Psychosocial Hazards at Work: What Australian Law Requires, and Where ISO 45001 Stops Short

Every Australian work health and safety jurisdiction now requires you to manage psychosocial hazards. Not to promote wellbeing, not to offer counselling, but to identify hazards, assess risk and implement control measures, in the same way you would for a fall from height or a moving machine part. NSW moved first in October 2022 and Victoria last in December 2025.

The current edition of ISO 45001, the international standard for safety management systems, does not address psychosocial risk explicitly. The next edition will. So it is entirely possible today to hold a valid ISO 45001 certificate and still fall short of your legal obligations, which is an uncomfortable position and a common one.

This article covers what the law actually asks for, where the jurisdictions differ in ways that matter, and what an auditor looks for when they open your risk register.

What a psychosocial hazard is

The statutory definition is narrower and more useful than the everyday use of the term. Under the NSW Work Health and Safety Regulation 2025, a psychosocial hazard is a hazard that arises from, or relates to, the design or management of work, a work environment, plant at a workplace, or workplace interactions or behaviours, and may cause psychological harm, whether or not it may also cause physical harm.

Read that again with attention to where the hazard sits. Three of the four limbs are about the organisation, not the individual. The hazard is in how work is designed, how it is managed, the environment it happens in, and how people are required to interact. A psychosocial hazard is a property of the work, not a property of the worker. Almost every mistake organisations make in this area follows from getting that the wrong way round.

Note also that the harm limb includes physical harm. Chronic exposure to unreasonable demands does not only produce anxiety and sleep disorders. It produces musculoskeletal injury and fatigue-related incidents, which is why psychosocial hazards belong in the same risk register as everything else rather than in a separate wellbeing document.

The fourteen hazards, and why your state’s list is longer

Safe Work Australia’s model code lists fourteen common psychosocial hazards: job demands, low job control, poor support, lack of role clarity, poor organisational change management, inadequate reward and recognition, poor organisational justice, traumatic events or material, remote or isolated work, poor physical environment, violence and aggression, bullying, harassment including sexual harassment, and conflict or poor workplace relationships and interactions.

The code is careful to say the list is not exhaustive, and adds something worth quoting because it defuses a lot of unproductive argument:

How they are categorised is less important than ensuring you and your workers have the same understanding of what is happening and how it may be causing harm.

Your own jurisdiction’s list is probably longer than fourteen. WA and Victoria both list sixteen, WA adding poor leadership practices, inadequate policies, fatigue and family and domestic violence, Victoria adding gendered violence and splitting high from low job demands. NSW lists sixteen, splitting role overload from role underload and supervisor from co-worker support.

The most interesting divergence is in the two newest codes. The Commonwealth code from November 2024 and South Australia’s from February 2026 both add the same three hazards to the model taxonomy: fatigue, job insecurity and intrusive surveillance. Two jurisdictions, fifteen months apart, independently reaching for the same additions is a reasonable signal of where this is heading. If you are building a hazard list now, those three are worth including whatever your jurisdiction’s code says, because they are plainly capable of causing psychological harm and the definition does not depend on being named in a code.

When it became law where you are

The duty came in through regulations inserted into each jurisdiction’s WHS regulations, and the dates were staggered over more than three years.

Two traps in that table. Western Australia’s duty did not arrive with its new WHS regulations on 31 March 2022, as is often assumed. It was added later that year, on 24 December 2022. And Victoria’s duty is not part of the harmonised scheme at all: it sits in standalone Occupational Health and Safety (Psychological Health) Regulations 2025 under the OHS Act 2004, and it falls on employers rather than on persons conducting a business or undertaking.

One more thing about Victoria, because it is widely misremembered. The 2022 exposure draft included a mandatory written prevention plan and an obligation to report to WorkSafe. Both were removed from the final regulations, not deferred. WorkSafe encourages the plan template but does not require it. If somebody tells you a Victorian prevention plan is coming, it is not.

The codes are not one code

There is a widely held assumption that Safe Work Australia wrote a model code and the states adopted it. The reality is messier, and it matters if you operate across borders and are trying to work to one system.

New South Wales published its code in May 2021, fourteen months before the model code existed, so it cannot be an adoption of it and does not claim to be. Western Australia’s code is adapted from NSW’s, not from the model. Queensland’s is independently drafted. The ACT’s is expressly based on the model code and Queensland’s material. The Commonwealth’s and South Australia’s are model-derived but both add hazards. Only the Northern Territory’s is a straightforward adoption of the model.

The legal weight of these documents also differs, and this is the part most people get wrong. In the harmonised jurisdictions an approved code of practice is admissible in proceedings and can be used to determine what was reasonably practicable. It is strong evidence, not a safe harbour. Two exceptions are worth knowing.

Queensland is quasi-mandatory. Section 26A of its WHS Act requires a duty holder either to comply with an approved code or to manage risk in a way that provides an equivalent or higher standard. You cannot simply disregard it and argue reasonableness.

Victoria’s Compliance Code confers deemed compliance. Under section 152 of the OHS Act 2004, a person who complies with a compliance code is taken to have complied with the underlying duty. That is a genuinely different and stronger protection than an approved code of practice offers, and it means Victorian employers have a clearer route to demonstrable compliance than their interstate counterparts.

If you want the broader picture on how codes of practice work and what weight they carry, we have a guide to Australian safety codes of practice, and NSW has gone further than most: NSW codes of practice became enforceable on 1 July 2026.

Find your jurisdiction’s code of practice

Whatever else you read, your own regulator’s code is the practical starting point, because it is the document an inspector will expect you to have worked from. Safe Work Australia’s model code has no legal force of its own, it is the template jurisdictions draw on, so use your own version rather than the model unless you are in the Northern Territory. Victoria’s is a compliance code rather than an approved code of practice, which as explained above carries more weight, not less.

Several jurisdictions also publish a separate code on sexual and gender-based harassment, which overlaps with the harassment hazard in the list above. The NSW one is the NSW Code of Practice: Sexual and gender-based harassment. Safe Work Australia has a model version, South Australia’s commenced on the same day as its psychosocial code, and Western Australia takes a different route with companion codes on workplace behaviour and on violence and aggression at work. Queensland has no separate harassment code but does impose a mandatory sexual harassment prevention plan.

The hierarchy of controls, and what most commentary gets wrong

Here is the technical point that separates people who have read the regulations from people who have read articles about the regulations.

When Safe Work Australia amended the model regulations in 2022, the new regulation 55C required psychosocial risks to be managed in accordance with the general risk management part of the regulations other than regulation 36, the hierarchy of control measures. Safe Work Australia’s own explanatory memorandum confirms the carve-out was deliberate. The model code reflects it: search the whole document for “hierarchy” and you get one hit, and it is describing a hierarchical organisational structure as a hazard factor. There is no hierarchy of controls diagram in it at all.

That carve-out is now the minority position in Australia.

New South Wales is the change worth knowing about. When the WHS Regulation 2017 was remade as the WHS Regulation 2025, commencing 22 August 2025, the words “other than clause 36” came out. Section 55C now reads simply that a person conducting a business or undertaking must manage psychosocial risks in accordance with Part 3.1 and implement the control measures required by section 55D. SafeWork NSW has confirmed the effect on its own website, describing it as “the mandatory application of the hierarchy of control measures”. If your NSW psychosocial risk assessments predate August 2025, they were built under a different rule.

The Northern Territory is very widely misreported. A number of law firm and consultancy summaries list the NT alongside WA and Tasmania as retaining the carve-out. It does not. The NT inserted the carve-out effective 1 July 2023 and repealed it by a further instrument commencing immediately after the first, so it never had a day of practical operation.

Victoria has the most explicit provision in the country, and it is better than saying Victoria has no hierarchy. Its regulations require elimination so far as reasonably practicable, and if that is not practicable, reduction by altering the management of work, plant, systems of work, work design or the workplace environment. Information, instruction or training may be used exclusively only if none of those alterations is reasonably practicable, and where used in combination they must not be the predominant control measure. There is no personal protective equipment tier, because there is no such thing as psychosocial PPE.

You cannot train your way out of a work design problem

This is where most psychosocial risk programs fail, and the regulators are unusually direct about it.

SafeWork NSW puts it most plainly. The best and most effective way to control these risks is at the source, by substituting current work methods with less hazardous alternatives. Where risks remain after the work has been redesigned, administrative controls including safe systems of work and appropriate information, training, instruction and supervision will also be required, but “relying on administrative controls should never be the main risk management approach”. Note that NSW’s own definition of administrative controls in that sentence expressly includes training, which means resilience training is captured without anyone needing to argue the point.

Queensland and South Australia use the same two sentences, four years apart, and they are worth reading twice. Control measures should predominantly be considered at an organisational, work and system design level rather than at an individual level, “although some circumstances may require responses at both levels”. Focusing on higher level control measures that address work design ensures the risk of harm is addressed at the source, “rather than inferior measures that only reduce the impact of harm after it has occurred”.

None of this means an employee assistance program is a bad thing. It means it is not a control. It is a support measure that operates after harm has occurred, and if it is the primary entry in your controls column then your controls column is empty. The same goes for resilience training, mindfulness sessions and a wellbeing policy. SafeWork NSW lists it among the common failures: focusing on poor behaviour by an individual without identifying or controlling the psychosocial hazards giving rise to it, and relying mainly on administrative controls.

If a hazard is unreasonable job demands, the control is a change to workload, rostering, resourcing or scope. If the hazard is low role clarity, the control is a position description and a reporting line that match reality. Those are the answers, and they are harder than booking a workshop, which is precisely why the workshop keeps getting booked instead.

Where ISO 45001 stops short, and what changes in 2027

ISO 45001:2018 requires you to identify hazards and control risks to health. Psychosocial hazards are hazards to health, so they are covered in principle. But the 2018 text does not name them, does not describe them, and gives no guidance on them, which in practice means a great many certified safety management systems have handled them thinly or not at all and still passed audit.

The next edition changes that. Psychosocial risk and mental health are among the main areas being sharpened, along with worker participation and modern work patterns including remote and hybrid work. The draft is at international ballot, which closes on 8 September 2026, with publication expected during 2027 and a three year transition expected to follow.

The practical consequence for anyone certified today. Your legal obligation already exists and is already enforceable. The standard will catch up next year. So there is no value in waiting for the standard before doing the work, and there is a real risk in assuming your certificate demonstrates you have done it. The organisations that will find the 2027 transition easy are the ones treating psychosocial hazards as ordinary hazards now.

What an auditor looks for

Four things, and none of them takes long to check.

Are psychosocial hazards in the risk register? Not in a wellbeing policy, not in an HR procedure, not in a separate document owned by someone who does not attend the safety meeting. In the risk register, with an assessed rating and a control, alongside the physical hazards. This one question sorts most systems immediately.

What are the controls, and do they change the work? If the controls column reads “EAP available”, “resilience training” and “open door policy”, the honest finding is that the risks have not been controlled at all, only cushioned. An auditor will ask what changed about the work.

How did you identify them? Psychosocial hazards are not visible on a walkaround. Identification requires asking people, through consultation, surveys, exit interview themes, incident and complaint patterns, workers compensation data, absenteeism and turnover. A system with no evidence of having asked anyone has not identified anything.

Is there a line from hazard to control to review? Pick one hazard. Ask which control treats it, who owns it, when it was implemented and how anyone knows whether it worked. In most systems the chain breaks at the last link, because reviewing the effectiveness of a psychosocial control requires going back to the people affected and asking again. This is the kind of thing an independent internal audit is for.

Common questions

Is this only about bullying and harassment?

No, and treating it that way is the most common scoping error. Bullying, harassment and violence are three of fourteen hazards. The majority of the list is about how work is designed and managed: demands, control, support, role clarity, change management, recognition and justice. Those are the ones that generate most of the harm and get the least attention.

Do we need a separate psychosocial risk register?

No, and we would recommend against it. A separate register is how psychosocial hazards end up outside the safety management system, reviewed by different people on a different cycle. Put them in the register you already have.

Does a psychosocial hazard have to have caused harm before we act?

No. The duty is to manage the risk, not to respond to injuries. Waiting for a workers compensation claim means the control was implemented after the harm, which is the definition of an inferior control.

We are a small business. Does this apply to us?

Yes. The duty does not have a size threshold. What changes with size is the proportionate response: a twelve person business does not need an engagement survey platform, it needs a genuine conversation and a record of it, and controls that match what came out.

Can ISO 45001 certification demonstrate we have met the psychosocial duty?

Not on its own, and this is worth being clear about. Certification demonstrates you operate a safety management system that meets the standard. Whether that system adequately addresses psychosocial hazards depends on what is in it. Since the current edition does not explicitly require them, a certificate is not evidence either way. What does help is a risk register showing psychosocial hazards identified, assessed, controlled at the source and reviewed.

If you want help getting psychosocial hazards properly into a safety management system, that is part of what we do. See our ISO 45001 consulting, audits and mentoring, or have a free chat with us by Teams, Zoom or phone first and we will work out what you actually need.