How to Conduct a Psychosocial Risk Assessment (Step-by-Step)

Under Australian WHS law, identifying psychosocial hazards is only the first step. Once you know which hazards exist in your workplace, you are legally required to assess the risk they create and put controls in place to manage them.

A psychosocial risk assessment is how you do that. This guide walks through each step, explains what to document, and shows how a risk assessment becomes the backbone of a defensible, WHS-compliant system for your business.

What Is a Psychosocial Risk Assessment?

A psychosocial risk assessment is a structured evaluation of the risks created by psychosocial hazards in your workplace. For each identified hazard, it works out:

• How likely is it that the hazard will cause harm?
• How severe would that harm be?
• What controls are already in place, and are they adequate?
• What additional controls are needed?

The result is a completed assessment for each hazard. That feeds into your risk register and shapes your control measures, training and review schedule.

If you haven't completed the hazard identification step yet, start there. Our guide to identifying psychosocial hazards walks you through it.

Before You Start: What You Need

Before you begin, gather:

• The list of psychosocial hazards from your hazard identification process
• Input from workers and supervisors who know the relevant work areas
• Any incident reports, near misses or complaints related to those hazards
• A psychosocial risk assessment template that captures all the information you need

Step-by-Step: How to Complete a Psychosocial Risk Assessment

Step 1: Describe the hazard and work context

For each hazard, describe what it is and the specific work context where it occurs. Be specific. Rather than "high workload", write "high workload in the customer service team during peak periods, with inadequate staffing and no clear escalation process". The more specific the description, the more effective the controls you choose. Vague descriptions lead to vague controls.

Step 2: Determine your initial risk rating

Rate the risk using a likelihood and consequence matrix. Most WHS frameworks use two dimensions:

• Likelihood: how probable is it that the hazard will cause harm? (Rare, Unlikely, Possible, Likely, Almost Certain)
• Consequence: if harm occurs, how severe would it be? (Insignificant, Minor, Moderate, Major, Catastrophic)

Where the two ratings meet gives you a risk level: Low, Medium, High or Critical. Critical and High risks need immediate action, Medium risks need a scheduled response, and Low risks need monitoring.

Step 3: Identify existing controls

Record the controls you already have for this hazard. These might include policies, procedures, training, and practical arrangements such as regular team check-ins or workload reviews. Be honest here: a policy that staff don't know about is not an effective control.

Step 4: Assess whether controls are adequate

Check whether your existing controls are actually reducing the risk to an acceptable level. Are workers aware of the control? Is it applied consistently? Has the risk stayed the same or got worse despite it? Under WHS law, controls must be reasonably practicable, meaning the most effective control that is proportionate to the risk.

Step 5: Identify additional controls

If existing controls aren't adequate, decide what additional controls you will put in place. Use the hierarchy of controls as a guide:

1. Eliminate: redesign the work so the hazard no longer exists
2. Substitute: replace a hazardous work arrangement with a less hazardous one
3. Redesign: change the work environment or systems
4. Administrative controls: policies, procedures and training that reduce exposure

Administrative controls on their own are generally not enough for High or Critical risks.

Step 6: Assign responsibility and a due date

Give each additional control a responsible person and a realistic completion date. Without clear ownership and deadlines, controls that look good on paper don't get done. This information goes straight into your risk register, which is usually the first document an inspector asks to see.

What Is a Residual Risk Rating?

Once you've identified additional controls, re-rate the risk as if those controls are in place. This is the residual risk: the level of risk left after all controls are implemented.

The aim is to reduce residual risk to as low as reasonably practicable. For most small and medium businesses, that means reaching a Low or Medium residual rating with appropriate controls in place.

If the residual risk is still High or Critical with every planned control in place, that's a sign you may need bigger changes to work design or structure.

How to Document Your Risk Assessment

Your completed risk assessments should be:

• Kept in a consistent format, ideally a standard template that captures every required field
• Dated and signed by the person who completed them
• Accessible to the workers and supervisors who need them
• Reviewed and updated after incidents, complaints or significant organisational change

Common Mistakes to Avoid

• Assessing risks without consulting workers. It's poor practice and doesn't meet WHS consultation requirements.
• Rating every hazard as Low without real analysis. It offers no protection and won't stand up if challenged.
• Counting controls that exist on paper but aren't actually in use. Only count controls that are genuinely in place.
• Completing the assessment once and never reviewing it. Review at least annually and after any significant event.
• Treating it as a tick-box exercise. The value is in the process, not the paperwork.

Frequently Asked Questions

How often should a psychosocial risk assessment be reviewed?

At least annually. You should also review it after any psychosocial incident or complaint, after significant organisational change such as a restructure, redundancies or new management, and whenever a control appears not to be working. An audit and review checklist helps make sure this happens.

Who should conduct a psychosocial risk assessment?

In most small and medium businesses, the business owner, HR manager or WHS officer completes the risk assessment, ideally with input from supervisors and workers in the relevant area. You don't need to be a WHS specialist, but you do need a structured template, a clear process and genuine input from the people doing the work.

What is the difference between a psychosocial risk assessment and a general WHS risk assessment?

A general WHS risk assessment covers physical hazards such as slips, trips, equipment and chemicals. A psychosocial risk assessment focuses on work-related psychological hazards such as workload, conflict, aggression and job control. The method (likelihood and consequence, hierarchy of controls) is the same; only the subject matter is different. Most businesses need both.

Do I need a consultant to conduct a psychosocial risk assessment?

No. A WHS consultant can help in complex or high-risk workplaces, but most Australian small and medium businesses can do a psychosocial risk assessment in-house. Use a standardised, WHS-aligned template, consult genuinely with your workers and document your process clearly.

What happens if I don't complete a psychosocial risk assessment?

Not assessing psychosocial risks is a breach of your WHS obligations. If a psychological injury occurs and you can't show that you identified and assessed the relevant hazards, you are exposed to improvement notices, fines and, in serious cases, prosecution. More importantly, the risk assessment is your best tool for preventing harm in the first place.

Disclaimer: This article is general information only and is not legal or professional WHS advice. Check it against the legislation in your state or territory and get expert advice where needed.