Employer Obligations: Managing Psychosocial Hazards in Victoria

Every Victorian employer has a legal duty to eliminate or reduce psychosocial risks in their workplace so far as is reasonably practicable. This is not a guideline or a best-practice recommendation it is a requirement under the Occupational Health and Safety Act 2004 (Vic), reinforced by specific psychosocial hazard provisions in the OHS Regulations that took effect in December 2025.

What the Victorian OHS Regulations Require

The OHS Regulations now explicitly require employers to identify psychosocial hazards, assess the risks associated with those hazards, implement control measures using the hierarchy of controls, and review those controls for effectiveness. This mirrors the approach employers are already required to take for physical hazards. The difference is that many employers are less experienced at applying this framework to psychological risks.

The Compliance Code for Psychosocial Hazards, published by WorkSafe Victoria, provides practical guidance on how to meet these obligations. While a compliance code is not mandatory in itself, it is admissible in court proceedings. If you follow the compliance code and something goes wrong, you have a strong defence. If you don't follow it and something goes wrong, you'll need to demonstrate that whatever you did instead was equally effective.

The 16 Psychosocial Hazard Categories

WorkSafe Victoria identifies 16 categories of psychosocial hazards that employers must consider. These are not exhaustive, but they cover the most common workplace sources of psychological harm:

High job demands — workloads, time pressure, or emotional demands that exceed a worker's capacity.

Low job control — workers having little say over how, when, or where they do their work.

Poor support — inadequate training, supervision, or access to resources.

Low role clarity — unclear expectations, conflicting instructions, or undefined responsibilities.

Poor organisational change management — restructures, redundancies, or process changes handled without adequate communication or consultation.

Low recognition and reward — effort going unacknowledged or undervalued.

Poor organisational justice — inconsistent application of policies, favouritism, or unfair processes.

Traumatic events or material — exposure to death, serious injury, violence, or other distressing incidents.

Remote or isolated work — working alone or in locations without access to support.

Poor physical environment — noise, temperature, lighting, or workspace conditions that affect wellbeing.

Violence and aggression — physical or verbal threats from colleagues, clients, or members of the public.

Bullying — repeated unreasonable behaviour directed at a worker that creates a risk to health and safety.

Harassment - unwelcome conduct that a reasonable person would consider offensive, humiliating, or intimidating.

Sexual harassment — unwelcome conduct of a sexual nature that would be considered offensive, humiliating or intimidating.

Conflict or poor workplace relationships — unresolved interpersonal tension that has escalated beyond normal disagreement.

Gendered Violence – behaviour directed at, or affecting a person because of their: sex, sexual orientation, gender or gender identity.

Other jurisdictions also recognise fatigue, intrusive surveillance and domestic violence at work.

The Four-Step Risk Management Process

Step 1 — Identify the hazards. This means actively looking for psychosocial hazards in your workplace, not waiting for a complaint. Methods include worker consultation, surveys, reviewing incident and complaint data, analysing absenteeism and turnover patterns, and examining work design. Workers must be consulted as this is a legal requirement under the OHS Act.

Step 2 — Assess the risks. Once hazards are identified, assess the level of risk by considering how severe the potential harm could be, how likely it is, how many workers are exposed, and how long they're exposed for. Some hazards interact, for example, high job demands combined with low job control and poor support creates a significantly higher risk than any one of those hazards alone.

Step 3 — Control the risks. Apply the hierarchy of controls: eliminate the hazard if possible, substitute it with something less risky, isolate people from it, use engineering or administrative controls, or as a last resort, provide personal protective measures. For psychosocial hazards, this translates to redesigning work (elimination), changing processes or rosters (substitution), adjusting team structures (isolation), updating policies and training managers (administrative controls), and providing employee assistance programs (personal measures). Higher-order controls that change the work itself rather than asking workers to cope, are always preferred.

Step 4 — Review. Controls must be reviewed regularly and whenever there's a change in the workplace, a new incident, or new information about a hazard. A control that was effective six months ago may not be effective now if the workplace has changed.

What 'Reasonably Practicable' Actually Means

This is the phrase that trips up most employers. It does not mean you must eliminate every possible risk. It means you must do what a reasonable person in your position would do, taking into account the likelihood of the hazard causing harm, the degree of harm that could result, what the employer knew or ought to have known about the hazard, the availability and suitability of ways to eliminate or reduce the risk, and the cost of those measures (but only after considering the first four factors as cost alone is rarely a sufficient reason for inaction).

In practice, WorkSafe inspectors assess reasonably practicable by looking at what the employer actually did, what they could have done, and why they didn't do it. If there was an obvious, affordable control that would have reduced the risk and the employer didn't implement it, that's a problem.

What Happens If You Don't Comply

WorkSafe Victoria has a range of enforcement tools. These include improvement notices (requiring you to fix a specific problem within a set timeframe), prohibition notices (requiring you to stop an activity that poses an immediate risk), enforceable undertakings (legally binding agreements to take specific corrective action), and prosecutions under the OHS Act, which can result in substantial fines for both the organisation and individual officers.

How Victoria's Approach Differs from Other States

While every Australian state and territory now has obligations relating to psychosocial hazards, the specifics differ. Victoria's approach sits within the OHS Act 2004 and its regulations, whereas states operating under the model Work Health and Safety Act have adopted specific psychosocial regulations under that framework. The principles are broadly consistent, identify, assess, control, review but the legislative references, compliance codes, and enforcement approaches vary. If your organisation operates across state borders, you need to understand the obligations in each jurisdiction.

Frequently Asked Questions

Do these obligations apply to small businesses?

Yes. The OHS Act applies to all employers in Victoria, regardless of size. The scale of what's reasonably practicable will differ. A five-person business isn't expected to have the same systems as a 500-person organisation but the duty itself is the same. Small businesses should start with worker consultation, identify the most significant hazards in their workplace, and put proportionate controls in place.

What if we already have a mental health program, is that enough?

Not on its own. Employee assistance programs and mental health awareness training are personal-level controls so they sit at the bottom of the hierarchy. They're useful, but they don't address the hazards themselves. WorkSafe expects employers to start with higher-order controls that change the conditions creating the risk, not just support workers in coping with them.

How often should we review our psychosocial risk controls?

At minimum, review annually. But you should also review whenever there's a significant workplace change (restructure, new systems, leadership change), after a psychosocial incident or complaint, when new information about a hazard becomes available, or when worker consultation reveals that existing controls aren't working.

Can we be prosecuted for a psychosocial hazard even if nobody has been injured?

Yes. The OHS Act creates duties to prevent exposure to risks, not just to prevent injury. If WorkSafe identifies a psychosocial hazard that the employer has failed to manage, enforcement action can follow regardless of whether a specific worker has been harmed.

If you're unsure whether your organisation is meeting its obligations, contact Clear Boundaries for a confidential assessment. We can help you identify gaps and build a defensible framework before a complaint or an inspector visit forces the issue.