Psychosocial Hazards in Victorian Workplaces: An Employer's Guide

Table of Contents

1. The direct answer
2. What is psychological health at work?
3. What is a psychosocial hazard?
4. Hazard, risk, stress and injury
5. The Victorian legal framework
6. Who owes duties, and when
7. Where psychosocial hazards arise
8. Common psychosocial hazards
9. Identifying hazards proactively
10. Consultation with employees and HSRs
11. Assessing risk where required
12. The hierarchy of controls
13. Work-design controls
14. Managing bullying and harmful behaviour
15. Sexual harassment as a psychosocial hazard
16. Aggression, violence and customer-facing risk
17. Exposure to traumatic events or content
18. Remote and isolated work
19. Organisational change
20. Responding to complaints and incidents
21. Reasonable management action
22. Psychological injury and workers compensation
23. Reviewing and revising controls
24. Records and governance
25. Small-business implementation
26. WorkSafe inspections and enforcement
27. Overlapping employment, discrimination and privacy laws
28. Legal-framework table
29. Risk-management table
30. Evidence and records checklist
31. Common employer mistakes
32. Practical employer action plan
33. Worked examples
34. When urgent legal advice is required
35. Conclusion
36. Frequently Asked Questions

What is psychological health at work?

Psychological health is part of an employee's overall health. The Occupational Health and Safety Act 2004 (Vic) defines health to include psychological health, placing it on the same legal footing as physical health. An employer that takes physical safety seriously but treats psychological health as a discretionary cultural matter is misreading the Act.

In practice, the workplace factors that affect psychological health are well documented in the Victorian compliance code and in WorkSafe Victoria guidance. They include the way work is designed and organised, the demands and resources of the role, relationships at work, the way change is managed and exposure to particular content or behaviour. These are management variables, not personal-resilience variables.

What is a psychosocial hazard?

A psychosocial hazard is a hazard that arises from, or relates to, the design or management of work, the working environment, plant at a workplace or workplace interactions or behaviours, and that may cause psychological or physical harm. The phrase covers a wide spectrum — from sustained excessive workload to exposure to traumatic content, from poor role clarity to repeated customer aggression, from bullying to poorly managed restructuring.

Several hazards commonly occur together. High job demands with low job control and poor support is a well-recognised combination. Role ambiguity coupled with a poorly managed organisational change can multiply risk. Examining hazards in isolation usually underestimates the overall exposure.

Hazard, risk, stress and injury — the differences

These terms are often used loosely. They are not interchangeable.

• Hazard — a source of potential harm (for example, sustained excessive workload).
• Risk — the likelihood and severity of harm arising from the hazard (for example, the likelihood of psychological injury given the workload, duration and affected group).
• Stress — a human response to demand, which may be a signal of risk but is not itself a hazard.
• Complaint or incident — a report, event or near-miss that may evidence a hazard or risk.
• Psychological injury — a diagnosed condition that may give rise to compensation, return-to-work and treatment obligations.

Conflating these terms produces poor management. A workplace with no diagnosed injuries may still carry substantial unmanaged risk. A workplace with several complaints does not necessarily have a higher hazard profile than a workplace with very few — it may simply have better reporting.

The Victorian legal framework

Victorian psychosocial-hazard duties sit primarily in three layers of authority: the Occupational Health and Safety Act 2004 (Vic), the Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic) and the WorkSafe Victoria Psychological Health Compliance Code. Each plays a different role.

The OHS Act 2004 (Vic). The Act imposes the primary duty on employers to provide and maintain, so far as is reasonably practicable, a working environment that is safe and without risks to health. Health includes psychological health. Reasonably practicable is defined in section 20 and requires balancing the likelihood and degree of harm, knowledge, available controls and cost. Officers owe separate duties to exercise due diligence.

The Psychological Health Regulations 2025. The regulations sit under the Act and add specific obligations directed at psychosocial hazards. They address identification, control and review of psychosocial risks and, depending on the workplace and circumstances, may prescribe particular requirements. Employers should check the current authorised version for the precise wording, commencement and any transitional or 2026 amendments that may apply to them.

The Psychological Health Compliance Code. The compliance code issued by WorkSafe Victoria provides practical guidance on how to comply with the Act and regulations in this area. Under the Victorian framework, complying with the compliance code is a recognised way to comply with the underlying obligations, but the code is not itself the law and following it does not guarantee freedom from liability.

Federal model material — including the Safe Work Australia model code on managing psychosocial hazards and the Work Health and Safety Act 2011 — uses different terminology (most notably PCBU) and applies in other jurisdictions. It is sometimes useful as secondary guidance but should not be treated as Victorian law.

Who owes duties, and when

The principal duty-holder under Victorian OHS law is the employer. Other duty-holders include self-employed persons, occupiers of workplaces, persons who design, manufacture, supply or install plant or substances, and persons in control of workplaces. Officers — including directors and others who participate in making decisions that affect the whole or a substantial part of the business — must exercise due diligence to ensure the corporation complies with its duties.

Duties are owed to employees, but also extend, so far as is reasonably practicable, to independent contractors and their employees in respect of matters over which the employer has control, and to other persons whose health and safety may be affected by the conduct of the undertaking. Hosts of labour-hire workers carry duties even where the labour-hire agency is the legal employer.

When the duties arise. The duty to identify and control psychosocial hazards is not contingent on a formal complaint, a notification or a psychological injury. It is enlivened by what the employer knows or ought reasonably to know, including information that should have been obtained through consultation, observation, incident data and review. Waiting for a formal complaint is rarely a defensible strategy.

Where psychosocial hazards arise

The compliance code and current WorkSafe guidance describe psychosocial hazards as arising from work design, systems of work, management of work, the way work is carried out, the working environment and personal and work-related interactions. Each of these is a legitimate area for inquiry.

• Work design. The fundamental shape of the role — duties, demands, decision-latitude, exposure, hours, location, autonomy.
• Systems of work. The processes by which work is allocated, supervised, escalated, reviewed and reported.
• Management of work. How managers communicate, support, hold accountable and respond to concerns.
• Carrying out the work. The actual day-to-day execution, including unplanned events, escalations and customer interactions.
• Interactions and behaviours. Conduct between employees and with customers, clients, patients and members of the public.
• Environment. Physical conditions, equipment, layout, security, isolation, technology and monitoring.

Common psychosocial hazards

The following table is non-exhaustive. Many workplaces will have several of these hazards present, and the interaction between them is often more important than any one in isolation.

Identifying hazards proactively

Identification should not depend on complaints. Useful sources of information include:

• structured consultation with employees and HSRs;
• direct observation of work in operation;
• incident, near-miss and complaint records;
• absence, leave-pattern and turnover data;
• workers-compensation claim data;
• exit-interview themes;
• surveys, focus groups and interviews;
• workload, rostering and overtime records;
• customer-complaint and aggression records.

Survey instruments may be useful but are not, by themselves, sufficient. Anonymity should be protected where promised. Identifying a hazard does not require attributing fault.

Consultation with employees and HSRs

Consultation is a duty under the OHS Act, not a courtesy. Where one or more HSRs have been elected for a designated work group, the employer must consult them on matters affecting the group's health and safety. Where there are no HSRs, the employer must still consult employees directly so far as is reasonably practicable.

Consultation should be timely (before decisions are made), informed (sharing relevant information), genuine (allowing employee input to influence the decision) and responsive (telling employees what was decided and why). Tokenistic consultation — particularly on change projects — is a documented source of psychosocial risk in its own right.

Assessing risk where required

The regulations require employers to identify psychosocial hazards and to control associated risks. Where the appropriate control is not obvious, a structured risk assessment is generally appropriate. Useful factors include:

• frequency and duration of exposure;
• severity of potential harm;
• number and identity of those exposed (including vulnerable groups);
• interaction with other hazards;
• existing controls and their effectiveness;
• industry-specific evidence;
• practicability and cost of further controls.

There is no single mandatory risk-assessment template. Some employers will use simple registers; others will use more structured tools. The format matters less than the rigour and the link to action.

The hierarchy of controls

Controls should be ordered from highest to lowest effectiveness:

1. Elimination. Remove the hazard where reasonably practicable (for example, removing a poorly designed task).
2. Redesign of work. Change demands, decision-latitude, role design, scheduling, supervision pattern.
3. Changes to systems and staffing. Increase resourcing, rebalance workload, restructure escalation paths.
4. Isolation of exposure. Separate harmful interactions; design physical barriers or secure spaces; rotate exposure.
5. Engineering and environmental controls. Lighting, security design, equipment, technology limits.
6. Administrative controls. Policies, procedures, codes of conduct, escalation rules.
7. Training and information. Targeted training for those at higher risk, manager capability development.
8. Individual support. EAP, debriefing, professional supervision, return-to-work support.

Lower-order controls should not be used as a substitute for reasonably practicable higher-order controls. An EAP, wellbeing day or resilience program may complement stronger controls but, alone, rarely discharges the duty.

Work-design controls

Specific work-design interventions that frequently reduce psychosocial risk include:

• reducing excessive caseloads;
• changing unrealistic deadlines;
• improving staffing in peak periods;
• clarifying roles and decision rights;
• redesigning rosters and on-call arrangements;
• introducing physical barriers or secure spaces;
• separating harmful interactions;
• changing reporting lines;
• improving escalation and supervision patterns;
• providing recovery time after traumatic work;
• setting clear behavioural standards;
• providing EAP support as a supplementary control.

Managing bullying and harmful behaviour

Workplace bullying is a recognised psychosocial hazard that also engages the Fair Work Commission's anti-bullying jurisdiction under Part 6-4B of the Fair Work Act 2009 (Cth), discrimination law and the employer's broader duty of care. Section 789FD(2) of the Fair Work Act provides that reasonable management action carried out in a reasonable manner is not bullying — but the corollary is that unreasonable, repeated behaviour that creates a risk to health and safety is.

From an OHS perspective, the employer must consider not only how to respond to a particular incident, but also what work-design, supervision or cultural factors allowed the conduct to occur and continue. An investigation may be one response (see our guide to workplace investigations in Victoria), but it does not discharge the broader prevention duty.

Sexual harassment as a psychosocial hazard

Sexual harassment is a recognised psychosocial hazard. The same conduct may engage the Sex Discrimination Act 1984 (Cth), the Equal Opportunity Act 2010 (Vic), the positive duty under federal law, the Fair Work Act stop-sexual-harassment jurisdiction and, in serious cases, criminal law. Prevention is a legal duty and should be built into work design, supervision and response systems — not delivered solely through annual e-learning.

Aggression, violence and customer-facing risk

Customer, client, patient and public aggression is a common but under-controlled hazard in many sectors. Stronger controls include environmental design, staffing levels at high-risk times, queue management, de-escalation training, panic alarms, body-worn devices where appropriate, security support, incident-reporting systems, post-incident support and review. "Customer-service training" alone is rarely sufficient.

Exposure to traumatic events or content

Some roles — emergency response, health care, investigations, content moderation, legal practice in certain areas — involve foreseeable exposure to traumatic events or content. Stronger controls include exposure limits, rotation, scheduled debriefing, access to clinical supervision, peer-support structures, supervisor training and explicit recovery time. Where the work cannot be eliminated, the employer's task is to control the exposure and to support recovery.

Remote and isolated work

Remote, hybrid and isolated work patterns can amplify risks such as poor support, role ambiguity, low job control, isolation and blurred work-hour boundaries. They can also reduce risks such as commuting fatigue and exposure to unsafe physical environments. The response is rarely "return to office or remain remote" but rather genuine work design — defined communication patterns, supervision, access to assistance, defined work hours and clear escalation.

Organisational change

Restructures, mergers, system migrations and leadership change are well-documented sources of psychosocial risk. Stronger controls include genuine consultation, accurate and timely communication, transition planning, support for affected employees, attention to those left in the changed structure and review of workload after the change has been implemented.

Responding to complaints and incidents

A complaint or incident may engage several distinct responses, each of which should be handled on its own footing:

• Immediate safety. Interim measures to address foreseeable risk to those involved.
• Hazard control. Examining whether the work design, system or supervision contributed and what should change.
• Investigation. Where disputed conduct must be determined, a procedurally fair investigation may be required — see our guide to procedural fairness in workplace investigations and common investigation mistakes.
• Discipline. Where conduct is established and meets the relevant threshold, disciplinary or termination action may be appropriate — see our guide to terminating employment for serious misconduct.
• Support. Practical, confidential support for affected employees, including time, EAP, leave and reasonable adjustments.
• Prevention review. Whether wider systemic change is needed to prevent recurrence.

Confidentiality should be managed carefully. It is rarely absolute. Anti-victimisation and adverse-action protections (see unfair dismissal claims in Australia) apply throughout. Moving the complainant is rarely an appropriate default control.

Reasonable management action

Legitimate performance management, operational decisions, lawful directions and necessary restructuring continue to be available to employers. They are not, in themselves, psychosocial hazards. However, the manner, process, timing and systems used can affect psychosocial risk, and lawful or reasonable management action is not a licence to ignore health and safety.

Where performance is the issue, our guide to managing underperformance and performance improvement plans sets out the framework. The two duties — performance management and psychosocial-hazard control — coexist; neither displaces the other.

Psychological injury and workers compensation

Where psychological injury arises, the Workplace Injury Rehabilitation and Compensation Act 2013 (Vic) and the Victorian WorkCover scheme engage separate obligations regarding claim acceptance, weekly payments, medical expenses, return to work, reasonable adjustments and rehabilitation. Prevention duties under the OHS Act and Psychological Health Regulations continue regardless of any claim. Claims management and prevention should be treated as distinct but coordinated processes.

Reviewing and revising controls

Review should occur:

• when an incident, near-miss or complaint suggests existing controls are inadequate;
• when work, workplace conditions, staffing or technology change;
• when new evidence or guidance emerges (including WorkSafe guidance);
• when consultation indicates a need to review; and
• at planned intervals appropriate to the risk.

Effectiveness is judged on outcomes, not on whether a document exists. A control register that is not implemented is a risk in its own right.

Records and governance

Senior management and board oversight matter. Officers owe a due-diligence duty. Useful governance practices include a board-level psychosocial-safety oversight mechanism, regular reporting on hazard register status, incident and trend data, control-review outcomes and consultation with HSRs.

Records should reflect what was actually done. Creating records merely for appearance, without implementing the controls described, is itself a documented risk in WorkSafe inspections and litigation.

Small-business implementation

Smaller employers face the same duties but may implement them in a proportionate way. Practical approaches include direct conversations with employees, a simple hazard register, plain work-design choices about workload and supervision, external HR or OHS assistance for complex matters, attention to manager capability and modest recordkeeping that actually reflects practice. Reliance solely on a generic policy and an EAP rarely discharges the duty.

WorkSafe inspections and enforcement

WorkSafe Victoria inspectors may enter workplaces, inspect documents, interview people and require information. They may issue improvement notices, prohibition notices and infringement notices in defined circumstances and refer matters for prosecution. HSRs may issue provisional improvement notices in defined circumstances.

Incident notification obligations are confined to specific categories of incident. Most psychological injuries are not notifiable in the same way as a serious physical injury, but employers should check the current notification requirements rather than assume.

Overlapping employment, discrimination and privacy laws

Psychosocial-hazard management intersects with the Fair Work Act 2009 (Cth) (workplace rights, anti-bullying, stop-sexual-harassment, general protections, unfair dismissal), the Equal Opportunity Act 2010 (Vic) and federal discrimination laws (including the Sex Discrimination Act 1984 (Cth) and Disability Discrimination Act 1992 (Cth)), the Privacy Act 1988 (Cth) (where it applies) and the Health Records Act 2001 (Vic). Each set of obligations operates in parallel; satisfying one does not satisfy the others.

Legal-framework table

Risk-management table

Evidence and records checklist

• psychosocial-hazard register;
• consultation records and HSR meeting records;
• risk assessments;
• incident and near-miss reports;
• bullying, harassment and aggression complaints;
• absence, turnover and workers-compensation data;
• exit-interview themes and survey/focus-group results;
• workload, staffing, rosters and overtime records;
• position descriptions and reporting lines;
• change-management plans;
• training and supervision records;
• policies, procedures and codes of conduct;
• investigation records and outcomes;
• control implementation plans and control-review records;
• board or executive oversight records;
• contractor and labour-hire arrangements;
• WorkSafe correspondence and notices.

Records should be aligned with action. A well-drafted register that is not implemented is a liability, not a defence.

Common employer mistakes

• treating psychosocial safety as an "employee wellness" initiative;
• relying on EAP, wellbeing days or resilience training as the principal control;
• waiting for a formal complaint or diagnosed injury before acting;
• conflating reasonable management action with safe management action;
• using lower-order controls instead of reasonably practicable higher-order controls;
• conducting investigations without addressing the underlying hazard;
• moving the complainant as a default response;
• treating the absence of complaints as evidence of safety;
• tokenistic or post-decision consultation on change;
• ignoring the interaction between several hazards;
• treating the compliance code as the law;
• poor records that do not reflect what was actually done.

Practical employer action plan

1. Appoint accountable senior responsibility for psychosocial safety.
2. Read the OHS Act, the Psychological Health Regulations 2025 and the WorkSafe compliance code in their current authorised form.
3. Consult employees and HSRs about how the work actually operates.
4. Identify psychosocial hazards by workgroup and task.
5. Examine organisational data — incidents, complaints, absence, turnover, claims, exit interviews.
6. Assess risk where the appropriate control is not obvious.
7. Prioritise elimination and source-based controls; treat training and EAP as supplementary.
8. Allocate actions, resources, owners and deadlines.
9. Train managers on the controls and escalation pathways.
10. Implement confidential reporting and response systems with anti-victimisation safeguards.
11. Monitor incidents, workload, absence and employee feedback.
12. Review controls after incidents, change or evidence of ineffectiveness.
13. Document decisions and provide governance oversight at board or executive level.
14. Obtain specialist legal, clinical, OHS or investigative advice where issues overlap.

Worked examples

The following examples are illustrative only and are not decided cases.

• Professional-services team. A team is repeatedly working very long hours to meet unrealistic deadlines. EAP usage is up. The defensible response addresses workload, deadlines and resourcing — not a resilience workshop.
• Public-facing employee. A retail employee is repeatedly subjected to customer aggression. Security design, staffing, de-escalation training, panic alarms and structured post-incident support are all relevant. "Customer-service training" alone is not.
• Bullying complaint with workload context. A complaint about bullying arises in a team with poor role clarity and excessive workload. An investigation may be required, but the prevention response also addresses role clarity, workload and supervision.
• Remote worker. A remote employee reports isolation and missed escalations. The response includes defined contact patterns, supervision, escalation paths and work-hour boundaries.
• Poorly managed restructure. A team is restructured by announcement with little consultation. Sick leave spikes. The response includes genuine consultation, transition support and workload review.
• Traumatic content. An employee reviewing distressing material develops symptoms of secondary trauma. Controls include exposure limits, rotation, professional supervision and recovery time.
• Resilience training without resourcing. A manager responds to chronic understaffing by booking a resilience course. This is rarely sufficient and may worsen perceptions of organisational justice.
• Small business consultation. A small business introduces a simple hazard register and a regular consultation forum. Modest, well-implemented controls outperform an elaborate but unread policy library.
• Investigation without prevention. A complaint is investigated and the conduct addressed, but no review is done of the work-design factors that contributed. Recurrence follows.
• Performance process after a safety complaint. A performance process commences immediately after an employee raises a safety concern. The employer should review timing, basis and evidence carefully, given general-protections risk.
• EAP-only response. An EAP referral is made after an incident, but the source of the risk is not reviewed. The hazard remains.
• Combined low-level hazards. Several low-level hazards (high demand, poor role clarity, limited support) combine to create substantial risk that no single hazard would have presented in isolation.

When urgent legal advice is required

• WorkSafe Victoria has made contact or issued a notice;
• a serious incident, injury or claim has occurred;
• a complaint of bullying, sexual harassment, discrimination or violence has been made;
• significant organisational change is planned in a workplace with existing risk factors;
• contractor, labour-hire or multi-employer arrangements complicate duty allocation;
• performance, leave, complaint or workplace-rights issues are overlapping; or
• the employer is uncertain how the current Victorian regulations and compliance code apply.

Early advice is materially more useful than late advice. Once a decision has been communicated or a notice issued, the options narrow rapidly.

Conclusion

Victorian psychosocial-hazard duties are not a wellness initiative. They are a workplace health and safety obligation owed by employers and officers and enforceable by WorkSafe Victoria. The duties focus on how work is designed, managed and supervised — not on individual resilience. They begin before a complaint or injury and require consultation, source-based controls and review.

An employer that builds psychosocial safety into how work is done — and then keeps reviewing it — is in a materially stronger position than one that relies on policies and EAP referrals. Our employment law team for employers can advise on the current regulations and compliance code, design and stress-test hazard-control systems, advise on complaint and incident responses and represent employers in WorkSafe and Fair Work matters.