The distinction between "must" and "should" in the Safe Work Australia Code of Practice for Managing Psychosocial Hazards at Work is not editorial decoration. It determines whether a statement records a direct statutory requirement or describes one accepted way of discharging a duty, and organisations that treat the two words as interchangeable create risk in both directions.
Some organisations read every recommendation as legally fixed, producing paperwork that may not address the actual source of harm. Others treat "should" as optional guidance with no legal consequence. Neither approach reflects the legal function of an approved code of practice.
The practical question is not simply whether a business has followed the Code. A PCBU must be able to show that it has identified psychosocial hazards, assessed the associated risks where necessary, implemented controls that are reasonably practicable, consulted workers as required, and reviewed the controls. It may depart from the Code's recommended method, but the alternative must provide an equal or higher level of protection.
What the Code is, and what it is not
The Code of Practice is approved guidance under the Model WHS Act. It is not a regulation, and it does not replace the duties imposed by the Act or applicable WHS Regulations. It gives practical direction on how those duties can be met in the context of psychosocial hazards at work.
Its legal significance is nevertheless substantial. An approved code is admissible in proceedings as evidence of whether a duty under the Act has been complied with. That does not mean a prosecutor or court must treat the Code as an inflexible checklist. It means the Code may be used to test the quality of an organisation's risk-management system, decisions, consultation, controls and records.
The Model WHS framework also permits a PCBU to use another method. The alternative is not automatically acceptable merely because it is different, more convenient or supported by an internal policy. The PCBU needs to be able to demonstrate that the alternative provides an equal or higher level of protection than the approach described in the Code.
There is an additional jurisdictional point. The Model WHS laws are adopted and administered through Commonwealth, state and territory schemes, which can differ in their application and detail. The Code is therefore a central reference point, but it should be read alongside the WHS Act and Regulations applying to the organisation's operations. A compliance process that identifies only the Code and ignores the applicable jurisdictional law is incomplete.
Reading "must" and "should" as legal signals
The Code uses "must" for legal requirements that come directly from the Act or Regulations. A "must" statement is not a recommendation that a PCBU can discard by choosing a different administrative preference. It describes an obligation that already exists in the legislation.
The consultation obligation illustrates the point. PCBUs must consult with workers on psychosocial risk management. The precise form of consultation may depend on the workforce, the nature of the work, existing health and safety representative arrangements, and the matter being considered. But the underlying obligation to consult is not optional.
By contrast, the Code uses "should" for recommended practices that Safe Work Australia considers appropriate for satisfying the duty. "Should" does not mean "irrelevant". It identifies a method that has regulatory credibility. Departing from it is possible, but departure shifts the evidentiary burden onto the organisation to explain why its method was suitable and how it delivered an equal or higher level of protection.
This is best understood as a distinction between obligation and method. The obligation may be fixed, while the method retains some flexibility. For example, the duty to manage risks to health and safety so far as is reasonably practicable is fixed. The form of the risk assessment, the sequence of internal approvals, the software used to record actions, and the design of worker interviews may be adaptable, provided the overall system meets the statutory standard.
"Reasonably practicable" does not mean whatever is easiest for the organisation. It involves consideration of the likelihood of the hazard or risk occurring, the degree of harm that could result, what the person concerned knows or ought reasonably to know, the availability and suitability of ways to eliminate or minimise the risk, and the cost of those measures, including whether the cost is grossly disproportionate to the risk.
A policy that says "managers should monitor workload" may be a sensible starting point. It is not, by itself, evidence that the organisation has discharged a duty. The organisation must be able to show what monitoring means in practice, how information is obtained, what thresholds trigger action, who acts, and whether the response is reviewed.
The Code's four-step structure
The Code is organised around a four-step risk-management process:
- identify psychosocial hazards;
- assess the risks associated with those hazards;
- implement control measures; and
- review the controls and their effectiveness.
The process is sequential for analytical purposes, but not necessarily linear in operation. New information may require a business to return to hazard identification. A control may alter work design and create a different risk. A complaint, incident, organisational restructure, change in technology or pattern of absence may require reassessment.
Hazard identification should not be reduced to asking whether anyone has made a complaint. Psychosocial hazards can arise from the design or management of work, the working environment, equipment, interactions and behaviours. The Code covers all 13 psychosocial hazard categories, including high job demands, low job control, poor support, lack of role clarity, poor organisational justice, low recognition and reward, inadequate organisational change management, insufficient reward and recognition, traumatic events, violence and aggression, bullying, harassment including sexual harassment, and remote or isolated work.
Some categories overlap in practice. A restructure may produce role ambiguity, increased demands and low control at the same time. Customer-facing work may expose workers to violence and aggression, while remote work may increase isolation and reduce access to support. Categorisation is useful, but it should not encourage an organisation to treat each hazard as a separate silo when the causes and controls are interconnected.
Risk assessment requires more than assigning a numerical score. The organisation needs to understand how the work is actually performed, who may be affected, how often exposure occurs, and what consequences may follow. Worker consultation is central because psychosocial risks are often visible in workload patterns, supervisory behaviour, staffing decisions and informal practices that do not appear in an incident register.
Controls should then be selected using the hierarchy of controls. Elimination is the preferred response, followed by substitution, isolation, engineering controls, administrative controls and personal protective equipment. The hierarchy applies to psychosocial hazards as it does to physical hazards, although its application looks different.
For a psychosocial hazard, elimination might involve removing an unnecessary source of excessive workload or discontinuing a work practice that exposes staff to abusive interactions. Engineering controls may include changes to systems, staffing technology or the physical arrangement of a work area. Administrative controls can include procedures, training, supervision, reporting pathways and roster changes. Personal protective equipment is rarely the relevant control for a psychosocial hazard and should not be used as a substitute for addressing work design.
Finally, review must test whether the control works, not merely whether it was implemented. A completed training module may demonstrate that training occurred. It does not demonstrate that bullying decreased, workload became manageable or workers could safely report concerns.
Where PCBUs have discretion
The Code does not prescribe one universal psychosocial risk assessment template, one survey instrument or one governance structure. A small business and a large, geographically dispersed organisation may need different systems. The relevant question is whether the system is proportionate to the nature of the work and capable of identifying and controlling the risks.
PCBUs may have discretion over:
- the combination of consultation methods, such as health and safety representatives, team discussions, confidential surveys, interviews and incident data;
- the frequency and trigger points for assessments;
- the allocation of responsibilities between operational leaders, HR, WHS personnel and senior management;
- the form in which hazards, controls and review findings are recorded; and
- the particular control measures selected, where they address the risk and provide the required level of protection.
That discretion is bounded by evidence. If an organisation chooses a shorter assessment process, it should be able to explain why the process still captures the relevant hazards. If it relies on anonymous reporting, it should consider whether anonymity prevents adequate investigation or remediation. If it chooses training as the primary control, it should explain why the underlying work design, management practice or exposure cannot also be changed.
Consider a synthetic example. A 24-hour customer support business records repeated aggression towards staff during overnight shifts. Management introduces a resilience workshop and places a poster near the reporting channel. It also asks workers to report future incidents. The business has taken some action, but it may not have addressed the risk so far as is reasonably practicable. The hazard is not simply a lack of resilience. It may include customer access without effective screening, inadequate staffing, insufficient escalation support, poor isolation controls and a system that makes it difficult to end abusive interactions.
A stronger response could include reviewing the operating model, introducing call controls, ensuring workers can obtain immediate supervisory support, changing staffing arrangements, improving incident capture, consulting affected workers and reviewing whether aggression has reduced. The organisation retains discretion over the precise design of those controls. It does not have discretion to treat a low-level awareness initiative as sufficient without analysing the source and persistence of the risk.
Where the requirements are fixed
The Code's flexibility should not obscure several fixed points. A PCBU cannot contract out of its WHS duties. It cannot rely on a worker's consent to an unsafe system of work. It cannot avoid consultation by labelling a decision as an HR matter when the decision affects psychosocial health and safety. Nor can it treat a lack of complaints as proof that no hazard exists.
The duty to manage risks is also ongoing. Psychosocial hazards are not controlled permanently by issuing a policy. Organisational change, new performance systems, changes in staffing, hybrid work arrangements, customer conduct, leadership behaviour and external events can alter the risk profile. The Code's review step reflects that continuing character.
Record-keeping is not merely an administrative concern. Records help demonstrate what the organisation knew, what it considered, who was consulted, what options were available, why a control was selected and whether it worked. They also expose gaps. A risk register that records "stress" without describing the work conditions, affected groups, controls and review evidence is unlikely to provide a reliable account of compliance.
The same applies to accountability. Assigning an action to "management" is weaker than identifying a responsible role, a due date, the required evidence and the review point. The legal duty may rest on the PCBU, but effective implementation requires decisions to be assigned within the organisation and escalated when controls are not delivered.
The practical risk in discretion
The Code has critics who regard its use of "should" as too open-ended for a subject involving serious health consequences. That criticism has force. Discretion can permit proportionate responses, but it can also allow an organisation to describe a weak process as an alternative method without testing whether it provides equal or higher protection.
The answer is not to convert every recommendation into a rigid checklist. A checklist can produce formal compliance while leaving the work unchanged. The better response is disciplined reasoning: identify the legal duty, distinguish it from the recommended method, document the organisation's chosen approach, record the evidence supporting it, and review the outcome.
ReFresh supports that process by mapping regulatory requirements from the Code and applicable state-specific WHS legislation to actionable compliance tasks. It can draft policies referenced to relevant Code of Practice material and help track regulatory changes. It does not determine whether a particular control is reasonably practicable, replace worker consultation, investigate an allegation, provide legal advice on a specific enforcement risk, or assume the PCBU's statutory responsibility.
For HR and safety teams, the most defensible implementation is therefore not "follow every word" or "use our own process". It is a documented system that distinguishes mandatory duties from recommended methods, explains any departure, tests controls against the actual work, and preserves evidence of consultation and review.
The Code's legal weight lies precisely in that combination of guidance and accountability. It gives PCBUs room to design a system suited to their operations, but that room is not a safe harbour. Where an organisation departs from the Code, the quality of its reasoning and evidence becomes part of the compliance question.
