What is a Psychosocial Risk Assessment?
And why your business likely needs one.
- Psychosocial risk assessments identify, evaluate and control factors harming psychological health at work
- It's a legal requirement, covering Safe Work Australia's 14 defined psychosocial hazards
- The process runs four stages: identify, assess, control, review, with ongoing worker consultation
- With the People at Work survey being decommissioned, organisations need a 2026 replacement
Download our guide to managing your teams mental health
What is a psychosocial risk assessment?
A psychosocial risk assessment identifies, evaluates and controls workplace factors that could cause psychological or physical harm. It looks at how work is designed, organised and managed, not at any individual's mental health.
Under Australian WHS law, a person conducting a business or undertaking (PCBU) has the same duty to manage psychological risk as physical risk. A psychosocial risk assessment is the mechanism organisations use to meet that duty, drawing on survey data, incident reports and consultation to build a picture of where hazards exist and how serious they are.
The output is not just a report. It's a documented risk register, with prioritised hazards and control measures the organisation commits to implementing and reviewing over time.
What are the 14 psychosocial hazards?
The 14 psychosocial hazards are the specific workplace factors Safe Work Australia has identified as capable of causing psychological harm. Every psychosocial risk assessment should be structured around identifying and evaluating these.
Why these hazards are rarely assessed in isolation
These hazards compound each other. A workplace with unclear roles often also has poor organisational justice, and the two together create more risk than either alone. This is why a formal psychosocial risk assessment, rather than an informal check-in, is needed to properly weigh cumulative risk rather than treating each hazard as a separate, unrelated issue.
See Foremind's psychosocial hazard examples for how each of these plays out in real workplace scenarios.
Is a psychosocial risk assessment a legal requirement in Australia?
Yes. Under the model Work Health and Safety Act and the Managing Psychosocial Hazards Code of Practice, a PCBU must identify, assess and control risks to psychological health with the same rigour applied to physical safety.
How state-based requirements differ
This obligation sits alongside state-based codes of practice, and enforcement detail varies by jurisdiction. New South Wales, Victoria, Queensland and other states have each issued their own supporting guidance and, in some cases, additional regulatory requirements. What stays consistent everywhere is the underlying duty, a PCBU cannot treat psychological harm as optional or secondary to physical safety.
Because requirements differ by location, check Foremind's breakdown of psychosocial hazards legislation by state before finalising a compliance approach.
How do you conduct a psychosocial risk assessment?
A psychosocial risk assessment is conducted through four stages, identify, assess, control and review, with worker consultation running throughout rather than sitting at the end.
- Identify the hazards. Gather data from anonymous surveys, incident and hazard reports, unplanned leave data, exit interviews and direct consultation. No single data source gives a complete picture.
- Assess the risk. For each hazard, evaluate likelihood and consequence using a risk matrix, considering how many workers are affected, how often, and how severe the impact would be with current controls.
- Control the risk. Choose measures that target the source of the hazard first, rather than relying only on individual coping strategies.
- Review and monitor. Reassess regularly and whenever significant workplace change occurs. A risk assessment reflects a single point in time, not a one-off compliance task.
Documenting the process
Every identified hazard, its risk rating, the controls chosen and the review date should sit in a formal risk register. Foremind's risk assessment template gives you a starting structure for the identify, assess, control and review stages.
What tools are used for a psychosocial risk assessment?
Several validated tools support the identification and assessment stages, and the right choice depends on organisation size, sector and whether you want a standalone survey or an integrated platform.
Which tool should you choose
Most of these tools stop at hazard identification. What happens with that data, prioritising risks, assigning controls, tracking review dates, still needs a separate system. Foremind's psychosocial risk survey is built to sit at that identification stage while feeding directly into the rest of the Code of Practice compliance cycle, rather than leaving you to manually stitch survey results into a risk register afterwards.
See our guide to best platforms for psychosocial safety.
What are the signs your organisation needs a psychosocial risk assessment?
Several leading indicators suggest an assessment is overdue, and most of them are already sitting in data your organisation collects for other reasons.
Data signals
Rising unplanned leave, particularly clustered in specific teams or periods, is often the first visible sign. Patterns in workers' compensation claims relating to stress, anxiety or psychological injury are another, as are recurring themes in incident reports, exit interviews and EAP utilisation data.
Cultural signals
Frequent turnover in a specific team, complaints about workload or unclear roles raised repeatedly in meetings, or a noticeable drop in productivity without an obvious operational cause, all point toward unmanaged psychosocial hazards. None of these signals alone proves a problem exists, but together they build a case for a formal assessment rather than an informal fix.
See Foremind's signs of employee burnout and absenteeism statistics for more on how quickly these patterns escalate.
Difference between a psychosocial hazard and risk
A psychosocial hazard is the workplace factor itself, such as low job control or poor support. A psychosocial risk is the likelihood and severity of that hazard actually causing harm given current conditions and controls.
Why this distinction matters in practice
Two organisations can have the same hazard present, say, high job demands during a busy period, but very different levels of risk depending on how well that demand is currently managed. One team with strong support and clear workload distribution may face low risk from high demands, while another team with the same workload and no support structure faces high risk. A psychosocial risk assessment exists to make this distinction explicit, rather than treating every hazard as equally urgent.
What control measures follow a psychosocial risk assessment?
Control measures should target the source of the hazard first, and generally fall into three levels, applied together rather than in isolation.
Primary controls
These aim to eliminate or reduce the hazard before it causes harm. This includes redesigning work, setting realistic workloads, clarifying job descriptions and reporting lines, and building predictable rostering.
Secondary controls
These equip employees to cope with hazards that cannot be fully eliminated, through training in stress management, communication skills or manager capability building.
Tertiary controls
These provide support after harm has occurred, such as access to an Employee Assistance Program or rehabilitation support. Relying only on tertiary controls, without addressing the source, is a common mistake that leaves the underlying hazard unresolved.
Foremind's psychosocial safety system is designed to support organisations across all three levels, rather than treating support services as a standalone fix.
How often should a psychosocial risk assessment be conducted?
Every six to twelve months, and immediately whenever a significant workplace change occurs, such as a restructure, a change in leadership, or a shift to remote work.
Ongoing review matters more than the initial assessment. A risk rating reflects conditions at a single point in time, and controls that were effective a year ago may no longer be adequate if workload, staffing or leadership has changed. Building review into a standing HR or safety committee cycle keeps the assessment genuinely useful rather than symbolic.
What happens if an employer doesn't conduct a psychosocial risk assessment?
An employer that fails to conduct any psychosocial risk assessment is in breach of its WHS duties, exposing the organisation to regulatory investigation, workers' compensation claims and reputational damage.
Regulatory exposure
Regulators have shown increasing willingness to investigate and penalise organisations that cannot demonstrate a structured approach to psychosocial risk, particularly following a notifiable incident.
Practical cost
Beyond legal exposure, the cost tends to show up first in absenteeism, turnover and reduced productivity, often well before any formal claim or investigation begins.
See Foremind's overview of employer duty of care for what this obligation requires and where organisations most commonly fall short.
Is the People at Work survey still available?
No. The People at Work survey, a free regulator-backed tool used by many Australian organisations, is being decommissioned, so organisations relying on it need a replacement before their next assessment cycle.
What this means for your organisation
This creates a genuine gap for organisations that built their identification stage entirely around People at Work data. Foremind's psychosocial risk survey is one option built specifically to fill that role, but unlike a standalone survey, it connects directly into the assess, control and review stages within a single platform. That means organisations transitioning away from People at Work aren't just replacing one survey with another, they can move to a system covering the full Code of Practice compliance cycle end to end.
For background on the transition, see Foremind's post on the People at Work survey decommissioning.
Frequently Asked Questions
What is the difference between a psychosocial hazard and a psychosocial risk?
A psychosocial hazard is the workplace factor itself, such as poor support or high job demands. A psychosocial risk is the likelihood and severity of that hazard causing actual harm given the controls currently in place. The same hazard can carry very different levels of risk depending on how well it's managed.
Is a psychosocial risk assessment mandatory in Australia?
Yes. A PCBU is required to identify, assess and control risks to psychological health in the same way it manages physical safety risks, under the relevant WHS Act and Code of Practice.
What are the 14 psychosocial hazards?
They include job demands, low job control, poor support, lack of role clarity, poor organisational change management, low reward and recognition, poor organisational justice, poor physical environment, remote or isolated work, violence and aggression, bullying, harassment, conflict or poor workplace relationships, and exposure to traumatic events or content.
What tools are used for psychosocial risk assessment?
Common tools include the APHIRM Toolkit, COPSOQ III, the ADDRESS model for Australian Public Service agencies, and Foremind's Psychosocial Risk Survey. Scope varies, with some tools covering only hazard identification and others integrating directly into a broader compliance platform.
Is the People at Work survey still available?
No, it's being decommissioned, and organisations that used it need to select a replacement tool such as APHIRM, COPSOQ III, or Foremind's Psychosocial Risk Survey.
How often should a psychosocial risk assessment be conducted?
Every six to twelve months, and reassessed whenever significant workplace change occurs, such as a restructure or a shift in work arrangements.
What control measures follow a psychosocial risk assessment?
Primary controls that eliminate or reduce the hazard at its source, secondary controls that build employee capacity to cope, and tertiary controls that support employees after harm has occurred. Effective risk management uses all three, prioritising primary controls first.
What does a psychosocial risk assessment cost?
Costs vary depending on the depth of the assessment and whether it's a standalone survey or a full end to end platform. Most providers offer tiered options depending on whether an organisation needs hazard identification alone or full assessment, control and review support.
Managing psychosocial risk doesn't need to mean juggling a survey tool, a spreadsheet and a compliance checklist separately. Visit Foremind to see how identification, assessment, control and review can sit in one platform.
Answers to the frequently asked questions.
Our last EAP was barely touched. Why would this be different?+
Most EAPs go unused because of how they're accessed, not because staff don't need them. Phoning a stranger, explaining yourself, then waiting weeks is enough to stop most people before they start. Foremind removes all three steps: staff see real counsellor profiles, pick someone themselves, and book the same day.
If you already have a provider, the question worth asking is what your current utilisation is. Most traditional EAPs sit in low single digits, which means you're paying for cover your people aren't reaching. If yours is being used, staff can get seen quickly, and it covers your psychosocial obligations, there's no reason to move. If not, it's worth knowing what you're getting for the spend.
Do you offer 24/7 support?+
Yes. A 24/7 after-hours crisis line means staff can reach someone immediately at any hour, including nights and weekends.
Counselling appointments are also available outside standard business hours, so shift-based and on-call teams aren't limited to a nine-to-five window. Those are two different things, and it's worth checking any provider offers both rather than just the crisis line.
Are your EAP counsellors based in Australia?+
Yes. Every practitioner on the platform holds current membership with an Australian professional body and practises under Australian standards, codes of ethics and disciplinary frameworks. There are no offshore call centres.
Practitioners hold membership with the Australian Counselling Association, the Psychotherapy and Counselling Federation of Australia, or the Australian Association of Social Workers, along with a current Working with Children or Vulnerable People Check.
How much does an EAP cost?+
Pricing is usually per employee per month, based on total headcount rather than how many people use the service. Costs vary widely depending on whether sessions are bundled in and whether compliance tooling is included.
A more useful comparison is cost per employee who actually uses it. An EAP with 2% utilisation can work out several times more expensive per person helped than one that gets used. Foremind offers pay-as-you-go, inclusive session plans and compliance-inclusive plans, with discounted pricing for not-for-profits and charities.
For full breakdown of our plans, see our EAP pricing page or request a quote for a tailored proposal.
What information does an employer receive about EAP usage?+
Nothing that could identify anyone. All counselling is completely confidential and all reporting is anonymous - you'll never see who booked, when, or what was discussed.
What you do see is the aggregated picture: how many people are using it, what psychosocial risks are prevalent in the business, and which teams are under pressure. Enough to know the investment is working and where to act, never enough to identify a person. Reporting thresholds mean small teams can't be reverse-engineered from the data.
Does having an EAP meet an employer's psychosocial duty of care?+
No. An EAP is a control measure, and a valuable one, but it only addresses harm after it has occurred. It doesn't identify hazards, assess risk, or evidence that controls are working.
Australian WHS law requires you to identify psychosocial hazards, assess the risk, control it so far as is reasonably practicable, and review whether those controls are working — with documented evidence at each step. Offering counselling on its own leaves three of those four steps undocumented.
Foremind covers both in one platform. See how the compliance side works in our product tour.