How to conduct a psychosocial risk assessment: a step by step guide for Australian employers

Every Australian employer now has a legal duty to manage psychosocial risks the same way they manage physical ones. The starting point is a psychosocial risk assessment. This guide walks through the four step process set out in the Safe Work Australia model Code of Practice, what to look at in each step, and how to turn the results into controls that actually reduce harm.

What is a psychosocial risk assessment?

A psychosocial risk assessment is a structured process for finding the aspects of work that could harm your people's mental health, judging how serious those risks are, and deciding what to do about them. It covers the design of work, the systems that manage it, and the way people interact, rather than any one employee's personal circumstances.

The Safe Work Australia model Code of Practice, published in July 2022, names 14 common psychosocial hazards, listed in full below. Most workplaces will have several of them present at once. The assessment is how you work out which ones matter most and where to act first.

Why it is now a legal requirement

Under the model WHS laws, a person conducting a business or undertaking must eliminate psychosocial risks so far as is reasonably practicable, and where that is not possible, minimise them. Regulators have been steadily converting that general duty into specific, enforceable expectations.

Queensland's Managing the risk of psychosocial hazards at work Code of Practice has been mandatory since 1 April 2023. New South Wales has had a code in place since 2021, and its Work Health and Safety Regulation 2025 now explicitly requires the hierarchy of controls to be applied to psychosocial risks. Victoria's Occupational Health and Safety (Psychological Health) Regulations came into force on 1 December 2025 and require employers to identify psychosocial hazards, eliminate or reduce the risks, and review their controls.

The claims data explains the urgency. Safe Work Australia's Key Work Health and Safety Statistics 2025 report that mental health conditions made up 12 per cent of all serious workers' compensation claims in 2023 to 2024, a 14.7 per cent rise on the previous year and a 161 per cent rise over a decade. Median time lost for those claims was almost five times longer than for other injuries.

Step 1: identify the hazards

You cannot assess what you have not found, so this step deserves the most time. Consultation with workers is not optional under WHS law, and it is also the most reliable source of information you have.

Useful methods include:

• A validated survey that asks about each hazard category rather than general satisfaction. Talked's free psychosocial risk assessment tool gives you a structured starting point without building one from scratch.

• Focus groups or team discussions, ideally run by someone outside the reporting line.

• Direct observation of how work is actually done, including rosters, handovers and peak periods.

• Existing data: absenteeism, turnover, exit interviews, incident reports, complaints, EAP usage themes and workers' compensation claims.

Look for patterns by team, site, role and shift rather than only at whole of business averages. A hazard concentrated in one call centre team can disappear in a company wide number.

Step 2: assess the risks

Once you have a list of hazards, work out which ones create the greatest risk. For each hazard ask four questions: how often are workers exposed, for how long, how severe could the harm be, and do workers themselves report feeling at risk?

Remember that hazards interact. High job demands on their own are manageable for many people. High demands combined with low control, poor support and unclear roles are a different matter, and the combination is what usually drives claims. Note the root cause behind each hazard as well, because that is what your control needs to target.

A simple matrix that rates likelihood and consequence for each hazard is enough for most organisations. Document the reasoning, not just the score, so the assessment can be reviewed later.

Step 3: control the risks

Apply the hierarchy of controls in order. Regulators in NSW, Queensland and Victoria all now expect to see this.

Training and counselling sit at the bottom of the hierarchy. They matter, but on their own they will not satisfy the duty. An EAP with psychosocial support built in works best when it sits alongside changes to the work itself.

Assign an owner and a date to every control, and tell workers what you decided and why.

Step 4: review and keep reviewing

Controls drift. Review them on a set schedule, at least annually, and whenever a trigger appears: rising sickness absence or turnover, new complaints, a change in ownership, restructure or systems, a request from a worker or health and safety representative, or evidence that a control is not working.

Re-run the survey and compare results to your baseline. Aggregated, de-identified EAP reporting is a useful signal here, because it shows whether the themes people seek help for are shifting after your controls go in.

The 14 psychosocial hazards to screen for

Most assessments stop at bullying and harassment. The model Code names 14 hazards, and a defensible assessment covers all of them:

• High or low job demands

• Low job control

• Poor support from supervisors or colleagues

• Lack of role clarity

• Poor organisational change management

• Inadequate reward and recognition

• Poor organisational justice

• Traumatic events or material

• Remote or isolated work

• Poor physical environment

• Violence and aggression

• Bullying

• Harassment, including sexual harassment

• Conflict or poor workplace relationships and interactions

Working through that list one hazard at a time, for every team, is where most organisations lose momentum. Talked's free psychosocial risk assessment takes you through all 14 in a structured way and gives you a rated picture of where your risks sit, so step 1 and step 2 are done before you open a spreadsheet.

A practical checklist

• Consult workers using at least two methods

• Screen against all 14 hazards above, not just bullying and harassment

• Rate likelihood and consequence and record the reasoning

• Apply the hierarchy of controls and name an owner for each action

• Communicate the outcome to workers

• Set a review date and the triggers that bring it forward

• Keep the documentation: it is your evidence of compliance

Smaller organisations sometimes assume this only applies to large employers. It does not. Our guide on whether small businesses need a psychosocial risk management plan covers how to scale the process down without skipping steps.

Where Talked fits

Talked helps Australian employers at both ends of this process. The free psychosocial risk assessment gives you a structured, anonymous way to identify and rate hazards across your teams. Once controls are in place, our EAP provides confidential support from AHPRA registered psychologists and counsellors, plus critical incident response and de-identified reporting that feeds directly into your review cycle. If you would like to talk through how it would work for a business your size, you can make an enquiry. For a broader look at the concept, see our overview of workplace psychosocial safety.

References

• Safe Work Australia, Model Code of Practice: Managing psychosocial hazards at work (July 2022)

• Safe Work Australia, Key Work Health and Safety Statistics Australia 2025

• SafeWork SA, Four steps to managing psychosocial hazards and risks

• WorkSafe Queensland, Managing the risk of psychosocial hazards at work Code of Practice 2022

• SafeWork NSW, Code of Practice: Managing psychosocial hazards at work

• WorkSafe Victoria, New regulations make psychological health a priority (December 2025)