"We have an employee assistance programme, a bullying policy and annual mental health training, so our psychosocial duty is covered." I hear versions of this from HR teams regularly. The problem is that these measures may support a safe workplace, but they do not, by themselves, discharge a PCBU's primary duty under Australian WHS law.
A PCBU, or person conducting a business or undertaking, must manage risks to workers' psychological health and safety as far as is reasonably practicable. That is a duty to identify and control risks arising from the way work is designed and carried out, not simply a duty to offer support after something goes wrong.
What is a PCBU responsible for?
Section 19 of the Model WHS Act 2011 places the primary duty of care on the PCBU. The PCBU must ensure, so far as is reasonably practicable, the health and safety of:
- workers engaged, or caused to be engaged, by the PCBU; and
- workers whose activities are influenced or directed by the PCBU.
In practice, that can include employees, contractors, labour-hire workers, apprentices and other people performing work in connection with the organisation. The duty is not limited to the people on the payroll or to what happens inside the organisation's own premises.
Psychological health is part of health and safety. The Model WHS Regulations 2022, Part 3.5, contains specific requirements for managing psychosocial hazards. These hazards can arise from excessive workloads, low job control, poor support, bullying, harassment, violence, traumatic events, remote or isolated work, conflict, or poorly managed organisational change.
The exact legal framework varies between jurisdictions. The model WHS framework has been adopted across most Australian states and territories, while Victoria operates under a different occupational health and safety legislative framework for some purposes. PCBUs should check the requirements and guidance of the regulator in the relevant jurisdiction, such as SafeWork NSW, WorkSafe Victoria or WorkSafe Queensland.
What does "reasonably practicable" mean?
"Reasonably practicable" does not mean doing everything imaginable, regardless of cost or operational impact. It also does not mean choosing the cheapest response or waiting until harm is proven.
Section 18 of the Model WHS Act sets out the matters to consider. They include:
- the likelihood of the hazard or risk occurring;
- the degree of harm that could result;
- what the PCBU knows, or ought reasonably to know, about the hazard or risk and ways of eliminating or reducing it;
- the availability and suitability of ways to eliminate or minimise the risk; and
- the cost of those ways, including whether the cost is grossly disproportionate to the risk.
Psychosocial risks can make this assessment feel less concrete than a physical hazard assessment. A damaged guard on a machine may be easy to observe and measure. A pattern of unreasonable deadlines, exclusion from decision-making or aggressive supervision may develop gradually, with different effects on different workers.
That does not make the risk too subjective to manage. It means the organisation needs a sensible evidence base. Relevant information may include worker consultation, complaints, exit interviews, absenteeism, turnover, overtime, incident reports, workload data and findings from regular risk assessments. No single metric proves that a psychosocial risk exists, and the absence of a complaint does not prove that the workplace is safe.
The assessment should also consider the seriousness of the possible harm. A risk that is less likely but could lead to severe psychological injury may require action. Frequency, duration, intensity, the number of workers exposed and whether a hazard is increasing are all relevant practical considerations.
Applying the hierarchy of controls to psychosocial hazards
The hierarchy of controls remains the starting point. The controls should be considered in order, rather than jumping straight to policies, training or individual resilience initiatives.
- Elimination: remove the hazard where possible. This might mean stopping a work practice that creates sustained excessive workload, removing an unsafe customer-contact requirement or ending a process that exposes workers to repeated abusive conduct.
- Substitution: replace a harmful work method with a less harmful one. For example, an organisation might replace unpredictable last-minute rostering with a more stable scheduling approach.
- Isolation: separate people from the hazard. In a psychosocial context, this could include separating a worker from a person who is engaging in threatening conduct while the matter is assessed.
- Engineering controls: change the work environment or systems so exposure is reduced. Examples may include call-screening tools, workload management systems, or communication settings that prevent contact outside defined hours.
- Administrative controls: use procedures, role clarity, training, supervision, reporting pathways and review processes. These are often necessary, but they depend on people following the system and therefore should not be the only response where the hazard can be addressed higher in the hierarchy.
- Personal protective equipment: PPE has limited application to most psychosocial hazards. It may have a role in a broader physical safety response, but it does not control excessive demands, bullying or poor organisational support.
For psychosocial hazards, "redesign the work" is often the most useful practical translation of the hierarchy. That may involve changing staffing levels, decision-making authority, performance measures, reporting lines, customer escalation processes or the timing of work.
A mid-size organisation scenario
Consider a 180-person organisation whose customer operations team has missed several quarterly targets. The business introduces a new performance dashboard, reduces team-leader coverage and expects staff to respond to customer escalations after hours. Within three months, overtime rises, workers report hostile exchanges in team chats and several people take stress-related leave.
The organisation's existing controls include an employee assistance programme, a respectful workplace policy and a module on personal resilience. Those controls may be useful, but they do not address the underlying work design.
A reasonable response would begin with consultation and a documented assessment of the hazards. The PCBU might identify excessive workload, low support, poor role clarity and unreasonable after-hours expectations. Higher-order controls could include reviewing staffing and targets, setting clear escalation limits, restoring supervision and redesigning the dashboard so it does not reward unsafe work practices.
Administrative controls would still matter. The organisation could establish a reporting process, train managers to respond to concerns, monitor overtime and review whether the changes are working. The point is not to produce a larger policy library. It is to connect the controls to the hazards and test whether exposure is actually decreasing.
Who else has WHS responsibilities?
The PCBU carries the primary duty, but it is not the only duty that matters.
Under s27 of the Model WHS Act, officers, including directors and senior managers, have a due diligence duty. They must take reasonable steps to understand the nature of the business and its hazards, ensure appropriate resources and processes are available, verify that those processes are used, and keep informed about WHS matters. For psychosocial risks, that means treating reports, trend data and control reviews as governance information, not just HR administration.
Workers also have duties under s28. They must take reasonable care for their own health and safety, avoid adversely affecting others and comply, so far as they are reasonably able, with reasonable instructions and notified policies or procedures. A worker's duty does not reduce the PCBU's obligation to provide a safe system of work, and it should not be used to shift responsibility for organisational hazards onto individuals.
Multiple duty holders must consult, cooperate and coordinate where their duties overlap. This is particularly important where a host organisation, labour-hire provider, contractor or other business influences the same work.
What remains difficult in practice?
The genuinely difficult question is often not whether a hazard exists, but how far the organisation must go in response to uncertain or competing evidence. Workers may describe the same workload differently. A business may need to meet a genuine operational deadline. A manager may deny that conduct was unreasonable. A control that helps one group may create pressure elsewhere.
There is no safe harbour that says a complaint threshold must be reached before action is required. At the same time, not every disagreement, busy period or management decision is automatically a psychosocial risk requiring the same control. The assessment needs context, evidence and proportionate judgement.
This article explains general duties under the model framework. It is not legal advice, and it cannot determine whether a particular control is reasonably practicable for a particular organisation. For a specific matter, obtain advice that considers the applicable state or territory legislation and the facts.
For practitioners, the most reliable test is whether the organisation can explain the chain from hazard, to risk, to control, to review. If the records only show that training was completed, the organisation may be documenting activity rather than demonstrating risk management. That distinction is where many psychosocial compliance programmes still become confused.
