Start with the question in front of you
When an HR manager opens the Safe Work Australia Code of Practice for the first time, the practical question is usually not "Why does psychosocial risk matter?" It is "What do I write down first, and how do I know whether it is enough?" The four-step risk management framework provides the starting point: identify psychosocial hazards, assess the risks, implement controls, and review whether those controls are working.
The organisations we work with at ReFresh often tell us they have been putting this off because they did not know where to start. That does not usually mean they lack concern or commitment. They may have policies, employee assistance arrangements, complaint channels, manager training, incident records and informal ways of responding to workload or conflict. The difficulty is that these pieces are rarely organised into one clear risk management process.
This article explains how to work through the framework from scratch, using the Australian WHS context. It is intended as a practical first pass for HR and workplace safety teams. It is not a substitute for advice about your particular duties as a PCBU, but it can help you turn a broad obligation into a sequence of manageable tasks.
Step 1: Identify the psychosocial hazards
The first step is to determine which psychosocial hazards are present in your workplace. This is broader than asking whether anyone has reported stress. Psychosocial hazards arise from the design or management of work, the work environment, equipment, interactions and behaviours. They can affect psychological health, physical health, or both.
The 13 Safe Work Australia psychosocial hazard categories provide a useful checklist. They include factors such as high or low job demands, low job control, poor support, lack of role clarity, poor organisational justice, conflict or poor interpersonal relationships, bullying, harassment including sexual harassment, exposure to traumatic events or content, remote or isolated work, violence and aggression, and inadequate recognition and reward. The categories should guide your questions, not replace them.
Begin by looking at several sources of information:
- Consult with workers, health and safety representatives, managers and relevant worker representatives.
- Review incident reports, complaints, grievances, workers compensation information and patterns of unplanned leave where appropriate.
- Use surveys, interviews, focus groups or team discussions to understand how work is actually experienced.
- Observe work conditions, including staffing levels, deadlines, customer interactions, after-hours expectations and the way work is allocated.
- Review existing policies and procedures, including whether they are understood and followed in practice.
Consultation is required at each step, not only at the beginning. A survey can show that workload is a concern, but workers may be able to explain which deadlines, systems, approval processes or staffing gaps are creating the problem. Managers may identify a different pressure, such as unclear escalation arrangements. Both perspectives matter.
Consider a growing professional services firm in Brisbane with about 50 employees. The HR manager initially records "stress" as the main hazard. After speaking with project teams, she identifies more specific issues: several employees are working across too many client projects, junior staff are unsure who can approve changes, and client-facing employees are receiving aggressive calls without a consistent escalation process. These are much more useful hazard descriptions because they point towards possible controls.
Do not wait for a serious incident before recording a hazard. A hazard can exist even when no one has made a formal complaint. Equally, a complaint should not automatically be treated as proof that a particular control has failed. The purpose of this step is to gather information carefully, identify patterns and understand the work context.
Step 2: Assess the risks without getting stuck
Once hazards have been identified, assess the risk associated with each one. The assessment should consider the likelihood of harm, the severity of potential harm and the controls already in place. It should also consider how many workers are exposed, how often exposure occurs, how long it lasts and the nature of the possible harm, such as psychological injury, burnout, sleep disruption or physical effects associated with sustained stress.
For example, "high job demands" may affect an entire team during a predictable reporting period, or it may affect a smaller group continuously because of a vacant role. Those situations may require different responses. Similarly, an isolated incident of unreasonable behaviour and repeated customer aggression may both involve interpersonal risk, but their controls may not be the same.
Record the basis for your assessment. A useful entry might state that a team of eight workers is exposed to excessive work demands during monthly reporting, that the exposure has occurred for four consecutive months, that two workers have raised concerns, and that the current control is an informal practice of sharing tasks when someone falls behind. The assessment can then explain the likelihood and potential severity, along with the evidence used.
The most common mistake I see at this stage is over-engineering the assessment and never reaching the controls. Teams can spend weeks debating whether a risk should be rated medium or high, or searching for a perfect scoring matrix. A consistent and reasonable method is useful, but it does not need to create delay. If workers are regularly missing breaks because the workload is unrealistic, you already have enough information to consider practical controls.
Start with the evidence available, record any uncertainty and set a date to revisit the assessment. The framework is designed to support iteration. An initial assessment does not need to be perfect on the first pass, provided the organisation acts on what it knows and improves the record as more information becomes available.
At ReFresh, the risk register is designed to bring these details together. Teams can record the hazard, the affected workers, the assessment, existing controls and the basis for decisions. That record is not just an administrative exercise. PCBUs are required to keep records of risk assessments and the basis for decisions made. Together, those records form an evidence trail showing how the organisation identified and responded to risk.
Step 3: Implement controls that change the work
The third step is to eliminate or minimise the risk by implementing controls. The hierarchy of controls should guide the order of preference. For psychosocial hazards, elimination is the highest priority. This may involve redesigning work so that the hazard is removed or substantially reduced, rather than relying only on workers to cope with it.
Controls might include:
- Redesigning roles, workloads, reporting lines or approval processes.
- Changing work schedules, staffing arrangements or deadlines.
- Clarifying responsibilities, escalation pathways and decision-making authority.
- Providing adequate support, supervision and opportunities for workers to raise concerns.
- Training managers to recognise and respond to psychosocial hazards.
- Establishing procedures for bullying, harassment, violence, aggression and traumatic exposure.
- Using worker support services as one part of a wider response, not as the only control.
Administrative controls such as training, policies and procedures are important, but they sit lower in the hierarchy than changes to the work itself. If a team is overloaded because there are not enough people to complete the work, a resilience seminar does not address the underlying cause. It may provide support, but it should not be presented as the main answer to an unreasonable workload.
Return to the Brisbane professional services example. The firm could introduce a policy reminding employees to manage their workload, but that would leave the core problem untouched. More direct controls might include a capacity review before accepting new client work, a limit on the number of concurrent projects, a named approver for scope changes and a requirement for managers to review workload during regular one-to-one meetings. For aggressive client interactions, the firm might create a clear escalation process, train staff in its use and require managers to take over when a call crosses an agreed threshold.
Controls should be specific enough that someone can understand what will happen, who owns it and when it will be checked. "Improve communication" is not a control plan. "The operations manager will review project allocation every Monday and reassign work where a team member exceeds the agreed capacity threshold" is more actionable, even if the organisation later refines the threshold.
Documentation is part of implementation. A policy, procedure, manager guide or consultation record should match the control being used in practice. ReFresh can support this stage by generating first drafts of controls documentation from the information recorded in the risk register. Those drafts still need human review, consultation and approval. The value is in giving a small HR team a workable starting document, rather than leaving a blank page to be completed after everything else is done.
Step 4: Review whether the controls are working
Controls are not finished simply because they have been approved or communicated. The fourth step is to evaluate whether they are working and whether the risk has changed. Monitoring can include follow-up consultation, surveys, incident and complaint tracking, manager observations, review of relevant work data and periodic reassessment of the risk register.
The WHS Act requires controls to be reviewed when there is a change in work conditions, after an incident, or when the controls may no longer be effective. A review may also be appropriate after a restructure, rapid growth, a new customer group, a change in technology, a shift to remote work or a significant change in staffing.
Ask practical questions:
- Has the underlying hazard been removed or reduced?
- Are workers using the control as intended?
- Do workers believe the control is helping?
- Have incidents, complaints or other warning signs changed?
- Has the work changed in a way that creates a new or different risk?
- Does the control need to be strengthened, replaced or supported by another measure?
Suppose the professional services firm introduces workload reviews, but employees continue to work late because client deadlines are still accepted without capacity checks. The review should identify that the control is not addressing the decision point that creates the excess workload. The firm may need to change its client acceptance process, not simply remind managers to hold better conversations.
Review dates are easy to lose in a spreadsheet, particularly when one person owns the programme alongside ordinary HR responsibilities. ReFresh tracks review dates and flags entries that are overdue. That does not perform the review for you, but it makes the follow-up visible and helps prevent controls from becoming static documents.
Make the framework workable in your organisation
A sensible first implementation does not require every document to be perfect or every hazard to be resolved immediately. It requires a defined process, worker consultation, clear ownership, reasonable records and controls that respond to the risks you have identified.
If you are starting from zero, choose one work area or hazard category for a pilot. Speak with the people doing the work, collect the records already available, document the assessment, agree on a small number of practical controls and set a review date. If you discover existing policies or informal practices, map them into the framework rather than starting again. This is often where organisations find they have more useful material than they expected.
A defensible programme is not one that claims there are no risks. It is one that shows the organisation has identified hazards, consulted workers, assessed risks using the information available, implemented reasonably practicable controls, and reviewed whether those controls remain effective. That is done enough to move forward responsibly, while leaving a clear record of what needs attention next.
