What Is a PCBU? The Duty Holder at the Centre of Australian WHS Law

If you have read an Australian safety document written any time in the last decade, you have met the acronym. It sits in incident reports, contracts, tender responses and induction slides, usually with no explanation, as though everyone already agreed what it means.

PCBU stands for person conducting a business or undertaking. It arrived with the harmonised work health and safety laws that began rolling out from 2012, and it did something deliberate: it took the central safety duty off the employment relationship and attached it to the work itself.

That change is the whole point of the term, and it is the part most people miss. Under the old law, the duty ran from employer to employee. If someone on your site was not your employee, your obligations to them were thinner and harder to pin down. Under the WHS Act, the question is no longer who signs whose pay slip. It is whose business or undertaking the work is being carried out for.

If you have ever wondered why a head contractor can be prosecuted over an injury to a subcontractor’s worker, this is why.

What PCBU stands for, and what the definition says

The acronym expands to person conducting a business or undertaking. Section 5 of the WHS Act defines it, and the definition is broader than most people expect. A person conducts a business or undertaking:

• whether alone or with others, and
• whether or not the business or undertaking is conducted for profit or gain.

That second limb is doing a lot of work. “Undertaking” is not a synonym for “company”. A not-for-profit, an incorporated association, a school, a church, a sporting club with paid staff, a local council and a Commonwealth agency are all conducting an undertaking. So is a sole trader. So is each partner in a partnership, individually, because section 5(3) reads the reference to a PCBU as a reference to each partner.

The word “person” is also legal shorthand rather than plain English. In most cases the PCBU is the legal entity, the company, not a human being. That distinction matters later, because the humans who run the company hold a different duty under a different section.

Who is a PCBU

You are almost certainly a PCBU if you are:

• a company that engages anyone to carry out work, employee, contractor, labour hire or volunteer
• a sole trader or self-employed person, who is both a PCBU and, under section 19(5), owes a duty to themselves
• a partner in a partnership, individually
• an unincorporated association that employs anyone
• a not-for-profit, charity, school or club with paid staff
• a government department, statutory authority or local council
• a franchisor or franchisee, each in respect of its own business
• a principal contractor, head contractor or project manager, in respect of the work it influences and controls

The test is not your size, your structure or whether you make money. It is whether work is being carried out for your business or undertaking.

Who is not a PCBU

The Act carves out four groups, and the carve-outs are narrow.

Workers acting only as workers. Section 5(4) says a person does not conduct a business or undertaking to the extent that they are engaged solely as a worker in, or as an officer of, that business. An employee is not a PCBU of their employer’s business.

Elected members of a local authority, in that capacity. A councillor acting as a councillor is not conducting a business or undertaking. Section 5(5).

Volunteer associations. Section 5(7) exempts a group of volunteers working together for community purposes where none of them employs anyone to carry out work for the association. The moment a volunteer group hires its first paid employee, it stops being a volunteer association and becomes a PCBU with the full primary duty. This catches a lot of community organisations by surprise, and it is worth checking against your own structure.

Strata and residential arrangements, in limited circumstances set by the regulations, which vary by jurisdiction.

Note what is not on that list. There is no exemption for being small, for being new, for using contractors instead of employees, or for the work happening at someone else’s site.

The primary duty of care

Section 19 is the section that matters most. A PCBU must ensure, so far as is reasonably practicable:

• the health and safety of workers it engages, or causes to be engaged, and
• the health and safety of workers whose activities in carrying out work it influences or directs, and
• that the health and safety of other persons is not put at risk from work carried out as part of the conduct of the business.

Read the second and third limbs again, because that is where the old employer duty ends and the PCBU duty begins. “Influences or directs” reaches a labour hire worker, a subcontractor’s crew, an apprentice placed with you and a volunteer. “Other persons” reaches visitors, neighbours, delivery drivers and members of the public.

Section 19(3) then spells out what the duty covers in practice. So far as is reasonably practicable, a PCBU must provide and maintain:

• a work environment without risks to health and safety
• safe plant and structures
• safe systems of work
• safe use, handling and storage of plant, structures and substances
• adequate welfare facilities, including access to them
• any information, training, instruction or supervision necessary to protect people from risks arising from the work
• monitoring of workers’ health and of workplace conditions, for the purpose of preventing injury or illness

That last item, health and conditions monitoring, is the one most commonly missing from a management system that otherwise looks complete.

Section 17 sets the order of operations: eliminate the risk so far as is reasonably practicable, and only if elimination is not reasonably practicable, minimise it. That is the hierarchy of controls expressed as a statutory duty, not a preference. We have written separately on the energy wheel and the hierarchy of controls, which is the practical half of the same idea.

What “reasonably practicable” means

Every limb of the duty is qualified by “so far as is reasonably practicable”. It is not a loophole, and it is defined. Section 18 requires you to take into account and weigh up all relevant matters, including:

• the likelihood of the hazard or risk occurring
• the degree of harm that might result
• what you know, or ought reasonably to know, about the hazard and about the ways of eliminating or minimising it
• the availability and suitability of ways to eliminate or minimise the risk
• and only after all of that, the cost, including whether the cost is grossly disproportionate to the risk

The order is not accidental. Cost comes last, and it is not a matter of whether the control is expensive. It is whether the cost is grossly disproportionate to the risk, which is a much harder test to meet than “we could not afford it”.

The “ought reasonably to know” limb is the one that catches organisations out. If a hazard is covered by a published code of practice, a regulator alert or an industry standard, a court will generally treat you as having known about it. We maintain a set of links to Australian safety codes of practice for exactly this reason.

PCBU, officer and worker are three different duty holders

This is where most confusion sits. The Act creates separate duties for separate roles, and the same human being can hold more than one of them at once.

Two details worth holding on to.

A sole trader is both a PCBU and a worker. Section 7(3) says the PCBU is also a worker if they are an individual who carries out work in the business, and the note to section 5 confirms a person can be both at once. They hold both duties simultaneously.

Officer due diligence is a personal duty and it is being enforced. Section 27(5) defines it as taking reasonable steps to acquire and keep up to date knowledge of WHS matters, to understand the operations and their hazards, to ensure the business has and uses appropriate resources and processes to eliminate or minimise risk, to ensure there are processes for receiving and responding to incident and hazard information, and to verify that all of it is happening. Section 27(4) makes the point bluntly: an officer can be convicted whether or not the PCBU has been convicted. We covered two directors fined personally in one week in officer due diligence and director liability.

You can share a duty, and you cannot give it away

Four short sections, and between them they settle most contractual arguments about safety.

Section 14: duties cannot be transferred. You cannot contract out of your duty, and no indemnity clause moves it to someone else.

Section 15: a person can have more than one duty, by being in more than one class of duty holder.

Section 16: more than one person can concurrently have the same duty. Each duty holder must comply to the standard the Act requires, even if someone else has the same duty. And each must discharge it to the extent they have the capacity to influence and control the matter, or would have had that capacity but for an agreement purporting to limit or remove it. That last clause is the anti-avoidance provision: writing the control away in a contract does not write the duty away.

Section 46: where more than one person has a duty for the same matter, each must consult, cooperate and coordinate activities with the others, so far as is reasonably practicable.

Put together, these are why a principal can be liable for a subcontractor’s worker on someone else’s plant. We wrote up a case where exactly that happened in fined $230,000 for someone else’s worker.

Construction adds a further layer on top of all this. On a project over the cost threshold, the regulations create a specific appointment, the principal contractor, with its own prescribed duties including a written management plan. That role sits differently to section 14: it can be moved, but only by engaging someone and authorising them to have management or control of the workplace. Until that happens it stays with the business that commissioned the project.

Separately, section 47 requires a PCBU to consult its own workers, so far as is reasonably practicable, on matters that directly affect their health and safety. Consultation is not a courtesy in this framework. It is a duty with a penalty attached.

Victoria uses different words for a similar idea

Safe Work Australia’s position is that the model WHS laws have been implemented in all jurisdictions except Victoria. Victoria still operates under its own Occupational Health and Safety Act 2004, which uses “employer” and “self-employed person” rather than “PCBU”, and frames the duty around employees and persons other than employees.

The practical effect is closer than the vocabulary suggests: a Victorian employer’s duty is also qualified by reasonably practicable, and also extends beyond its own employees. But if you operate across borders, do not assume a Victorian document that says “employer” and a New South Wales document that says “PCBU” are interchangeable. They are drawn from different Acts with different section numbers, different definitions and different penalty structures.

Even among the harmonised states, some have varied the model Act. Safe Work Australia publishes a cross comparison table showing where. If your management system relies on a legal register, that register needs to name the Act that applies in each state you work in, not “the WHS Act” generically.

What happens when a PCBU gets it wrong

The Act creates a graded set of offences rather than a single one.

• Category 3, section 33: failing to comply with a health and safety duty.
• Category 2, section 32: failing to comply with a duty where the failure exposes a person to a risk of death or serious injury or illness.
• Category 1, section 31: the same exposure, but engaged in without reasonable excuse and with gross negligence or recklessness as to the risk.
• Industrial manslaughter, now a separate Part in most jurisdictions, where conduct causing death meets the threshold set by that state or territory.

Maximum penalties are set as penalty units, indexed annually on 1 July, and they differ between jurisdictions because several states have moved away from the model amounts. Any specific dollar figure quoted in an article goes stale quickly, so check the current maximums for your jurisdiction against Safe Work Australia’s penalty table rather than relying on a number you read somewhere.

Two features of the enforcement regime matter more than the headline numbers. A prosecution does not need an injury: exposure to the risk is enough for a Category 2 offence. And officers are prosecuted separately from the PCBU, on their own duty, on their own facts.

Where ISO 45001 fits

ISO 45001 does not use the word PCBU. It speaks of the organization and of workers, because it is an international standard written to work in every legal system. That does not make it disconnected from the WHS Act. It makes the mapping something you have to do deliberately.

The connections that matter:

• Clause 6.1.3, determination of legal requirements and other requirements. This is where your WHS Act duties, the regulations and the applicable codes of practice get identified and kept current. A legal register that names the wrong Act for a state you work in fails here.
• Clause 6.1.2, hazard identification and assessment of risks, and clause 8.1.2, eliminating hazards and reducing risks, which sets out the hierarchy of controls. That is section 17 in standard form.
• Clause 5.4, consultation and participation of workers. This is section 47 in standard form, and it is the clause auditors most often find running on goodwill rather than process.
• Clause 8.1.4, control of procurement, contractors and outsourcing. Sections 16 and 46 in standard form: the shared duty, and the obligation to consult, cooperate and coordinate.
• Clause 5.1, leadership and commitment, which is where an officer’s due diligence under section 27 becomes visible and auditable rather than assumed.

The honest summary is this. A certified ISO 45001 system is not a defence, and certification is not compliance. What a well built system gives you is the evidence: the risk assessments, the consultation records, the training registers, the incident reviews and the management review minutes that show what you knew, when you knew it, and what you did about it. That evidence is exactly what “reasonably practicable” and “due diligence” are tested against.

Where ISO 45001 stops short of Australian law is also worth knowing. We have set that out for one significant area in psychosocial hazards at work.

Five questions to test whether you know your duties

1. Name the Act. Which Act applies in each state and territory you operate in, and does your legal register name it correctly?
2. Count the duty holders. For your highest risk activity, who else has a duty for the same matter, and when did you last consult, cooperate and coordinate with them?
3. Check the reach. Does your risk assessment cover people you influence or direct but do not employ, and people who are not workers at all?
4. Test the officers. If a regulator asked one of your directors to demonstrate the five limbs of section 27(5), what document would they reach for?
5. Find the monitoring. Section 19(3)(g) requires monitoring of worker health and of workplace conditions for the purpose of preventing injury or illness. Where does yours live?

If any of those took longer than a minute to answer, the gap is not in your paperwork. It is in knowing which duties you hold.

Frequently asked questions

What does PCBU stand for?

Person conducting a business or undertaking. It is the principal duty holder under Australia’s harmonised work health and safety laws, defined in section 5 of the WHS Act.

Is a PCBU a person or a company?

Usually a company. “Person” is used in its legal sense and covers a body corporate, a partnership, an unincorporated association and an individual. A sole trader is a PCBU as an individual.

Can an employee be a PCBU?

Not of their employer’s business. Section 5(4) excludes a person engaged solely as a worker or officer of that business. Someone who runs their own business on the side is a PCBU of that business.

Is a director a PCBU?

No. A director is an officer, with a separate duty under section 27 to exercise due diligence. The company is the PCBU. A director can be prosecuted on their own duty whether or not the company is.

Are volunteers covered?

Volunteers are workers under section 7(1)(h), so a PCBU owes them the primary duty. A pure volunteer association that employs nobody is not a PCBU at all, but it stops being one the moment it hires its first employee.

Does Victoria use the term PCBU?

No. Victoria has not adopted the model WHS laws and uses “employer” and “self-employed person” under its Occupational Health and Safety Act 2004.

Does ISO 45001 certification mean I am meeting my PCBU duties?

No. Certification is not compliance. A well built ISO 45001 system produces the evidence that your duties were discharged, but the duty comes from the Act and is tested against the Act.

Knowing which duties are yours

Most organisations we work with are not unclear about safety. They are unclear about which duties are theirs, which are shared, and what evidence would stand up if someone asked.

Streamline builds ISO 45001 management systems that map to the WHS duties that apply in your states, not to a generic template. If you want a straight answer on where your gaps are, get in touch.