Building a Psychosocial Risk Register: What to Include and Why

A psychosocial risk register is the central document in your WHS compliance system, and usually one of the first things a regulator asks to see. This guide explains what goes in one, how to structure it, and how to keep it current.

What Is a Psychosocial Risk Register?

A psychosocial risk register is a structured document that records every psychosocial hazard identified in your workplace, the level of risk each one carries, the controls you have in place, and who is responsible for them.

It is the master record of your psychosocial risk management. Individual risk assessments go into depth on one hazard at a time. The register gives you, and any auditor or inspector, the whole picture in one place.

Why You Need One

Under the Model WHS Regulations, PCBUs must identify psychosocial hazards, assess the risks, implement controls and review those controls. A risk register is the practical tool that shows you have done all four.

Without one, you have no systematic way to:

• Track which hazards have been assessed and which haven't
• Show a regulator that your risk management is ongoing rather than a one-off
• Make sure controls are actually implemented and assigned to someone
• Spot patterns, such as the same hazard reappearing after incidents
• Show due diligence if a worker makes a compensation claim or lodges a complaint

What to Include in Your Risk Register

A well-structured psychosocial risk register records the following for each hazard:

1. Hazard ID and name

Give each hazard a unique reference number (for example, PSY-001, PSY-002) and a clear name taken from Safe Work Australia's list of recognised psychosocial hazards. This makes it easy to cross-reference with individual risk assessments and incident reports.

2. Description of the hazard

Briefly describe how the hazard shows up in your workplace, not just the general category. Rather than "high job demands", write "customer service team regularly unable to finish their workload within standard hours due to staffing levels". Specific descriptions make the register useful, not just compliant.

3. Who is affected

Note which workers, roles or teams are exposed. It might be the whole workforce or a specific group. Being specific helps you target controls and makes sure no group is missed.

4. Likelihood rating

Rate how likely it is that the hazard will cause harm, using a consistent scale. A simple three or five-point scale works well, for example Rare, Unlikely, Possible, Likely, Almost Certain. Base the rating on current conditions, not a best-case scenario.

5. Consequence rating

Rate how severe the harm could be, for example Insignificant, Minor, Moderate, Major, Severe. Consider the impact on the individual (psychological injury, time off work) and on the organisation (compensation claims, regulatory action).

6. Overall risk rating

Combine likelihood and consequence in a risk matrix to get an overall rating: Low, Medium, High or Critical. This sets the urgency and priority of your controls.

7. Existing controls

List the controls already in place for the hazard. Be honest and only record controls that are actually implemented and working, not ones that exist only on paper.

8. Additional controls required

Where existing controls don't reduce the risk to an acceptable level, record what else needs to happen. Use specific actions, not vague commitments like "improve communication".

9. Responsible person and due date

Assign each additional control to a named person with a specific completion date. Without clear ownership, actions don't get done. This is one of the most common gaps in registers that look complete at first glance.

10. Residual risk rating

Re-rate the risk assuming all planned controls are in place. This is the residual risk: what's left once everything has been done. Aim to bring it down to Low or Medium. If it stays High or Critical, you may need bigger structural changes.

11. Review date

Record when the hazard is next due for review. That should be at least annually, and also after incidents, complaints or significant organisational change.

How to Rate Your Risks

Risk rating doesn't need to be a complicated calculation. The standard WHS approach is a simple matrix:

1. Rate likelihood. How often are workers exposed to this hazard, and how likely is it to cause harm? Consider how often and how long people are exposed, and how many are affected.
2. Rate consequence. If harm occurs, how serious would it be? Consider the range of outcomes, from minor distress to serious psychological injury requiring extended leave.
3. Combine them. Use a risk matrix to combine the two ratings. Likely plus Major gives a High rating. Rare plus Minor gives a Low rating.
4. Prioritise your response. Critical and High risks need immediate action. Medium risks should be dealt with within a set timeframe. Low risks should be monitored and reviewed.

Recording Controls and Who Is Responsible

The controls section is where compliance systems most often fall down. Listing a control isn't enough. You need to record:

• What the control is, specifically. "Monthly workload review meetings with team leaders" is a control. "Improve workload management" is not.
• Who is responsible: a named person, not a job title or department.
• When it will be done: a specific date, not "ongoing" or "as required".
• Whether it's done: a status field (Not Started, In Progress, Complete) makes this visible at a glance.

Follow the hierarchy of controls where you can. Eliminating the hazard or redesigning the work is always better than relying on individual workers to manage their own stress.

Keeping Your Register Current

A register filled in twelve months ago and untouched since isn't a compliance system; it's a historical document. It needs to be kept up to date.

Review your risk register:

• At least annually, as a scheduled review of all hazards and controls
• After any incident or near miss, to see whether it needs updating
• When a worker raises a concern, so new information about a hazard is captured
• During significant organisational change. Restructures, new systems, leadership changes and rapid growth all bring new psychosocial risks.
• When a control is implemented, to update its status and re-rate the residual risk

Common Mistakes to Avoid

Listing hazards without assessing them

A list of hazards with no risk ratings, controls or responsible people isn't a risk register; it's a hazard inventory. The register has to show that you assessed each hazard and acted on it.

Recording controls that aren't actually in place

Only record controls that are genuinely implemented. Recording planned controls as existing ones gives a false picture of where you stand and does nothing to protect workers.

No named responsible person

Every additional control needs a named owner. "Management" or "HR" isn't a responsible person. If nobody is accountable, nothing gets done.

Never reviewing or updating the register

A register that never changes tells an inspector you treat risk management as a one-off. Date every review and note what you considered, even if the outcome was "no changes required".

Not consulting workers

WHS law requires you to consult workers as part of risk management. A register built entirely by management is legally incomplete and less accurate, because workers know best what hazards they actually face.

Frequently Asked Questions

Does a risk register need to be a specific format?

No. WHS law doesn't prescribe a format. What matters is that it records the required information (identified hazards, risk ratings, controls, responsible people and review dates) in a consistent, accessible way. A well-structured spreadsheet or Word document is perfectly acceptable.

Can one register cover all WHS risks, including physical hazards?

Yes. Many organisations keep a single WHS risk register covering both physical and psychosocial hazards. If you already have a physical hazard register, adding a psychosocial section is a practical approach. Just make sure the psychosocial entries include the extra fields relevant to psychological risks.

How long should I keep old versions of the register?

Good practice is to keep previous versions for at least five years, or longer if your jurisdiction requires it. A dated version history shows your risk management has been ongoing and that you've responded to change over time. That can be important evidence in a compensation claim or regulatory investigation.

Who should have access to the risk register?

At a minimum, the person responsible for WHS and any managers with assigned controls. Workers should be able to see it too. Being open about identified hazards and planned controls fits with your consultation obligations and builds trust in the system.

Disclaimer: This article is general information only and is not legal or professional WHS advice. Check it against the legislation in your state or territory and get expert advice where needed.