminate or minimise psychosocial risks.
Under WHS law, you must eliminate risks where reasonably practicable. If elimination isn't possible, you must minimise the risks so far as is reasonably practicable.
The Hierarchy of Controls
Controls are most effective when they target the hazard at its source. Use the hierarchy of controls:
Important: PPE-level controls (like training or EAPs) should never be your only response. They don't eliminate or minimise the hazard—they just help workers cope with it.
Examples of effective controls:
Controls for High job demands:
- Increase staffing levels
- Adjust deadlines or workloads
- Prioritize tasks and remove non-essential work
- Provide adequate resources and equipment
Review Your Controls
Make sure controls are working
Risk management doesn't stop once you've implemented controls. You need to review them regularly to ensure they're effective.
When to review:
Regularly
- Schedule reviews at least annually
- More frequently for high-risk hazards
When things change
- Before implementing changes (like restructures, new rosters, or new technology)
- After changes have been made, to check the impact
When controls aren't working
- If workers report that controls aren't effective
- If incidents, complaints, or injuries occur
- If monitoring shows risks aren't being reduced
After incidents or complaints
- Review what happened and why
- Determine if controls need to be adjusted
How to review:
Ask yourself:
- Have we eliminated or minimised the hazard?
- Are workers less exposed to risk?
- Do we need to do more?
If controls aren't working, adjust them. Don't assume that because you've "done something," the risk is managed.
Involve workers at every step
Consultation with workers isn't just good practice—it's a legal requirement.
Workers must be consulted when you're:
- Identifying hazards
- Assessing risks
- Deciding on control measures
- Reviewing the effectiveness of controls
- Making changes that might affect health and safety
Why consultation matters:
Workers are the people who experience psychosocial hazards firsthand. They know:
- What's actually happening in the workplace
- Which hazards are causing the most problems
- What controls are likely to work (and which won't)
How to consult effectively:
Warning: Poor consultation is worse than no consultation—if workers feel their input is ignored, it damages trust and makes future consultation harder.
Document what you're doing
You must keep records of your risk management activities.
What to document:
- Hazard identification activities (surveys, consultation, observations)
- Risk assessments
- Control measures implemented
- Consultation with workers
- Reviews of controls
- Incident reports and complaints
- Actions taken in response to incidents or complaints
Why records matter:
⚠️ If you can't show you've managed the risks, a regulator may conclude you haven't—even if you've done the work informally.
What not to do
Relying only on policies or training
Policies and training don't eliminate or minimise hazards—they're the least effective controls. Always focus on changing work design, systems, and management practices first.
Waiting for complaints
Don't wait for someone to complain before identifying hazards. Be proactive.
Treating psychosocial risk as a "mental health issue"
Offering EAPs or resilience training doesn't eliminate hazards at their source. These supports can help, but they're not substitutes for proper risk management.
Skipping consultation
You're legally required to consult workers—and it leads to better outcomes. Don't skip this step.
Assuming controls are working
Review your controls regularly. Don't assume they're effective just because you've implemented them.
Doing it once and stopping
Risk management is ongoing. Hazards change, circumstances change, and controls need to be reviewed and updated.
Where to begin
If you haven't started managing psychosocial risks yet, here's how to begin:
Educate yourself
- Understand what psychosocial hazards are
- Learn about the 14 specific hazards
- Understand your legal duties
Consult with workers
- Ask them what's causing stress, frustration, or harm
- Use the 14 hazards as a framework for discussion
Prioritize
- Identify which hazards are creating the highest risks
- Start with those
Take action
- Implement controls that target the hazard at its source
- Focus on work design and systems, not just training or policies
Review
- Check whether your controls are working
- Adjust as needed
You don't need to solve everything at once—but you do need to start.
Are You Meeting Your Legal Duties?
Most businesses have significant gaps in their approach to psychosocial hazards—and don't realise it until a complaint triggers an investigation. Find out where you stand before a regulator does.
- Identify compliance gaps before a regulator does
- Understand your current risk level
- Get tailored priority actions
- Access relevant resources for your situation
No signup required • Results in 2 minutes
Your Compliance Score
You don't have to do this alone
Most businesses can make significant progress using the guidance available on this site. But sometimes, external support can save time and ensure you're meeting your duties effectively.
Consider seeking advice if:
- You're unsure how to identify or assess psychosocial risks in your workplace
- You need help designing effective control measures
- You want an independent review of your systems
- You've received a complaint or improvement notice
- You're planning significant changes and want to get ahead of potential risks
A confidential conversation with someone who understands psychosocial risk management and your industry can provide clarity and practical guidance.
Let's chat