Psychosocial Risk Assessment

A psychosocial risk assessment identifies the aspects of work that can cause psychological harm, decides how serious the risk is, and sets out what the business will do about it. It uses the same four steps as a physical risk assessment – identify, assess, control, review – but the hazards are in how work is designed, managed and experienced rather than in a machine or a substance.

The duty is not new. A PCBU has always had to ensure health, and health includes psychological health. What has changed is that the WHS Regulations in most Australian jurisdictions now deal with psychosocial risks expressly, and Safe Work Australia has published the model Code of Practice Managing psychosocial hazards at work. Regulators are inspecting against it.

The model Code lists the common psychosocial hazards. A sound assessment considers each of them:

• High or low job demands
• Low job control
• Poor support from supervisors or co-workers
• Lack of role clarity
• Poor organisational change management
• Inadequate reward and recognition
• Poor organisational justice
• Traumatic events or material
• Remote or isolated work
• A poor physical environment
• Violence and aggression
• Bullying
• Harassment, including sexual and gender-based harassment
• Conflict or poor workplace relationships and interactions

State Codes word the list a little differently – the New South Wales Code, for example, separates role overload from role underload and supervisor support from co-worker support – so check the Code that applies where you operate.

Hazards interact. High demands with low control and poor support is a much greater risk than any one of them alone, so they should be assessed together and not as a list of separate items.

Psychosocial hazards do not show up on a walk-through, so the evidence has to come from people and from records.

• Consult workers. This is a legal duty as well as the best source of information. Use surveys, focus groups, team meetings and one-to-one conversations. Anonymous channels matter, because the hazard is sometimes the person's own manager.
• Look at your data. Absenteeism, turnover, overtime, unplanned leave, workers' compensation claims, complaints, grievances, incident reports and exit interviews.
• Observe the work. Workloads, deadlines, staffing levels, how change is communicated, how customers and clients behave towards staff.
• Consider who is more exposed. New and young workers, those working alone or remotely, those exposed to distressing material, and those dealing with the public.

For each hazard consider three things: duration (how long workers are exposed), frequency (how often) and severity (how intense the exposure is). A short period of high demand before a deadline is a different risk from sustained overload with no end in sight.

A risk matrix can be used, but take care with it. Psychological injury is commonly a serious, long-term outcome with long periods off work, so the consequence is rarely "minor". Rate the inherent risk first, then the residual risk with the controls you genuinely have in place.

A customer service team of twelve, handling complaints by phone.

The employee assistance program and the call script are real, but they are lower-order controls and they barely move the rating. The actions that do are about work design: staffing the roster to the call volume, authority for staff to resolve complaints within set limits, a supported process for terminating and flagging abusive callers, and a team leader who is present.

The hierarchy of control applies. The Regulations require you to eliminate the risk so far as is reasonably practicable, and otherwise minimise it – and you must have regard to the design of work, the systems of work, the workplace itself, and workplace interactions.

That means the first controls are about work design: realistic workloads and staffing, clear roles, a say in how work is done, supportive and competent supervision, fair and transparent processes, good management of change, and physical and procedural protection from violence and aggression.

Resilience training, wellbeing apps and employee assistance programs help individuals cope. They are lower-order controls, and relying on them alone does not meet the duty.

• Treating it as a wellbeing program. Fruit bowls and resilience workshops do not address workload, role conflict or an aggressive customer base.
• Assessing individuals instead of work. The question is what in the work could cause harm, not who is "coping".
• Surveying and stopping. A survey with no visible action afterwards makes things worse.
• Leaving it to HR. Psychosocial risk is a work health and safety duty. Officers have due diligence obligations for it, the same as for physical risks.
• Forgetting consultation. Workers and Health and Safety Representatives must be consulted when hazards are identified and when controls are chosen.

Record the hazards identified, how you identified them, who was consulted, the risk ratings, the controls chosen and why, who is responsible for each action and by when. Review the assessment when a new hazard is identified, after a complaint or incident, when work changes – a restructure, new systems, new rosters – when a Health and Safety Representative requests it, and at a regular interval.