The field most often missing from a psychosocial hazard register is not the hazard description, but the evidence showing whether a control was implemented and reviewed.
A register that only lists risks is a static document. A useful register is a working system. It connects each hazard to its assessment, controls, accountable person, review date and supporting records. That structure helps a PCBU demonstrate what it identified, what it did and how it knows the controls remain suitable.
This guide sets out a practical approach for building that system under Australian WHS requirements. It uses the hierarchy of controls throughout, because controls should address the source of the risk wherever reasonably practicable, rather than relying only on reminders, training or individual coping strategies.
1. Define the register's purpose and scope
Start by deciding what the register needs to show. Under Part 3.5 of the Model WHS Regulations 2022, a PCBU must identify, assess and manage psychosocial hazards and keep records of risk management activities. The Safe Work Australia Code of Practice: Managing Psychosocial Hazards at Work provides practical guidance for doing this.
The register should allow someone who was not involved in the original assessment to answer five questions:
- What psychosocial hazard exists in this workplace?
- Who may be exposed, and in what work or location?
- What controls are currently in place?
- What further action is required, and who owns it?
- When will the risk and controls be reviewed?
Set the scope before collecting entries. You might use one organisation-wide register with fields for business unit, site, work group and employment type. Alternatively, you might maintain a central register supported by team-level assessments. The important point is that the structure should make coverage visible. A reviewer should be able to see whether risks affecting managers, contractors, remote workers, customer-facing staff and other groups have been considered.
The register is not a substitute for consultation, incident reporting, worker interviews or a broader WHS management system. It is the record that brings those activities together. This guide is general information, not legal advice, and the Model WHS laws must be considered alongside the WHS law applying in your state or territory.
2. Identify hazards using a consistent taxonomy
Use the 13 psychosocial hazard categories as a coverage check. A category is not itself a complete register entry. You still need to describe how the hazard presents in your organisation.
- High job demands
- Low job control
- Poor support
- Lack of role clarity
- Poor organisational justice
- Inadequate reward and recognition
- Poor organisational change management
- Inadequate training and information
- Remote or isolated work
- Violence and aggression
- Bullying
- Harassment, including sexual harassment
- Exposure to traumatic events or content
Do not treat the list as a box-ticking exercise. A single category can contain several different hazards. For example, "high job demands" might involve sustained excessive workloads in one team, unpredictable peaks in another and conflicting deadlines for a third.
Write each entry in workplace-specific language. "Work pressure" is difficult to assess because it does not identify the work creating the exposure. "Payroll team regularly receives urgent processing requests from three business units during the final two days of each month, requiring staff to work extended hours and skip planned breaks" is more useful. It identifies the work, affected group, pattern and possible source of harm.
Record the sources used to identify the hazard. These may include worker consultation, surveys, complaints, incident reports, absenteeism trends, turnover data, task observations, change planning or feedback from health and safety representatives. The register does not need to reproduce sensitive personal information. It should record enough context to show how the hazard was identified and allow supporting evidence to be located securely.
3. Build the required fields into every entry
Use the same minimum data structure for every hazard. Consistency makes the register easier to search, review and audit.
- Hazard category: Select the relevant category or categories.
- Hazard description: Describe how the hazard appears in this workplace, including affected work groups, tasks, locations or work arrangements.
- Potential harm and exposure: Record how the hazard may affect workers and how often or under what conditions exposure occurs.
- Initial risk rating: Assess likelihood and consequence using the organisation's documented risk matrix.
- Current controls: Record controls that are actually in place, not actions that are merely proposed.
- Residual risk rating: Assess the remaining risk after current controls have been considered.
- Further control actions: Record additional measures, owners, due dates and status.
- Accountable person: Name the role or person responsible for ensuring the control is implemented and maintained.
- Consultation and evidence: Link to consultation records, procedures, training records, meeting notes or other implementation evidence.
- Next review date: Set a date and state the event that may trigger an earlier review.
- Review history: Keep previous ratings, decisions, changes and approval details rather than overwriting the original entry.
Be precise about the accountable person. "Management" is too broad to create clear ownership. A role such as "Customer Operations Manager" or "Head of People and Culture" gives the organisation a practical point of responsibility. That person does not need to complete every task personally, but they should be able to confirm progress and escalate obstacles.
Separate a control from an action. A control might be a rostering rule that limits consecutive late shifts and is currently applied. An action might be to review the rule with affected workers by a specified date. Combining both in one sentence makes it hard to tell what protection exists now.
4. Apply the hierarchy of controls to psychosocial risks
Assess controls from the top of the hierarchy down. The aim is to change the work or the conditions creating the risk before relying on administrative measures.
- Elimination: Remove the source of the risk where reasonably practicable. For example, stop a work practice that inherently creates excessive and sustained demands.
- Substitution: Replace the risky arrangement with a safer one. This could involve redesigning a role, changing a performance process or replacing an unpredictable workflow with a planned one.
- Isolation or engineering controls: Separate workers from the source of risk through work design, staffing structures, systems or physical arrangements. For psychosocial hazards, examples may include screening customer contact, adding an escalation channel or separating incompatible workflow demands.
- Administrative controls: Use procedures, training, supervision, consultation, reporting pathways, rostering rules and review processes. These can be important, but they depend on consistent implementation.
- Personal protective equipment: PPE has limited application to many psychosocial hazards. Where it is relevant to the work, it should not be treated as a replacement for higher-order controls.
For every control, record which level it represents and why it is suitable. A register that lists "training" as the only response to bullying, excessive workload or poor role clarity may show activity without addressing the source of risk.
Consider both current and proposed controls. For example, an organisation may currently provide manager training and a confidential reporting process, while planning to redesign workload allocation and clarify decision rights. The register should show that distinction and assess residual risk based only on controls that are operating.
5. Set ratings, owners and review triggers
Use a documented likelihood and consequence matrix, applied consistently across entries. The matrix should explain what each rating means. For psychosocial hazards, consider the duration, frequency and number of people exposed, as well as the potential severity of harm. Avoid assigning a low rating simply because no incident has been reported. Lack of reports may indicate that workers do not feel safe raising concerns.
Set the residual risk rating after current controls are considered. If further actions are required, the entry should state whether the residual risk is acceptable under the organisation's criteria while those actions remain open. High or changing risks may require interim measures, senior escalation and more frequent review.
Choose review dates based on the risk and the work, not a convenient annual calendar alone. A scheduled review may be appropriate for a stable work group, while a higher-risk arrangement may need a shorter interval. Add event-based triggers such as:
- significant organisational or system change
- new work, equipment, technology or customer requirements
- a report of bullying, harassment, violence or traumatic exposure
- a material change in workload, staffing or working hours
- an incident, complaint, consultation result or failed control
- evidence that workers are not using or receiving the intended control
Make the review process produce a record. A changed review date without an explanation is not a useful history. Capture who reviewed the entry, what evidence they considered, whether workers were consulted, what changed and whether the rating or controls were updated.
6. Test whether the register works in practice
Consider a synthetic example. A software organisation has a customer support team handling urgent requests across Australian and overseas time zones. The initial entry identifies high job demands and low job control. The description records frequent queue spikes, unclear priority decisions and regular after-hours escalation. The initial rating is based on the likelihood and consequence matrix.
Current controls include an escalation procedure, scheduled breaks and a manager check-in. These are mainly administrative controls. The register also records proposed higher-order measures: redesigning the service tiers to remove unnecessary urgent work, adjusting staffing during predictable peaks and giving support staff authority to defer non-critical requests. Each action has an accountable role, due date and status.
At review, the organisation checks whether the new service tiers were implemented, whether staffing changed, whether workers were consulted and whether queue and overtime patterns support the claimed improvement. If the procedure exists but staff cannot use it during peak periods, the control should not be recorded as fully effective.
This is the distinction between a register that looks complete and one that supports WHS decision-making. Investigators may examine whether the register covers identified hazards, whether it has been updated and whether controls were actually implemented rather than merely listed. Inadequate documentation can contribute to an improvement notice under the Model WHS Act.
Common failure modes include copying generic hazards between teams, using one accountable person for every entry, overwriting earlier assessments, setting the next review date without a trigger, and closing actions when a policy is published rather than when the control is operating. Another frequent problem is treating worker consultation as a one-time input. Conditions change, and workers often have the clearest view of whether a control works during ordinary operations.
A practical register should therefore have workflow around the data: reminders before review dates, change records, approval steps, evidence links and clear status values for proposed, in progress, implemented and verified controls. ReFresh is designed around this type of structured record, with fields for hazards, control measures, accountable persons and review dates, aligned to the hierarchy-of-controls approach.
Begin with a small set of work groups, test whether another person can understand each entry, and correct ambiguous fields before expanding the register. Then schedule routine reviews, event-based reassessments and periodic checks that controls exist in practice. That is how the register becomes part of the WHS system rather than another document in a folder.
