What is a Psychosocial Risk Assessment?

At A Glance

• A psychosocial risk assessment identifies, evaluates and controls workplace factors that can harm psychological health
• It's a legal requirement in Australia, covering the 14 psychosocial hazards defined by Safe Work Australia
• The process runs in four stages: identify, assess, control and review, with worker consultation throughout
• The People at Work survey is being decommissioned, so organisations relying on it need a replacement for 2026
• Foremind supports the identification stage and offers end to end Code of Practice compliance

What is a psychosocial risk assessment?

A psychosocial risk assessment identifies, evaluates and controls workplace factors that could cause psychological or physical harm. It looks at how work is designed, organised and managed, not at any individual's mental health.

Under Australian WHS law, a person conducting a business or undertaking (PCBU) has the same duty to manage psychological risk as physical risk. A psychosocial risk assessment is the mechanism organisations use to meet that duty, drawing on survey data, incident reports and consultation to build a picture of where hazards exist and how serious they are.

The output is not just a report. It's a documented risk register, with prioritised hazards and control measures the organisation commits to implementing and reviewing over time.

What are the 14 psychosocial hazards?

The 14 psychosocial hazards are the specific workplace factors Safe Work Australia has identified as capable of causing psychological harm. Every psychosocial risk assessment should be structured around identifying and evaluating these.

‍

Why these hazards are rarely assessed in isolation

These hazards compound each other. A workplace with unclear roles often also has poor organisational justice, and the two together create more risk than either alone. This is why a formal psychosocial risk assessment, rather than an informal check-in, is needed to properly weigh cumulative risk rather than treating each hazard as a separate, unrelated issue.

See Foremind's psychosocial hazard examples for how each of these plays out in real workplace scenarios.

Is a psychosocial risk assessment a legal requirement in Australia?

Yes. Under the model Work Health and Safety Act and the Managing Psychosocial Hazards Code of Practice, a PCBU must identify, assess and control risks to psychological health with the same rigour applied to physical safety.

How state-based requirements differ

This obligation sits alongside state-based codes of practice, and enforcement detail varies by jurisdiction. New South Wales, Victoria, Queensland and other states have each issued their own supporting guidance and, in some cases, additional regulatory requirements. What stays consistent everywhere is the underlying duty, a PCBU cannot treat psychological harm as optional or secondary to physical safety.

Because requirements differ by location, check Foremind's breakdown of psychosocial hazards legislation by state before finalising a compliance approach.

How do you conduct a psychosocial risk assessment?

A psychosocial risk assessment is conducted through four stages, identify, assess, control and review, with worker consultation running throughout rather than sitting at the end.

1. Identify the hazards. Gather data from anonymous surveys, incident and hazard reports, unplanned leave data, exit interviews and direct consultation. No single data source gives a complete picture.
2. Assess the risk. For each hazard, evaluate likelihood and consequence using a risk matrix, considering how many workers are affected, how often, and how severe the impact would be with current controls.
3. Control the risk. Choose measures that target the source of the hazard first, rather than relying only on individual coping strategies.
4. Review and monitor. Reassess regularly and whenever significant workplace change occurs. A risk assessment reflects a single point in time, not a one-off compliance task.

Documenting the process

Every identified hazard, its risk rating, the controls chosen and the review date should sit in a formal risk register. Foremind's risk assessment template gives you a starting structure for the identify, assess, control and review stages.

What tools are used for a psychosocial risk assessment?

Several validated tools support the identification and assessment stages, and the right choice depends on organisation size, sector and whether you want a standalone survey or an integrated platform.

‍

Which tool should you choose

Most of these tools stop at hazard identification. What happens with that data, prioritising risks, assigning controls, tracking review dates, still needs a separate system. Foremind's psychosocial risk survey is built to sit at that identification stage while feeding directly into the rest of the Code of Practice compliance cycle, rather than leaving you to manually stitch survey results into a risk register afterwards.

What are the signs your organisation needs a psychosocial risk assessment?

Several leading indicators suggest an assessment is overdue, and most of them are already sitting in data your organisation collects for other reasons.

Data signals

Rising unplanned leave, particularly clustered in specific teams or periods, is often the first visible sign. Patterns in workers' compensation claims relating to stress, anxiety or psychological injury are another, as are recurring themes in incident reports, exit interviews and EAP utilisation data.

Cultural signals

Frequent turnover in a specific team, complaints about workload or unclear roles raised repeatedly in meetings, or a noticeable drop in productivity without an obvious operational cause, all point toward unmanaged psychosocial hazards. None of these signals alone proves a problem exists, but together they build a case for a formal assessment rather than an informal fix.

See Foremind's signs of employee burnout and absenteeism statistics for more on how quickly these patterns escalate.

What is the difference between a psychosocial hazard and a psychosocial risk?

A psychosocial hazard is the workplace factor itself, such as low job control or poor support. A psychosocial risk is the likelihood and severity of that hazard actually causing harm given current conditions and controls.

Why this distinction matters in practice

Two organisations can have the same hazard present, say, high job demands during a busy period, but very different levels of risk depending on how well that demand is currently managed. One team with strong support and clear workload distribution may face low risk from high demands, while another team with the same workload and no support structure faces high risk. A psychosocial risk assessment exists to make this distinction explicit, rather than treating every hazard as equally urgent.

What control measures follow a psychosocial risk assessment?

Control measures should target the source of the hazard first, and generally fall into three levels, applied together rather than in isolation.

Primary controls

These aim to eliminate or reduce the hazard before it causes harm. This includes redesigning work, setting realistic workloads, clarifying job descriptions and reporting lines, and building predictable rostering.

Secondary controls

These equip employees to cope with hazards that cannot be fully eliminated, through training in stress management, communication skills or manager capability building.

Tertiary controls

These provide support after harm has occurred, such as access to an Employee Assistance Program or rehabilitation support. Relying only on tertiary controls, without addressing the source, is a common mistake that leaves the underlying hazard unresolved.

Foremind's psychosocial safety system is designed to support organisations across all three levels, rather than treating support services as a standalone fix.

How often should a psychosocial risk assessment be conducted?

Every six to twelve months, and immediately whenever a significant workplace change occurs, such as a restructure, a change in leadership, or a shift to remote work.

Ongoing review matters more than the initial assessment. A risk rating reflects conditions at a single point in time, and controls that were effective a year ago may no longer be adequate if workload, staffing or leadership has changed. Building review into a standing HR or safety committee cycle keeps the assessment genuinely useful rather than symbolic.

What happens if an employer doesn't conduct a psychosocial risk assessment?

An employer that fails to conduct any psychosocial risk assessment is in breach of its WHS duties, exposing the organisation to regulatory investigation, workers' compensation claims and reputational damage.

Regulatory exposure

Regulators have shown increasing willingness to investigate and penalise organisations that cannot demonstrate a structured approach to psychosocial risk, particularly following a notifiable incident.

Practical cost

Beyond legal exposure, the cost tends to show up first in absenteeism, turnover and reduced productivity, often well before any formal claim or investigation begins.

See Foremind's overview of employer duty of care for what this obligation requires and where organisations most commonly fall short.

Is the People at Work survey still available?

No. The People at Work survey, a free regulator-backed tool used by many Australian organisations, is being decommissioned, so organisations relying on it need a replacement before their next assessment cycle.

What this means for your organisation

This creates a genuine gap for organisations that built their identification stage entirely around People at Work data. Foremind's psychosocial risk survey is one option built specifically to fill that role, but unlike a standalone survey, it connects directly into the assess, control and review stages within a single platform. That means organisations transitioning away from People at Work aren't just replacing one survey with another, they can move to a system covering the full Code of Practice compliance cycle end to end.

For background on the transition, see Foremind's post on the People at Work survey decommissioning.

Frequently Asked Questions

What is the difference between a psychosocial hazard and a psychosocial risk?

A psychosocial hazard is the workplace factor itself, such as poor support or high job demands. A psychosocial risk is the likelihood and severity of that hazard causing actual harm given the controls currently in place. The same hazard can carry very different levels of risk depending on how well it's managed.

Is a psychosocial risk assessment mandatory in Australia?

Yes. A PCBU is required to identify, assess and control risks to psychological health in the same way it manages physical safety risks, under the relevant WHS Act and Code of Practice.

What are the 14 psychosocial hazards?

They include job demands, low job control, poor support, lack of role clarity, poor organisational change management, low reward and recognition, poor organisational justice, poor physical environment, remote or isolated work, violence and aggression, bullying, harassment, conflict or poor workplace relationships, and exposure to traumatic events or content.

What tools are used for psychosocial risk assessment?

Common tools include the APHIRM Toolkit, COPSOQ III, the ADDRESS model for Australian Public Service agencies, and Foremind's Psychosocial Risk Survey. Scope varies, with some tools covering only hazard identification and others integrating directly into a broader compliance platform.

Is the People at Work survey still available?

No, it's being decommissioned, and organisations that used it need to select a replacement tool such as APHIRM, COPSOQ III, or Foremind's Psychosocial Risk Survey.

How often should a psychosocial risk assessment be conducted?

Every six to twelve months, and reassessed whenever significant workplace change occurs, such as a restructure or a shift in work arrangements.

What control measures follow a psychosocial risk assessment?

Primary controls that eliminate or reduce the hazard at its source, secondary controls that build employee capacity to cope, and tertiary controls that support employees after harm has occurred. Effective risk management uses all three, prioritising primary controls first.

What does a psychosocial risk assessment cost?

Costs vary depending on the depth of the assessment and whether it's a standalone survey or a full end to end platform. Most providers offer tiered options depending on whether an organisation needs hazard identification alone or full assessment, control and review support.

Managing psychosocial risk doesn't need to mean juggling a survey tool, a spreadsheet and a compliance checklist separately. Visit Foremind to see how identification, assessment, control and review can sit in one platform.

‍