Physical and psychosocial hazards: what a workplace risk assessment covers

A workplace risk assessment identifies, evaluates, controls, and reviews hazards that could harm workers – both physical and psychosocial. Under Australian work health and safety (WHS) law, all persons conducting a business or undertaking (PCBUs) must manage risks so far as is reasonably practicable, and documented risk assessments are the core evidence of meeting that duty.

The gap between physical and psychosocial risk management is striking: according to Citation Group’s Workforce Pulse Report (WFPR), 89 per cent of Australian business leaders feel confident managing physical safety, yet only 77 per cent feel the same about psychosocial risks. Concerningly, one in three small businesses manage safety with no documented processes. Safe Work treats both physical and mental hazards with equal legal weight, and regulators are scrutinising psychosocial risk management across every sector.

What does a workplace risk assessment cover?

Physical hazards include unguarded machinery, slippery floors, and chemical exposure. Psychosocial hazards include excessive workload, role ambiguity, workplace conflict, poor leadership, and lack of support. Both carry the same legal obligations under the WHS Act 2011, regardless of business size. According to the WFPR, roughly one in three small businesses currently manage safety with no documented process at all, leaving them exposed to regulatory action and genuine harm.

How does the risk assessment framework apply to both hazard types?

Safe Work Australia’s Model Code of Practice: Managing psychosocial hazards at work prescribes the same four-step process used for physical risks: identify, assess, control, and review. It’s one process applied consistently across every hazard type.

Step one: Identify

For physical hazards, this means inspecting equipment, walkways, and work processes. For psychosocial hazards, it means examining workload, reporting structures, shift patterns, and interpersonal dynamics. Consultation with workers is the most reliable way to surface hazards.

Step two: Assess

Weigh the likelihood and consequence of each hazard, alongside the cost of fixing it. Costs are only disproportionate when they’re grossly disproportionate to the risk – a high-consequence, high-likelihood hazard demands urgent action regardless of cost.

Step three: Control

Apply the hierarchy of controls – eliminate, substitute, isolate, engineer, administer, then use personal protective equipment. This hierarchy applies equally to psychosocial risks: redistributing an unreasonable workload sits higher than training workers to manage stress.

Step four: Review

Controls degrade over time. Review after incidents, after significant workplace changes, and whenever consultation shows existing controls aren’t working.

Pro tip: A survey is one data source, not a full assessment. It only becomes defensible once the data is analysed, verified with workers, and control decisions are documented.

How do you conduct a psychosocial risk assessment step by step?

Psychosocial hazards are harder to identify than physical ones because they’re embedded in how work is organised, managed, and experienced. The complexity of psychosocial hazard interactions means that overlapping issues like role ambiguity and high workload multiply risk rather than simply adding to it. A single survey can’t capture that complexity. You need multiple data sources and a structured process.

Here’s a practical sequence for running your first psychosocial risk assessment:

1. Scope the assessment. Define the teams or roles involved, set a time frame, and assign a responsible person.
2. Collect data from multiple sources. Surveys, focus groups, interviews, incident reports, absenteeism records, and workers’ compensation data all add a piece of the picture.
3. Identify and document hazards. List each hazard, its source, affected workers, and frequency.
4. Rate each hazard using a risk matrix for likelihood and consequence.
5. Verify findings with workers. Best-practice assessments target strong survey response rates and treat verification as non-negotiable.
6. Select and implement controls, applying the hierarchy – redesigning a role outranks a resilience workshop.
7. Document everything, including scope, methods, consultation, ratings, and rationale. Senior management sign-off adds evidentiary weight.
8. Review regularly, and after any significant incident or change.

Pro tip**:** Involve frontline workers from the very start, not just as survey respondents but as active contributors to hazard identification. Workers who help shape the assessment are far more likely to support the controls that come out of it.

What are the most common pitfalls in workplace risk assessment?

Most risk assessment failures come down to a handful of predictable mistakes. Knowing them in advance saves you time, money, and regulatory exposure.

• Skipping verification. Without it, controls risk addressing the wrong problems.
• Treating the assessment as a one-off. A risk assessment filed away and never reviewed is a liability, not a compliance tool.
• Relying on a single data source. Incident records and consultation reveal hazards that surveys miss alone.
• Underestimating how hazards interact. Role ambiguity, high workload, and poor supervisor support together create a risk profile more serious than any one hazard alone.
• Insufficient worker consultation. Regulators expect genuine input, not a tick-box exercise.
• No documented process. Around one in three small businesses have none – a direct failure to meet the legal duty of care.

Pro tip: Could these records be handed to a regulator today to demonstrate hazards were identified, assessed, controlled, and consulted on? If not, that’s where to start.

How do you document a defensible risk assessment?

A defensible risk assessment includes clear records of scope, methods, consultation, hazards found, control rationale, residual risk, and senior management sign-off. Documentation isn’t bureaucracy. It’s the evidence that proves you met your legal obligations.

Regulators expect documented hierarchy of controls decisions, including your rationale for why elimination wasn’t practicable and why you chose a particular control instead. That reasoning must be recorded, not just implied.

A risk register is the central document for capturing and maintaining this evidence. Use it as a living record that you update as controls are implemented, reviewed, and revised.

Digital records with timestamps add evidentiary value by showing when assessments were conducted and when controls were updated. Senior management sign-off on the completed assessment demonstrates organisational accountability.

Key takeaways

A workplace risk assessment is only defensible when it covers both physical and psychosocial hazards, follows the identify-assess-control-review cycle, and is backed by documented evidence of genuine worker consultation.

• Mental and physical hazards both have equal legal weight.
• Use the framework: identify, assess, control and review.
• Verification is non-negotiable.
• Rationale must be documented.
• Review is ongoing.

Citation Group’s perspective on psychosocial risk

The confidence gap between physical and psychosocial risk management is the most consistent pattern we see across Australian businesses. Leaders with strong physical safety programmes often assume an annual engagement survey covers their psychosocial obligations. It doesn’t.

The businesses doing this well treat psychosocial risk as a work systems problem, not a people problem – looking at how work is designed and decisions are made, rather than simply asking workers how they feel. Surveys give breadth, interviews give depth, and incident records give history; all three build an accurate picture. The best organisations also involve frontline workers early, as genuine contributors to hazard identification, not just respondents.

How Citation Safety can support your risk assessment process

Citation Safety, part of Citation Group, works with businesses across all industries, including construction, aged care, allied health, and professional services, to build risk assessment programmes that hold up under regulatory scrutiny. Whether starting from scratch on a first psychosocial risk assessment or strengthening an existing physical safety programme, Citation Safety provides the guidance, tools, and documentation support to get it right.

FAQ’s