The five-stage check: how equipped is your business to manage psychosocial risk?

Our Workforce Pulse research found 89 per cent of businesses feel confident managing physical safety. However, psychosocial risk tells a different story. Citation Certification’s recent webinar on managing psychosocial risk found three-quarters of attendees weren’t confident their business had a robust psychosocial risk management system, and nearly 6 in 10 said psychosocial risks tend to get raised informally rather than through a clear reporting process.

Knowing the strengths in your existing systems and processes, and which gaps need filling is the key to building a safer and more compliant workforce.

Stage one: risk assessment

What’s already in place: Australian workplaces have embedded physical safety for decades, so your physical safety systems – hazard identification, incident reporting, safe work procedures – are probably already in good shape. Fold psychosocial risk into that same system.

Next steps: carry out a robust, documented psychosocial risk assessment. In practice, that means:

• An internal or external audit that specifically looks at psychosocial hazards, not just physical ones.
• Directly consulting workers in the process, rather than assuming leadership already knows what’s going on.
• Workplace inspections that investigate psychosocial wellbeing, not just physical safety.
• Routine manager check-ins.
• A review of existing hazard and incident reports, looking specifically for psychosocial patterns already in the data.

Psychosocial hazards typically fall into consistent categories:

• Unmanageable workloads and low job control
• Limited support from supervisors or systems
• Unclear roles and workflows
• Mismanaged organisational change
• Unresolved workplace relationships or conflict.

Once you’ve documented a risk assessment and categorised the hazards, your business will be ready to implement hazard controls.

Stage two: controls

What’s already in place: a completed psychosocial risk assessment. You know what psychosocial hazards look like, and you’ve clearly documented psychosocial risks in your workplace.

Next steps: actual controls, not just a documented list of known problems. The standard approach, working from most to least effective, looks like this:

• Eliminate the hazard where possible.
• Substitute or change the way the work is done.
• Engineer a new way of working that removes the risk by design.
• Administrative controls, clear instructions, signage, and defined processes.
• Support measures as a last layer, not the whole solution.

In practice, this typically includes: workforce planning that balances workload against capacity, consulting workers before setting performance targets, clearly defined job roles, achievable timeframes, giving people input into how they do their work, flexible work arrangements where possible, planned and communicated organisational change, support systems like buddying or mentoring for new starters, regular feedback, and a clear system for people to raise concerns.

What’s still missing at this stage: leadership development. You’re building the platform, but no one’s equipped yet to own the day-to-day process.

Moving to compliance: once controls exist, the next step is making sure leaders know their role in keeping them running – position descriptions, procedures, and basic training.

Stage three: compliance

What’s already in place: the paperwork regulators want to see. If an inspector arrives tomorrow, or a serious incident occurs, this is what you’d need to produce:

• A psychosocial hazard risk assessment specific to your workplace, not a generic template.
• Evidence of worker consultation: meeting minutes, surveys, toolbox talks.
• Implemented controls: safe work design, proper resourcing, training, and clear reporting pathways.
• Training records for leaders and managers.
• Ongoing review and monitoring: tracking injury data, absenteeism, and complaint trends.

Keep in mind that the legal bar keeps moving, and varies by state. In Victoria, training alone isn’t enough, and businesses must report workplace complaints to WorkSafe. In Queensland, a written sexual harassment prevention plan is mandatory.

Moving to commitment: the shift from compliance to genuine buy-in tends to start with two things: replacing infrequent, large-scale surveys with smaller, more frequent check-ins, and giving leaders real, scenario-based training rather than a single awareness session.

Reframe any employee assistance program (EAP) as one tool among several, not the main response, since higher-order controls (roster design, handover protocols, peer supervision, debriefing structures) do more of the actual work.

Stage four: commitment

What’s already in place: leaders with real capability, not just a completed training record. Practical, scenario-based training builds the ability to have a difficult conversation, notice a change in someone, and know when to check in – a one-hour awareness session ticked off once a year doesn’t.

Next steps: education spreading beyond leadership. Commitment isn’t just better-equipped managers – it’s the workforce understanding psychosocial safety from their own perspective, rather than something managed on their behalf.

Embedding into the culture: the last shift folds this into everything the business already does, rather than running it as a separate initiative.

Stage five: culture

At this stage, psychosocial safety isn’t a separate program – it’s built into recruitment, position descriptions, reviews, and how you assess every other business risk. Your leaders know what to do without being told.

What’s often already in place: shared ownership. It’s no longer one team’s job to carry alone – teams and individuals share the responsibility.

What this looks like day to day: ongoing review is no longer a separate project – it’s how the business operates, tracking injury data, absenteeism, and complaint trends as a matter of course, the same way it would for any other business risk.

Four questions to ask

Once you’ve identified your business’s stage, ask these four questions to find the gaps:

1. Is it easy to report a concern, and is confidentiality properly protected?
2. Do people know what happens, and who’s meant to support them after they report a concern?
3. Are responsibilities for following up and managing hazards clearly assigned to the right people?
4. Do the teams responsible for people and safety share information easily, or are they working in parallel without realising it?

Any question without a clear answer is where to focus next. Closing that gap is how you build a safer, more compliant workplace.