Does an EAP satisfy your psychosocial safety obligations?

Partly, and the gap is bigger than most employers realise. An Employee Assistance Program is a legitimate control measure. But controlling risk is one of four steps the codes of practice require, and an EAP only contributes to part of that one step.

Identify, assess, control, review. An EAP touches one of them, at the lowest level of effectiveness. That is the distinction that matters if a regulator asks what you have done.

What is an EAP, and what is it for?

An employee assistance program is a workplace-funded service giving staff confidential access to short-term counselling, usually a set number of sessions per person per year, often extended to immediate family.

It is a genuinely good thing to have. It costs relatively little per head, and for someone dealing with a separation, a sick parent or a rough patch at work, it can matter enormously.

It is also, in WHS terms, a control measure. That is exactly why the confusion arises. Employers reasonably assume that because they have implemented a control, they have discharged the duty.

What do the codes of practice actually require?

The risk management process runs in four steps:

‍

Running alongside all four is a duty to consult workers.

A psychosocial hazard is an aspect of the work, the work environment, or workplace interactions that could cause psychological or physical harm. Recognised examples include high or low job demands, low job control, poor support, lack of role clarity, poor workplace relationships, bullying and harassment, violence and aggression, exposure to traumatic events, and remote or isolated work.

Where does an EAP sit within step three?

Even inside the control step, not all controls carry equal weight. The hierarchy of controls ranks them by effectiveness:

‍

An EAP is a tertiary control. Several jurisdictions now explicitly require higher-order controls to be considered before lower-order ones. So an employer who has gone straight to counselling has not just done one step of four, they have done the least effective part of that step.

What does this mean if a regulator asks?

An inspector reviewing psychosocial risk management is generally looking for evidence of the whole process: a hazard identification exercise, a documented risk assessment, control measures with someone accountable for each, a review date, and a record of worker consultation.

An EAP contract speaks to a fraction of one of those. It shows you funded a support service. It does not show you identified the hazards in your workplace, assessed them, did anything about their causes, or checked whether it worked.

That is the gap most small employers do not realise they have: a real, funded, well-intentioned service, and no defensible record of managing the risk.

So should you still have an EAP?

Yes, and this is the part worth being clear about. Support and risk management are two different jobs, and neither substitutes for the other.

An EAP is there for the individual, whatever they are carrying, work-related or not. A psychosocial risk process is about the work itself: how it is designed, resourced and managed. One helps a person through something. The other reduces how often the work is the cause.

You want both. Most small employers have the first and assume it covers the second.

What to do next

1. Map what you have against the four steps

‍Identify, assess, control, review. Be honest about which ones you have evidence for. Most organisations find they have a partial three and nothing else.

2. Write down your hazards

‍Not a generic list, but the five or six things about your work that could foreseeably cause psychological harm. Your staff will usually name them faster than you can.

3. Name a source-level control for each one

‍For every hazard, identify a change to the work itself, not just a support service. Where you cannot name one, that is your gap.

4. Check your jurisdiction. Requirements, codes of practice and enforcement posture differ by state and territory, and several have changed recently.

See our state-by-state guide to psychosocial hazards legislation.

‍

Frequently asked questions

Is an EAP legally required in Australia?

No, an EAP is not mandatory. There is no law requiring an employer to provide an employee assistance program. What is required is that you manage psychosocial risk through the four-step process. An EAP is one way to contribute to the control step, not a mandated service in its own right.

Does having an EAP reduce our liability if someone makes a claim?

It can form part of the picture, because a regulator or insurer will look at everything you did. But it carries far less weight than evidence that you identified the hazard and changed the work. Support offered after harm does not answer the question of whether the harm was foreseeable and preventable.

Can we list our EAP in our psychosocial risk register?

Yes, and you should. Record it as a tertiary control against the hazards it genuinely supports. The point is not to leave it out, but to make sure it is not the only control listed against any hazard. A register where every row ends in "EAP" is the pattern regulators notice.

Does an EAP count as consulting workers?

No. Consultation means giving workers a genuine opportunity to raise concerns about the work and to influence decisions that affect their health and safety. An EAP is a confidential service for individuals. By design, nothing said in it reaches you, so it cannot function as consultation.

Can we use EAP usage data as evidence we are managing risk?

Only in a limited way, and with care. Providers supply aggregate reporting, which can indicate broad themes, but usage numbers show demand for support rather than control of hazards. Confidentiality also means the data will never be granular enough to identify a specific hazard in a specific team.

Do we need to do this if nobody has complained?

Yes. The duty is to manage reasonably foreseeable hazards, not to respond to complaints. Waiting for someone to raise an issue means acting after exposure has already occurred, which is the position the four-step process is designed to avoid. Absence of complaints is not evidence of absence of risk.

Does the duty cover contractors, casuals and volunteers?

Generally yes. WHS duties are owed to workers broadly rather than to employees only, and that usually extends to contractors, labour hire staff, casuals and in many cases volunteers. Whether your EAP extends to the same group is a separate commercial question, and often the answer is no.

We are a small organisation. Is a simpler approach acceptable?

Yes. The duty does not scale with headcount, but what counts as reasonably practicable does. A twenty-person organisation is not expected to run an enterprise WHS system. It is expected to have identified its hazards, done something about them, and be able to show that.

‍

‍