7 min
The short answer - An NSW psychosocial risk assessment process should cover five steps: identify psychosocial hazards, consult affected workers, assess the risks, implement controls using the hierarchy of controls and review whether those controls are working.
Under the Work Health and Safety Act 2011 (NSW) and the Work Health and Safety Regulation 2025, a person conducting a business or undertaking (PCBU) must manage psychosocial risks and since 1 July 2026, must follow the approved Code of Practice or achieve an equivalent or higher standard.
A useful process
identifies work related psychosocial hazards,
consults the workers affected,
assesses how often and how long workers are exposed and how serious the harm could be,
selects and implements controls in the order the hierarchy of controls requires, and
checks whether those controls are working.
In my work with NSW organisations, I usually find a psychosocial policy, an employee assistance program (EAP) and wellbeing training already in place, but far fewer can show me a structured psychosocial risk assessment process.
This article is for PCBUs, HR and people leaders and managers preparing or reviewing that process. It sets out what the process should cover and where it commonly falls short.
What is a psychosocial risk assessment?
A psychosocial risk assessment is a structured WHS process for identifying aspects of work that may cause a stress response and lead to psychological or physical harm, assessing how serious those risks are, and deciding which controls will eliminate or minimise them. It looks at how work is designed, managed and carried out, not at the resilience of individual workers.
What do the NSW psychosocial risk duties require?
The starting point is the primary duty of care in section 19 of the Work Health and Safety Act 2011 (NSW) (the WHS Act). PCBUs must ensure, so far as is reasonably practicable, the health and safety of workers and others and under the WHS Act "health" includes psychological health. The Work Health and Safety Regulation 2025 (the WHS Regulation) then sets out how psychosocial risks must be managed.
Section 55C - PCBUs must manage psychosocial risks under the general risk management provisions in Part 3.1 and implement the controls required by section 55D.
Section 55D(1) - Psychosocial risks must be eliminated so far as is reasonably practicable or, if not, minimised so far as is reasonably practicable.
Section 55D(2) - When deciding on controls, PCBUs must have regard to all relevant matters, including the duration, frequency and severity of exposure, how hazards interact and the design and systems of work.
Section 36 - Where elimination is not reasonably practicable, controls must follow the hierarchy of control measures.
Consultation - Sections 47 to 49 of the WHS Act require PCBUs to consult workers who are or are likely to be directly affected.
The Code of Practice: Managing psychosocial hazards at work (May 2021) remains the approved NSW Code. SafeWork NSW advises that section 26A of the WHS Act, which commenced on 1 July 2026, requires PCBUs to comply with approved Codes or manage risks to an equivalent or higher standard. In practice, the Code is now the benchmark a psychosocial risk assessment process will be measured against.
What psychosocial hazards should be considered?
An NSW psychosocial risk assessment should consider every work related psychosocial hazard, not only bullying and harassment. SafeWork NSW describes these as aspects of work that may cause a stress response and lead to harm, arising from the design or management of work, the work environment, plant and workplace interactions or behaviours. The common hazard types grouped below are a starting point, not a complete list.
Work design and management - role overload, low job control, role conflict or lack of role clarity, poor organisational change consultation, poor procedural justice and inadequate reward and recognition.
Support and relationships - poor coworker, supervisor and manager support, and conflict or poor workplace relationships.
Harmful behaviours - workplace violence, bullying and harassment and sexual harassment.
Work environment and exposure - exposure to traumatic events, hazardous physical working environments and remote or isolated work.
Ideally draw on more than one source, conversations with workers and managers, observation of how work is done and records such as complaints, incidents, claims, absenteeism, turnover and survey results.
Ask what about the work could cause harm, not which individuals are struggling and remember that hazards can interact. High workload combined with low control and limited support creates a much higher risk than any one alone.
How should workers be consulted?
Workers who are, or are likely to be, directly affected must be consulted when hazards are identified, when risks are assessed and when controls are chosen. This is a legal requirement under the WHS Act.
Consultation means sharing relevant information, giving workers a reasonable opportunity to raise issues and contribute to decisions, taking their views into account and telling them the outcome. Where health and safety representatives (HSRs) have been elected, they must be involved.
For psychosocial risks, consultation also needs some extra care. When I run consultation sessions, one of the first questions workers ask is what will happen to what they say, so it pays to answer that up front.
Make it safe to speak up - Explain the purpose, how information will be used and the limits of confidentiality.
Use more than one method - Combine group discussions, individual conversations and anonymous surveys.
Reach every affected group - Include remote, part time, shift, contractor and labour hire workers.
Record it - Note who was consulted, what they raised and how their views were considered.
How should psychosocial risk and existing controls be assessed?
Assessing psychosocial risk means looking at four things, exposure, potential harm, how hazards interact and how well existing controls are working. Section 55D (2) of the WHS Regulation gives a useful structure.
Exposure - Who is exposed, how often, for how long and how severely.
Potential harm - What psychological or physical harm could result, including from sustained exposure.
Interaction - Whether hazards combine, such as afterhours demands with reliance on one manager for support.
Existing controls - What is in place, whether it is used in practice and whether it works.
A written policy is not a working control. When I assess a workplace, I compare what the documents say with what actually happens day to day and that gap is often where the real risk sits. Then prioritise the highest risks and the groups most exposed.
What controls should be considered first?
Higher order controls that eliminate the risk or change how work is designed should be considered first. The WHS Regulation 2025 requires PCBUs to eliminate psychosocial risks where reasonably practicable and if not, to minimise them using the hierarchy of controls in section 36.
SafeWork NSW explains that this means starting with measures such as flexible working or redesigning work before relying on training or coping strategies. This is where I see many psychosocial processes fall down, often because a training session is easier to organise than changing how the work is done.
Eliminate - Remove the source, such as unrealistic deadlines.
Substitute, isolate or use engineering controls - Change the work or environment, such as staffing, rosters or secure work areas.
Administrative controls - Procedures, reporting pathways, role clarity, supervision and training.
Personal protective equipment - Rarely relevant and never a primary control.
Training, wellbeing programs and EAPs should support higher order controls, not replace them. Where a higher order control is not reasonably practicable, record why.
How should actions be recorded and reviewed?
Each control needs an owner, a timeframe and evidence of implementation. In my experience, a simple risk register or action plan is usually enough if it records the hazards, who is exposed, the risk rating, the controls chosen and why higher order controls were or were not practicable.
Under the Regulation, controls must be maintained and reviewed, including
When a control does not minimise the risk so far as is reasonably practicable, such as after a complaint or incident.
Before a workplace change likely to create a new or different risk, such as a restructure.
When a new hazard is identified, consultation indicates a review is needed, or an HSR requests one.
Also set a scheduled review date and decide which indicators, such as reporting trends, survey results or leave patterns, will show whether controls are working.
What are the common weaknesses in psychosocial risk processes?
In reviewing psychosocial processes across NSW workplaces, Lane Safety Systems regularly sees the same five gaps in psychosocial risk assessment processes.
Treating it as an HR or wellbeing issue - Psychosocial risk is a WHS risk and needs the same disciplined risk management as physical hazards.
Focusing on individuals rather than work - Assessments that look at individual resilience instead of job demands, systems of work and behaviours miss the hazards the law requires PCBUs to control.
Training and EAP as the main controls - Lower order controls are used without considering, or recording why, higher order controls were not practicable.
Consultation not recorded - Workers were consulted, but there is no evidence of what they said or how it shaped decisions.
No review - The assessment is completed once and filed, with no follow up on whether controls are working.
For a broader look at building a defensible psychosocial system, see Part 4 of our psychosocial series.
When should you seek specialist psychosocial WHS support?
Many organisations can run a sound psychosocial risk process internally. Independent WHS support is worth considering when
SafeWork NSW has issued, or is considering, an improvement notice relating to psychosocial risk.
There have been complaints, claims or incidents involving bullying, harassment, sexual harassment, violence or excessive workload.
Workers may not feel comfortable speaking openly to internal managers or HR.
Internal teams lack the time or WHS expertise to apply the hierarchy of controls and document decisions.
A psychosocial risk assessment is a WHS process. It is not a workplace investigation and does not replace legal advice. If allegations are made against individuals, handle them separately through a workplace investigation and seek legal advice where needed.
How Lane Safety Systems Can Help
Lane Safety Systems supports NSW organisations to
Review existing psychosocial processes against the WHS Regulation 2025 and the approved Code of Practice
Conduct workplace specific psychosocial risk assessments, including confidential worker consultation
Develop psychosocial risk registers and action plans that record hierarchy of control decisions
Brief officers, managers and HR leaders on their psychosocial duties.
Contact us today to discuss whether your psychosocial risk assessment process covers what the NSW laws now require.
By Darren Lane - WHS Compliance Specialist
Managing Director, Lane Safety Systems Pty Ltd | Bachelor of Occupational Health and Safety
Darren is the Managing Director of Lane Safety Systems. He has more than 20 years of experience in NSW WHS compliance, with a strong focus on helping clients manage WHS risk.
As a former WHS Inspector, Darren brings a regulator's perspective to his work and provides clear, practical guidance aligned with WHS legislative requirements and regulatory expectations.