Making Psychosocial Risk Manageable

A practical, scenario-based guide to psychosocial risk management 

Dr. Georgi Toma  |  Director, HeartBrain Works  |  Honorary Research Fellow, University of Auckland 

Introduction 

Psychosocial risk management can feel overwhelming. With growing regulatory pressure, increasing workers’ compensation claims, and the sheer complexity of workplace mental health, many WHS professionals struggle to know where to begin or how to move beyond a generic risk assessment and an EAP poster in the tearoom. 

But it doesn’t have to be this way. Psychosocial risk management, at its core, follows the same principles as any other area of workplace health and safety: identify the hazards, assess the risks, implement controls, and monitor their effectiveness. The challenge lies not in the framework itself, but in the practical application, navigating organisational politics, securing buy-in, choosing the right tools, and translating findings into meaningful action. 

This article is based on an interactive webinar delivered to over 200 health and safety professionals through the Healthy Work Community of Practice in February 2026. Rather than presenting psychosocial risk management as an abstract concept, the session used a realistic, scenario-based approach to walk participants through the process step by step, from first identifying the problems to mapping controls on the hierarchy of controls. 

What follows is a comprehensive guide drawn from that session. Whether you are a WHS/HR professional tackling psychosocial risk for the first time or an experienced practitioner looking to sharpen your approach, this article will help you make psychosocial risk management systematic, achievable, and effective. 

The Scenario: Z Correctional Centre 

To ground this discussion in reality, we use a fictional scenario inspired from real events. It includes patterns commonly observed across high-risk industries such as : correctional facilities, emergency services, healthcare, and other sectors where exposure to trauma, understaffing, and cultural challenges are prevalent. 

Z Correctional Centre is a medium-security facility in regional Western Australia, housing approximately 500 inmates and employing 210 correctional officers plus 60 administrative and support staff. The facility is managed by a state government department. 

The centre has faced chronic understaffing for over two years, with a vacancy rate of approximately 22% for custodial officers. Remaining officers are regularly required to work double shifts and mandatory overtime, sometimes with fewer than 12 hours between shifts. New recruits receive a shortened induction program (reduced from 12 weeks to 6 weeks) before being deployed on the floor. 

18 months ago, a serious assault incident occurred in which a correctional officer was attacked by an inmate and sustained significant physical injuries. Several colleagues witnessed the assault. The officer returned to work after 10 weeks of leave but was placed back into the same unit where the incident occurred, with no phased return-to-work plan and no updated risk assessment. 

A female officer has lodged a formal sexual harassment complaint alleging sustained harassment by a senior supervisor over eight months. When she raised the issue informally, she was told the behaviour was “just how he is” and to “not make a fuss.” She is now on extended personal leave. 

Workers’ compensation claims for PTSD, anxiety, and depression have increased by 85% over two years. Sick leave usage is 40% above the departmental average. Anecdotal reports suggest some officers are self-medicating with alcohol. 

The facility’s culture has been described as “hypermasculine,” “punitive,” and “us versus them.” Officers report that seeking mental health support is viewed as a sign of weakness. The sexual harassment complaint is the third about the same supervisor in two years. Previous complaints were either not investigated or resulted in no action. 

If elements of this scenario feel familiar, and for many WHS professionals, they will, that is precisely the point. These are not unusual circumstances. They are the everyday realities of workplaces where psychosocial risks have been allowed to accumulate without systematic management. 

What Would You Do? Prioritising Action 

Imagine you have been appointed as the new WHS Manager at Z Correctional Centre. Your predecessor left three months ago, and the role was vacant for six months before that. You’ve inherited a filing cabinet with a two-year-old generic psychosocial risk assessment, an EAP poster in the tearoom, a growing stack of workers’ compensation claims, and one part-time WHS admin officer who mostly deals with those claims.  

Where do you start?  

The key is to think in terms of three time horizons: immediate actions, short-term actions, and medium-to-longer-term actions. 

Immediate Actions 

When there are multiple fires burning, the first step is to address the most acute safety risks. In this scenario, several situations demand urgent attention. 

Address the sexual harassment complaint. Immediately separate the supervisor who is the subject of the complaint from the complainant and any other workers who may be at risk. Implement interim controls pending a formal investigation. Given that this is the third complaint about the same supervisor in two years, the urgency cannot be overstated, both from a duty-of-care and regulatory compliance perspective. 

Support the trauma-affected officers. Ensure that the officers affected by the assault incident, the officer who was attacked and the colleagues who witnessed it, receive immediate access to trauma-informed psychological support. The fact that the assaulted officer has been re-diagnosed with PTSD after being placed back in the same unit without a phased return plan represents a serious systemic failing. 

Review fatigue risks. Assess current shift patterns and mandatory overtime arrangements against fatigue risk management standards. Where shifts are occurring with fewer than 12 hours between them, implement emergency limits. Fatigue in a high-risk environment like a correctional facility is not merely an occupational health concern, it is a safety-critical risk for both officers and inmates. 

Brief the leadership and legal teams. Immediately flag the severity of the situation to the executive leadership and legal teams. Present the current regulatory framework, including the relevant code of practice for managing psychosocial hazards at work. Frame the situation in terms of organisational risk, not just employee wellbeing. This is a WHS compliance issue, and leadership needs to understand the exposure. 

Short-Term Actions 

Conduct or commission a psychosocial risk assessment. A comprehensive, independent psychosocial risk assessment of the entire facility is essential. This should include confidential worker consultation through surveys, interviews, and focus groups. Given the small WHS team, there is a strong case for commissioning external support and building that business case for leadership is part of the work.  

Initiate a formal investigation. Engage an independent investigator for the sexual harassment complaint and prior related complaints. The investigation must be timely, unbiased, and trauma-informed, with both parties kept appropriately informed throughout. 

Develop a critical incident response protocol. The current facility clearly lacks a structured response for critical incidents. Given the nature of the work, where violence and aggression from inmates are foreseeable risks, a robust protocol is essential. This should include mandatory psychological first aid, structured debriefing, and scheduled follow-up care. 

Overhaul the return-to-work process. The current process failed the officer who returned to the same unit without any phased return plan, risk assessment, or ongoing support. A safe return-to-work process must include a psychosocial risk assessment of the work environment, phased duties, and the option to return to a different unit if necessary. 

Medium-to-Longer-Term Actions 

Address the staffing crisis as a WHS issue. The 22% vacancy rate is not merely an HR problem, it is a primary psychosocial risk driver. Advocate for accelerated recruitment and build the business case for filling vacancies as a critical risk control. Understaffing is directly linked to fatigue, excessive workload, reduced autonomy, and diminished capacity to manage incidents safely. 

Drive workplace culture change. Enlist HR to implement a workplace culture change program that targets the stigma around mental health help-seeking, with visible and sustained leadership commitment. In an environment with routine exposure to trauma, a culture that discourages help-seeking is not just unhelpful, it is dangerous. 

Restore and enhance the induction program. Review the shortened induction and advocate for restoring it to its original length, supplemented with enhanced psychological preparation content. New recruits need to understand the psychosocial demands of the role, recognise signs of psychological distress in themselves and colleagues, and know how to access support without stigma. Culture change begins with the people who walk through the door. 

The Six-Stage Psychosocial Risk Management Process 

When we examine the risk management cycle, established frameworks such as ISO 45003’s Plan-Do-Check-Act cycle (2021) and Safe Work Australia’s Model Code of Practice (2022) provide a four-step structure. However, practical experience suggests that two additional stages deserve explicit attention, not because they are new concepts, but because when they are not named specifically, their components tend to be missed. 

The six-stage process, drawn from Dr. Georgi Toma’s upcoming book Psychosocial Risk Management for a Healthier Workplace: A Practical Implementation Guide  (Routledge, 2026), is as follows: 

Stage 1: Prepare the risk assessment. This is the stage that is most often rushed or skipped entirely. Preparation involves defining your scope, assembling your team, assessing whether your team has the capability and resources to conduct the assessment, planning your consultation approach, securing organisational buy-in, and communicating the process to your workforce. Without adequate preparation, even the best assessment tools will underdeliver. 

Stage 2: Identify psychosocial hazards. Use a tool or process specifically designed for psychosocial risk. Many organisations still rely on engagement surveys, which are not appropriate instruments for conducting a risk assessment. A fit-for-purpose tool will capture the specific hazards relevant to your workplace context. 

Stage 3: Assess which hazards are risks. This is where the legislation directs us to consider likelihood of harm, severity, and exposure. However, effective risk assessment also requires consideration of protective factors, how hazards interact with one another, and what existing controls are already in place. This stage, the accurate prioritisation of risks, is where many assessments fall short. 

Stage 4: Identify appropriate control measures. Determine the most effective actions to eliminate or minimise risks, using the hierarchy of controls and drawing on evidence about what works. Most jurisdictions now require the use of the hierarchy of controls, with a clear expectation that organisations consider higher-level controls before defaulting to individual-level interventions. 

Stage 5: Report findings and implement controls. This is critically important and frequently neglected. If an organisation conducts a risk assessment but fails to communicate the findings and follow up with action, workers will perceive that nothing has changed. The next time a risk assessment is conducted, response rates will be lower and trust will be further eroded—even if genuine progress has been made behind the scenes. Closing the loop with your workforce is essential. 

Stage 6: Monitor, review, and improve. The final stage involves monitoring the effectiveness of the controls you have implemented. This is the stage most commonly neglected, often because other priorities arise and resources are limited. But without ongoing monitoring, organisations cannot know whether their interventions are working—or whether new risks have emerged. 

Getting Buy-In: Three Audiences, Three Approaches 

One of the most common barriers in psychosocial risk management is securing organisational buy-in. The critical insight is that you are not speaking to a single, monolithic audience. You have three distinct groups, each with different needs, concerns, and motivations, and each requires a different communication approach. 

What Executives Need 

Connect to existing priorities. Executive leaders have their own vision, strategy, and agenda. Rather than presenting psychosocial risk management as an additional burden, connect it to what already matters to them. People are the enablers of every organisational priority. If the workforce is not well, those priorities will not be achieved. This is a language shift, and language matters. 

Avoid the “wellness trap.” Presenting a psychosocial risk assessment as a wellness initiative is a strategic error. Yes, effective psychosocial risk management contributes to employee wellbeing, but framing it as wellness makes it discretionary. Wellness initiatives are easily cut when budgets are tight. Risk, on the other hand, is always a strategic priority. Frame psychosocial risk management for what it is: a risk and compliance issue under WHS legislation. 

Use their language. Most executive leaders do not know—and do not need to know—the technical details of psychosocial risk. Use the language of business risk, operational impact, and regulatory exposure. You may not even need to use the phrase “psychosocial risk” at all. Speak their language, and they will listen. 

What Middle Managers Need 

The translation layer. If you approach middle managers with “here’s new training” or “here are new regulations,” the likely response is resistance: another WHS initiative, another requirement, on top of everything else. The key is translating the message into something that serves their interests. If they can spot and address problems before they escalate, they will experience fewer team issues, less absence, fewer complaints, and ultimately less work on their plate. 

The frozen middle. In many organisations, there is a cohort of middle managers who have been through multiple culture surveys, change initiatives, and engagement programs, and have become deeply jaded because nothing ever changes. They are “frozen” and conventional approaches will not move them. Engaging this group requires demonstrating how psychosocial risk management translates into practical, tangible results, not more talk, but genuine systemic change. Executive sponsorship is essential here; without it, the frozen middle will remain frozen. 

Job resources. This is chronically understated. Managers are often overworked themselves, and their capacity, whether in time, cognitive bandwidth, or emotional energy, to take on one more thing is genuinely limited. They must be part of your risk assessment. Pay special attention to their job demands and advocate for the resources they need. Let them know that this process is for them as well, not just something they are expected to impose on their teams. 

What Staff Need 

Genuine consultation. Staff need to feel that the consultation process is authentic: that their input genuinely matters, that what they share will have no adverse repercussions on their employment or career, and that their voices will actually be heard. Tokenistic consultation is worse than no consultation at all, because it breeds cynicism. 

Closing the loop. This means reporting the findings from the risk assessment and providing regular updates on what is being done to address those findings. Invariably, this is where organisations fail. Even when meaningful action is being taken, if workers are not informed, they will conclude that nothing has changed and the opportunity to build trust will be lost. 

Identifying Psychosocial Hazards: What to Look For 

Returning to our scenario, a systematic review reveals a cluster of interacting psychosocial hazards, none of which exist in isolation. Understanding how these hazards compound one another is essential to accurate risk assessment. 

Exposure to traumatic events and material. Correctional officers are routinely exposed to violence, self-harm by inmates, and high-threat environments. The serious assault incident and its inadequate aftermath are a clear example of this hazard in action. 

High job demands and low job control. Chronic understaffing at a 22% vacancy rate means remaining officers absorb unsustainable workloads. Mandatory overtime and double shifts with fewer than 12 hours between them leave workers with little control over their working conditions, a combination that research consistently identifies as a primary driver of psychological harm. 

Fatigue. Insufficient recovery time between shifts creates extreme fatigue, which compounds every other risk. In a high-threat environment, fatigue is not just an occupational health issue, it is a safety-critical concern. 

Sexual harassment. Sustained harassment over eight months, compounded by a dismissive organisational response, represents a severe psychosocial hazard. The fact that this is the third complaint about the same supervisor makes this a systemic failure, not an isolated incident. 

Poor organisational justice. Three complaints about the same supervisor in two years with no meaningful action taken. This erodes trust in the organisation’s willingness and ability to keep workers safe. Perceived injustice is one of the most corrosive psychosocial hazards because it undermines the foundation of the employment relationship. 

Poor support. No formal debriefing or psychological support after a critical incident. Return to the same unit with no phased plan, no updated risk assessment, and no support. These are not oversights, they are systemic failings in the organisation’s support structures. 

Harmful workplace culture. A hypermasculine, punitive culture that stigmatises help-seeking behaviour. This is especially dangerous in a context where workers are already exposed to trauma and high workload. When the culture itself acts as a barrier to accessing support, the available resources become functionally unavailable. 

Inadequate training and preparation. A halved induction program means new recruits are likely underprepared for the psychological demands of the role. They enter an environment riddled with psychosocial hazards without the tools or knowledge to recognise and manage the impact on their own wellbeing. 

The “Trinity of Risk”: When you have exposure to traumatic events, combined with high job demands and low job control, you already have a very serious risk profile. Add poor support and a culture that discourages help-seeking, and you are stripping workers of their coping resources in an environment that is already psychologically dangerous. This pattern mirrors the findings in landmark cases such as Kozarov v Victoria, where the High Court examined the cumulative impact of psychosocial hazards on a prosecutor who developed PTSD and major depressive disorder. 

It is worth noting a common error: identifying outcomes such as anxiety, depression, or burnout as psychosocial hazards. These are not hazards: they are the consequences of frequent, prolonged, or intense exposure to psychosocial hazards. The distinction matters because effective risk management targets the hazards themselves, not merely their symptoms. 

Mapping Controls on the Hierarchy 

Most Australian jurisdictions now require the use of the hierarchy of controls when managing psychosocial risks. Two complementary frameworks are particularly useful. The first, developed by Health and Safety Government Lead in New Zealand, presents physical and psychosocial hierarchies side by side. The second, from WorkSafe Victoria (2025), provides a practical structure that maps well onto real-world psychosocial risk scenarios. Both emphasise that effective control requires a combination of measures at multiple levels, because psychosocial hazards interact and no single control will address the full risk profile. 

[insert image of 2 frameoworks from slides] 

Applying these frameworks to our scenario produces the following control mapping. 

Elimination 

Remove the source of harassment. Remove the supervisor who is the subject of multiple unresolved complaints from any supervisory role. Repeated, unaddressed harassment is a hazard that can be eliminated by removing the source. This is not a discretionary decision, it is a necessary control. 

Eliminate unsafe overtime practices. Eliminate mandatory overtime where it creates shifts with fewer than the minimum rest period. If staffing does not allow this, it must be escalated as a critical WHS risk requiring resourcing intervention. The hazard is the insufficient recovery time, and the control is to remove the conditions that create it. 

Substitution, Design, and Engineering Controls 

This is the level where we change the systems of work, the way work is designed, the management of work, and the work environment.  

Redesign post-incident support. Replace the ad-hoc, informal approach with a structured, evidence-based critical incident response framework. This should include psychological first aid and structured welfare checks at 24 hours, 72 hours, two weeks, and six weeks following a critical incident. 

Restore and enhance the induction program. Replace the shortened induction with the full-length program, supplemented with psychological resilience preparation, stress inoculation training, and realistic job previews. Workers need to understand the environment they are entering and the supports available to them. 

Redesign the return-to-work process. Design a safe process that includes a psychosocial risk assessment of the work environment, phased duties, and the option to return to a different unit if necessary. The current process failed the officer who was placed back in the same unit where the assault occurred. 

Redesign staffing models. Develop minimum safe staffing ratios that account for psychological safety, not just operational coverage. Advocate for the resourcing needed to address the 22% vacancy rate. The individual who was attacked was alone. Staffing design must prevent this. 

Implement peer support programs. Structured clinical supervision and peer support programs are powerful interventions, particularly in sectors with high exposure to trauma. Research in policing, emergency services, and healthcare consistently demonstrates their effectiveness. Peer supporters, colleagues who are trained and trusted, can also serve as agents of culture change, normalising help-seeking behaviour from within. 

Redesign the grievance process. Redesign the complaint process to include a mandatory WHS risk assessment at the point of lodgement, interim safety measures, and integration between HR and WHS functions. The current process, where three complaints about the same supervisor resulted in no action, is itself a psychosocial hazard. 

Administrative Controls 

Supervisor and manager training. Train all supervisors and managers on psychosocial hazard identification, trauma-informed management, appropriate responses to sexual harassment complaints, and their legal obligations under WHS legislation. 

Fatigue management policy. Create a policy with enforceable limits on consecutive shifts, mandatory rest periods, and overtime caps. Note that while the policy itself is an administrative control, the actions it mandates, such as eliminating unsafe shift patterns, operate at a higher level. The policy provides the framework; the system changes provide the actual risk reduction. 

Workplace culture strategy. Develop a formal strategy targeting the stigma around help-seeking, with visible leadership commitment. As with the fatigue policy, the strategy is administrative, but its implementation, through peer support programs, code of conduct reinforcement, and behavioural standards for supervisors, operates at higher levels of the hierarchy. 

Individual-Level Support (PPE Equivalent) 

These are the reactive, individual-focused controls. They are necessary but must never be the sole or primary response. 

Proactive psychological support. Provide confidential, proactive psychological support for all officers, not just reactive EAP. Consider embedding a psychologist on site or on regular rotation. Ensure the support is accessible, visible, and normalised. 

Trauma-focused therapy. Offer specialised, trauma-focused therapy and ongoing clinical support for the officers directly affected by the assault incident. 

Alcohol and substance support. Where officers are self-medicating with alcohol to manage stress, ensure that alcohol and substance support is available without stigma, without career consequences, and anonymously. This addresses an immediate welfare concern while the systemic controls take effect. 

Key principle: A single control will rarely be sufficient for psychosocial risks. Because hazards interact, you need a combination of controls operating at multiple levels of the hierarchy. A fatigue management policy (administrative) must be backed by actual changes to shift design (substitution/engineering). A culture change strategy (administrative) must be implemented through peer support programs (design) and leadership behaviour (systemic). The hierarchy is not a menu, it is a layered system. 

A Note on Risk Assessment Methodology 

A critical question for every WHS professional to ask is: Is my current methodology accurately assessing and prioritising my risks? 

This is not a theoretical question. The tools and methods used for psychosocial risk assessment directly determine the quality of the data, the accuracy of the risk prioritisation, and ultimately the effectiveness of the controls implemented in response. A tool that fails to assess how hazards interact, that does not measure protective factors, or that uses a simplistic risk matrix will produce results that may not reflect the true risk profile of the workplace. 

For Australian WHS professionals, there is also a practical consideration: the People at Work survey is being decommissioned. Organisations that have relied on this tool will need a strategy to replace it with an instrument that meets the evolving requirements of both the legislation and best-practice risk assessment methodology. 

Conclusion: From Overwhelm to Action 

Psychosocial risk management is not about doing everything at once. It is about thinking systematically, prioritising effectively, and building a process that is sustainable over time. The six-stage framework provides the structure. The hierarchy of controls provides the logic for designing interventions. And clear communication with the three key audiences: executives, middle managers, and staff, provides the organisational support needed to move from assessment to action. 

The scenario in this article is fictional, but the challenges it represents are real. Every element: the understaffing, the unresolved complaints, the inadequate post-incident response, the stigma around help-seeking, is drawn from patterns observed across Australian and New Zealand workplaces. The good news is that these are not intractable problems. They are manageable risks, and the tools to manage them are available. 

It is demanding work, but it is achievable and it is essential. If you need support, we are to help. Get in touch with us! 

Reference 

Toma, G. (2026). Psychosocial Risk Management for a Healthier Workplace: A Practical Implementation Guide. Routledge. 

About the Author 

Dr. Georgi Toma is the Director of HeartBrain Works and an Honorary Research Fellow at the University of Auckland. With over a decade of experience in psychosocial risk, occupational stress, and culture interventions, Georgi has supported high-profile clients including RMIT University, Uber, Hitachi Energy, Clough Group, MEC Mining, and Environment Canterbury to create mentally healthy workplaces. HeartBrain Works offers validated psychosocial risk audits, training for leaders and staff, and the scientifically validated Wellbeing Protocol. 

About the Healthy Work Community of Practice 

The Healthy Work Community of Practice is a professional community for health and safety professionals. Members access quarterly knowledge-sharing sessions, a psychosocial risk controls library, real-world case studies, regulatory alerts, practical toolkits, a job board, research summaries, and ongoing training and workshops. Intake opens three times per year. To learn more, visit heartbrainworks.org.