Quick answer: A psychosocial risk assessment is the structured process of identifying the work-related hazards that can cause psychological harm (such as high job demands, low control, poor support, bullying and exposure to trauma), assessing how likely and severe that harm is, implementing controls that change the work itself, and reviewing whether they worked. In Australia it is a legal duty under the model WHS Regulations, and it must be done in consultation with workers.
Psychosocial hazards moved from guidance to regulation across most of Australia between 2022 and 2025. The model WHS Regulations now expressly require a person conducting a business or undertaking to manage psychosocial risks; Queensland, NSW, Western Australia, Tasmania, the ACT, the Northern Territory and the Commonwealth have adopted regulations or codes, and Victoria's Occupational Health and Safety (Psychological Health) Regulations commenced in December 2025. The positive duty under the Sex Discrimination Act, enforced by the Australian Human Rights Commission since late 2023, overlaps heavily. New Zealand's Health and Safety at Work Act has always covered psychological health, and WorkSafe NZ guidance has sharpened accordingly.
The compliance question is settled. The operational question is not: how does an organisation with 5,000 or 50,000 workers across hundreds of sites actually assess psychosocial risk in a way that is credible to a regulator, useful to a manager, and repeatable every year? This guide is for WHS, HR and risk leaders who own that problem, and for the technology leaders who support them.
What is a psychosocial risk assessment, and why is it harder than a physical one?
A psychosocial risk assessment follows the same four steps as any WHS risk management process: identify hazards, assess risks, control risks, review controls. The difference is in the nature of the hazards. A guarding gap on a machine is visible, local and stable. Psychosocial hazards are:
- Systemic. They arise from how work is designed, organised and managed, not from a single piece of equipment.
- Cumulative and interacting. High demands with high control and good support may be sustainable; high demands with low control and poor support are not. The combination matters more than any single hazard.
- Perceived as well as measured. Workers' experience of the hazard is itself evidence, which is why consultation and surveys are central rather than optional.
- Spread across functions. The controls sit with HR (job design, workload, change management), operations (rostering, staffing), leadership (behaviour, culture) and WHS (incident response), not with one owner.
That is why spreadsheet-and-workshop approaches that work for a single site collapse at enterprise scale. You need a method, a data model and a system.
What are the 14 psychosocial hazards?
Safe Work Australia's model Code of Practice, Managing psychosocial hazards at work (2022), lists common hazards that the state codes mirror with minor variations:
- Job demands — Typical examples: Sustained high workload, time pressure, emotional demands, unreasonable targets
- Low job control — Typical examples: No say over pace, order or method of work; rigid scripts
- Poor support — Typical examples: Inadequate supervision, tools, training or peer support
- Lack of role clarity — Typical examples: Conflicting or ambiguous responsibilities
- Poor organisational change management — Typical examples: Restructures and new systems without consultation or information
- Inadequate reward and recognition — Typical examples: Effort-reward imbalance, no feedback, no development
- Poor organisational justice — Typical examples: Inconsistent or unfair application of policies and decisions
- Traumatic events or material — Typical examples: Exposure to death, injury, abuse or distressing content
- Remote or isolated work — Typical examples: Lone work, fly-in fly-out, home-based work without support
- Poor physical environment — Typical examples: Noise, heat, unsafe or poorly maintained spaces (interacts with psychological harm)
- Violence and aggression — Typical examples: From customers, patients, students or the public
- Bullying — Typical examples: Repeated unreasonable behaviour creating a risk to health and safety
- Harassment, including sexual harassment — Typical examples: Unwelcome conduct; also triggers the positive duty
- Conflict or poor workplace relationships — Typical examples: Unresolved interpersonal conflict, incivility
Two points for practitioners. First, several hazards are created by HR and transformation programmes: restructures, new rostering systems, automation of tasks and pay or classification disputes all sit under organisational change management and organisational justice. (Underpayment, for example, is a psychosocial hazard as well as a compliance failure; see payroll compliance in Australia.) Second, the regulator expects controls that change the work, not only resilience training and employee assistance programmes. Those are supports, not controls.
What data should an enterprise psychosocial risk assessment use?
Credible assessments triangulate at least three sources.
- Validated worker surveys. The People at Work survey (developed by Australian regulators and universities, free to use) measures the hazards above against Australian benchmarks and is explicitly designed as a psychosocial risk assessment tool. International equivalents include the Copenhagen Psychosocial Questionnaire (COPSOQ) and the UK HSE Management Standards Indicator Tool. Run them at a level of granularity that produces actionable results (team, site, role family) while preserving anonymity.
- Lagging indicators from existing systems. Psychological injury claims and their duration, incident and hazard reports, grievance and complaint data, absence and turnover patterns, exit interview themes, EAP utilisation trends (aggregate only), overtime and leave balance data from payroll and rostering systems.
- Consultation. Structured conversations with workers, health and safety representatives and managers to interpret the data and co-design controls. Consultation is a legal requirement, and it is also where the real hazards (the roster nobody can refuse, the customer who is never barred) surface.
The data model that makes this repeatable is simple: every hazard observation (survey score, incident, claim, consultation finding) is tagged to a hazard category, a work group, a site and a date, so that risk can be rolled up and drilled into. Few organisations have this today. Most have survey results in one vendor's portal, incidents in a WHS system, claims in an insurer's spreadsheet and HR data in the HRIS, with nothing joining them. (Clean people data is foundational; see how to choose and consolidate an HRIS.)
How do you assess and prioritise psychosocial risk?
Once hazards are identified, assessment asks how likely harm is, how severe it could be, how many people are exposed and for how long. A practical approach for large organisations:
- Segment by work group, not by individual. Risk lives in roles and teams.
- Score likelihood and consequence using your existing enterprise risk matrix, informed by survey benchmarks (for example, People at Work's risk bands), incident and claim history, and the duration and frequency of exposure.
- Weight interactions. A work group with high demands, low control and poor support is a higher priority than one with a single elevated hazard.
- Record the hierarchy of controls applied. Elimination and substitution (redesign the work, remove the trigger), engineering and administrative controls (staffing, rostering, duress systems, procedures, training), and supports (EAP, peer support). Regulators look for the top of the hierarchy, not the bottom.
- Assign owners who can change the work. If the control is "reduce workload", the owner is the operational leader who sets the workload, not the WHS adviser.
Can WHS software manage psychosocial risk?
Partly, and the gap is closing. Most enterprise WHS management systems were built for physical hazards: incident reporting, hazard registers, audits and inspections, contractor management, chemical registers. For psychosocial risk, evaluate platforms against these capabilities:
- Hazard taxonomy that includes psychosocial categories aligned to the model code, so incidents, hazards and survey findings can be classified consistently.
- Survey integration or native surveys with benchmarking, anonymity thresholds and results mapped to work groups.
- Confidential reporting channels for bullying, harassment and violence, with workflows that respect privacy and the positive duty.
- Risk register and controls tracking that supports the hierarchy of controls and records owners, due dates and review outcomes.
- Integration with HRIS and rostering for exposure data (hours, overtime, leave, tenure, structure) and with claims systems for outcomes.
- Analytics that join leading and lagging indicators by work group and show trend over time.
- Due diligence reporting for officers under the WHS Act, who must be able to show they understand the hazards and have verified controls.
Where a platform cannot do this, a people-analytics or GRC layer sitting across the WHS system, HRIS and survey tool is a common pattern. Be careful with AI features that claim to detect psychosocial risk from communications or sentiment data; the privacy, consent and trust implications are serious, and the Privacy Act reform direction in Australia increases the obligations around employee data, not the reverse.
In practice: a health service across 30 sites
A public health service with 22,000 staff ran People at Work across all directorates, giving results at ward and department level where groups exceeded the anonymity threshold. Survey results were loaded into the WHS platform's risk register and tagged by hazard category and work group alongside two years of incident reports (particularly occupational violence) and psychological injury claims. The combined view showed that emergency and mental health units had the expected violence exposure, but that a cluster of administrative teams scored worst on role clarity and organisational change after a shared-services restructure, with rising absence to match. Controls for the clinical units were engineering and administrative (duress alarms, security staffing, triage redesign). Controls for the administrative teams were owned by the transformation office: role redefinition, a change management standard requiring consultation, and a pause on further restructuring until the review. Officers received a quarterly dashboard joining the three data sources; the next survey cycle was scheduled 18 months later with pulse checks on the highest-risk groups in between.
What does ISO 45003 add?
ISO 45003:2021 is the international guidance standard on managing psychosocial risk within an occupational health and safety management system (it sits alongside ISO 45001). It does not create legal obligations in Australia, but it is useful in three ways: it gives multinationals a single framework across jurisdictions, it provides language for governance, leadership and worker participation that boards understand, and it frames psychosocial risk as a management-system matter rather than a wellbeing programme. Organisations certified to ISO 45001 can extend their system to psychosocial risk using 45003 without reinventing their processes.
How often should psychosocial risk be assessed?
The law requires review when controls are found not to be working, before changes that may introduce new risks (restructures, new technology, new rosters), when new information emerges (incidents, claims, complaints) and when a health and safety representative requests it. In practice, mature organisations run a full validated survey every 12 to 24 months, pulse surveys or targeted assessments for high-risk groups in between, and treat every significant organisational change as a trigger for a specific assessment. The important thing is that review is scheduled and evidenced, not reactive.
Key takeaways
- Psychosocial risk management is a legal duty across Australia and New Zealand; the open question is how to do it credibly and repeatably at enterprise scale.
- Use the model code's hazard list as a shared taxonomy, and remember that restructures, new systems and pay disputes are hazards too.
- Triangulate validated surveys (such as People at Work), lagging indicators from incident, claims and HR systems, and genuine consultation, all tagged by hazard, work group, site and date.
- Prioritise by work group, weight interacting hazards, apply the hierarchy of controls and assign owners who can actually change the work.
- Evaluate WHS platforms on psychosocial taxonomy, confidential reporting, survey and HRIS integration and officer due-diligence reporting; treat AI-based detection from communications data with extreme caution.
Join your peers at Clutch Events WHS and HR Technology Summits 2027
Free-to-attend, invite-curated and built by practitioners for practitioners. Upcoming HR-tribe summits:
- Melbourne WHS Transformation and Technology Summit 2027 — 15 July 2027
- Sydney WHS Transformation and Technology Summit 2027 — 12 October 2027
- Melbourne HR Technology Summit 2027 — 16 March 2027
- Sydney HR Technology Summit 2027 — 11 May 2027
See all upcoming events · More practitioner guides at Clutch Events Insights.