Best Practice in Psychosocial Hazards Identification and Management

A practical framework for WHS and HR professionals navigating the complexity of psychosocial risk.

Dr. Georgi Toma | Director, HeartBrain Works | Honorary Research Fellow, University of Auckland

Introduction

Psychosocial hazards are now firmly on the radar of Australian and New Zealand organisations — driven by evolving legislation, increasing workers' compensation claims, and a growing body of research linking workplace conditions to psychological injury. But awareness alone is not enough. The question that most WHS and HR professionals are grappling with is not whether they need to act, but how to do so in a way that is rigorous, defensible, and genuinely effective.

This article is drawn from a professional development webinar delivered as part of HeartBrain Works' monthly series. It covers what psychosocial hazards are and how they cause harm, a practical framework for identifying and managing them, and five principles that distinguish best practice from a box-ticking exercise. A real-world case study illustrates what this approach looks like in action.

Understanding Psychosocial Hazards: The Basics

Psychosocial hazards are aspects of work that carry the potential for psychological harm. They arise from four main areas: the design and management of work, the work environment, workplace interactions and behaviours, and the physical plant — the systems and machinery through which work is done.

The vehicle for harm is stress — specifically, chronic stress activation. When an aspect of work is stressful, and that exposure is frequent, prolonged, or severe, it creates the conditions for psychological and physical injury. The connection between chronic stress and physical illness is now well established; cardiovascular disease and musculoskeletal disorders, for example, often have chronic stress as an underlying cause. This is why the duty of care imposed by WHS legislation is not simply about preventing obvious accidents. It is about creating an environment where the majority of people can operate without sustained harm to their health.

It is worth noting that stress is not inherently negative. Human beings require a degree of challenge and stimulation to grow, stay engaged, and perform well. A workplace with no demands is not a healthy workplace. The aim is balance — a reasonable alignment between job demands and job resources — and it is when that balance is persistently and significantly disrupted that hazards become risks.

When Hazards Become Risks

The distinction between a hazard and a risk is critical and often misunderstood. A hazard is any aspect of work with the potential for harm. A risk is what that hazard becomes when the exposure is frequent enough, prolonged enough, or intense enough that harm becomes likely. Consider a team that has been chronically understaffed for an extended period. The heavy workload they carry is a hazard. Whether that hazard constitutes a risk for particular individuals — and to what degree — depends on a further set of factors.

One of those factors is what is happening in a person's private life, which can reduce their capacity to cope with stressors they might otherwise manage. Organisations cannot fully foresee or control this. But the other major factor is the presence or absence of protective factors — and these are very much within an organisation's influence.

Protective factors are aspects of work that buffer the harmful effects of psychosocial hazards. Research consistently shows that where supervisor support is strong and workers have meaningful autonomy over their work, people can sustain heavy workloads for extended periods without suffering psychological injury. Other common protective factors include positive work relationships, a healthy organisational culture, opportunities for professional development, and high organisational trust.

A critical point here: these factors are not always protective. Support from a direct line manager, for instance, is a protective factor in a healthy team — but if that relationship is unhealthy or abusive, low supervisor support becomes a significant hazard in its own right. This is why best practice requires measurement, not assumption. You need data that tells you whether a particular factor in your organisation is operating positively or negatively — not simply a checklist of things that tend to be protective.

A Framework for Identification and Management

A simplified, practical framework for psychosocial risk management moves through four connected stages: raising awareness, consulting, controlling risks, and monitoring. These stages are not a linear sequence to be completed once. They form a continuous cycle, embedded in the ongoing life of the organisation — much like a sales process or a customer lifecycle management process. You will enter the cycle at different points as new issues emerge, as the organisation changes, and as your assessment of risks evolves over time.

Stage One: Raise Awareness

Before any formal identification process begins, it is essential to ensure that the right people understand what psychosocial hazards are, why they matter, and what their responsibilities are. This means different things for different audiences.

Boards and executive leaders need to understand that they carry legal liability for psychosocial risk, just as they do for physical safety. They need to be familiar with what the legislation requires and what the consequences of non-compliance look like — both in terms of regulatory exposure and organisational cost. Managers need to understand that they play a frontline role in identifying hazards, responding to concerns, and putting controls in place. Staff — including contractors, part-time workers, and volunteers — need to understand what psychosocial hazards are, what their own responsibilities are, and how to report concerns.

This step is frequently skipped or compressed, with organisations jumping straight into surveys or focus groups before the groundwork has been laid. That is a mistake. Without adequate awareness, even the best assessment tools will underdeliver.

Stage Two: Consult

Effective consultation requires both quantitative and qualitative data, and it is here that many organisations fall short by relying on only one or the other.

Focus groups and interviews provide rich qualitative information — the texture and context that numbers alone cannot capture. But they cover only a fraction of the workforce, and there is always a question of how representative those voices are. Quantitative surveys, on the other hand, can reach everyone, but not all surveys are constructed equally. A survey that produces individual graphs of separate hazards — showing, for example, that 70% of workers perceive high workload — does not tell you whether high workload is a risk. The answer to that question requires an analytical methodology that accounts for the interaction between hazards, the presence of protective factors, and the duration and intensity of exposure.

Existing organisational records are also a valuable source of information. Sick leave data — particularly patterns of short-duration absences — can be an early indicator that people are struggling with psychosocial hazards. Workers' compensation claims, incident and injury records, grievances, exit interview data, and EAP records all contribute to a more complete picture. The practical challenge is that this information is often held in disparate systems and requires significant data mining to make usable. But it is worth the effort.

One further consideration when designing your consultation approach: anonymity is not optional. When workers are asked about aspects of work as sensitive as psychosocial hazards, they will not answer honestly unless they are confident their responses cannot be traced back to them and will not affect their employment. For this reason, consultation managed by an external provider, using a genuinely anonymous process, consistently produces more accurate and candid data than internally managed surveys.

Stage Three: Control

Once hazards have been identified and risks established, the task is to design controls that are proportionate, evidence-based, and positioned at the right level of the hierarchy. Most jurisdictions now require the application of the hierarchy of controls to psychosocial risks — elimination first, followed by substitution and design controls, administrative controls, and finally individual-level support.

Elimination will not always be practicable for psychosocial hazards, but it should always be considered. Where it is not possible to fully eliminate a hazard, the goal is a combination of controls operating at multiple levels, because psychosocial hazards rarely act in isolation and no single control will address the full risk profile.

A point that deserves emphasis here is that the controls implemented must be tied to the root causes of the risks identified, not simply to the surface-level presenting problem. High workload is a common example. In practice, only a minority of cases where workers perceive high workload are actually caused by an excess of work relative to capacity. More frequently, the underlying causes include lack of role clarity leading to duplication of effort across teams, ineffective work systems, poor information sharing, or incivility that disrupts collaboration. The controls required for each of these underlying causes are quite different. An intervention that addresses the wrong root cause will not be effective — and the investment will be wasted.

Managers play a particularly significant role at this stage. When a regulator investigates — whether in response to a complaint or as part of a broader audit — they will examine documentation of how line managers identified hazards, what controls or accommodations were put in place, and how individual workers were supported. Many managers are not currently equipped to meet this standard, through no fault of their own; this is still relatively new territory, and the skills required are not yet widely taught. Investing in manager training is not a discretionary nicety. It is a legal and operational necessity.

Stage Four: Monitor

The final stage is ongoing monitoring of the effectiveness of controls and the emergence of new risks. This stage is the most commonly neglected, typically because other priorities arise and resources are limited. But without monitoring, organisations cannot know whether their interventions are working — or whether new hazards have developed since the last assessment.

Five Principles of Best Practice

1. Engage All Stakeholders

Executive commitment is not a prerequisite for good intentions — but it is a prerequisite for effective action. Without it, the controls that emerge from a risk assessment may be too limited to address root causes, and the resources required to implement them may not be forthcoming. Securing that commitment means speaking the language of business risk: showing what the data reveals, what the regulatory exposure is, and what the organisational cost of inaction looks like. Workers' compensation claim costs, sick leave rates, turnover, and delayed project delivery are all measurable consequences of unmanaged psychosocial risk — and they make a compelling case.

It is equally important not to overlook workers who fall outside the standard employment relationship. Contractors, part-time staff, and volunteers are also covered by the duty of care, and they are frequently absent from risk assessment processes.

2. Communicate Effectively

Before undertaking any identification or consultation process, communicate clearly to your people how the data will be collected, how anonymity will be protected, and what will happen with the findings. Workers who do not understand the purpose of a psychosocial risk assessment — or who are not confident their responses will be genuinely anonymous — will not give accurate answers. This communication should be tailored to each audience: the board and executive team need to understand their legal exposure; managers need to understand their role; staff need to understand the process and the protections in place.

Equally important is what happens after the assessment. Communicating findings back to the workforce — and providing regular updates on the actions being taken — is not optional. Organisations that conduct assessments and then fall silent will find that trust erodes and participation in future assessments declines. Closing the loop is as important as opening it.

3. Train Your Managers

Line managers are the organisation's first line of defence against psychosocial harm. They are the people most likely to observe early warning signs, most positioned to have direct conversations with team members, and most responsible for the day-to-day working conditions that either protect or erode psychological safety. Yet many managers are not equipped to do this — not because they lack the will, but because they lack the skills, the knowledge, and in many cases a clear understanding of what is actually required of them.

Effective manager training covers what psychosocial hazards are and how to recognise them, how to have meaningful regular conversations with team members that create space to surface concerns, how to document what they observe and what actions they take, and what their legal obligations are. Providing managers with practical tools — scripts, checklists, decision frameworks — transforms awareness into action.

4. Adopt a Data-Driven Approach

Good intentions and qualitative insight are not sufficient for defensible risk assessment. A rigorous, data-driven approach requires quantitative data that covers the full workforce, an analytical methodology capable of identifying which hazards constitute actual risks (rather than just listing them), breakdowns by department or team that show where attention is most urgently needed, and integration of qualitative data to provide context and depth. Organisations that rely on separate graphs of individual hazards, without a framework for interpreting what those hazards mean in combination, are not conducting a risk assessment — they are compiling a list.

5. Implement Evidence-Based Controls

Controls should be designed in direct response to the root causes identified in the assessment, guided by evidence of what actually works. This sounds obvious, but in practice it is frequently overlooked. The most common failure mode is implementing controls that address the visible symptom — high workload, for example — rather than the underlying cause. A staffing increase will not resolve high workload that is actually caused by role ambiguity and duplication. Process redesign will not help if the real issue is a breakdown in team collaboration. Evidence-based controls are specific, targeted, and tied to real causal pathways.

Case Study: A Government Sector Organisation

To illustrate how this framework operates in practice, consider an organisation in the government sector with over 1,000 employees that came to HeartBrain Works with a familiar cluster of presenting problems: anecdotal reports of high workload and burnout, elevated turnover and recruitment difficulties in certain areas, high rates of sick leave, delayed delivery of key projects, and no systematic data on psychosocial hazards or burnout.

Our audit combined quantitative and qualitative data, and what it revealed was instructive. The presenting complaint was high workload, but the data told a more precise story: the real driver was high cognitive load, caused by two underlying factors. The first was ineffective work systems — technology and processes that were creating friction rather than enabling work. The second was a lack of role and process clarity across teams, leading to duplication of effort and confusion about responsibilities. The organisation's IT infrastructure was a known problem that had been tolerated; the audit provided the clarity needed to act on it. The assessment also revealed that 29% of staff were at severe or very severe risk of burnout — a significant finding that moved the conversation from anecdotal concern to documented risk.

The response was organised around several working groups, each bringing together HR, WHS, staff representatives, and executive sponsors. Interventions included role and process clarification work across teams, resourcing of the IT function to address systemic inefficiencies, and training for both managers and staff. The staff training covered not only organisational responsibilities and reporting processes, but also the neurobiology of stress — helping people understand how chronic stress activates certain brain systems, and equipping them with practical techniques to interrupt that response.

Twelve months later, the follow-up assessment showed a 10% reduction in severe and very severe burnout risk, a 21% improvement in perceptions of high workload, and an 80% improvement in protective factors including support from line managers. That last figure reflects the impact of targeted manager training: when managers have the skills and tools to have meaningful conversations with their teams, the experience of being supported by one's direct manager improves measurably.

Conclusion: From Good Intentions to Effective Practice

Best practice in psychosocial hazards management is not about doing more — it is about doing the right things, in the right order, with the right data. The framework is straightforward: raise awareness, consult rigorously, implement evidence-based controls, and monitor their effectiveness. The five principles — stakeholder engagement, effective communication, manager training, a data-driven approach, and evidence-based controls — provide the practical scaffolding for making that framework work in real organisations.

The organisations that do this well are not the ones with the largest budgets or the most elaborate programs. They are the ones that take the process seriously, invest in the right foundations, and are willing to act on what the data actually tells them — even when it differs from what they expected.

If you would like to explore how this approach could work in your organisation, we would welcome a conversation. Get in touch with us! 

References

Toma, G. (2026). Psychosocial Risk Management for a Healthier Workplace: A Practical Implementation Guide. Routledge.

Safe Work Australia. (2022). Model Code of Practice: Managing Psychosocial Hazards at Work. Safe Work Australia.

WorkSafe Queensland. (2023). Code of Practice: Managing the Risk of Psychosocial Hazards at Work. Queensland Government.

About the Author 

Dr. Georgi Toma is the Director of HeartBrain Works and an Honorary Research Fellow at the University of Auckland. With over a decade of experience in psychosocial risk, occupational stress, and culture interventions, Georgi has supported high-profile clients including Myer, RMIT University, Uber, Hitachi Energy, Clough Group, MEC Mining, and Environment Canterbury to create mentally healthy workplaces. HeartBrain Works offers validated psychosocial risk audits, training for leaders and staff, and the scientifically validated Wellbeing Protocol. 

About the Healthy Work Community of Practice 

The Healthy Work Community of Practice is a professional community for health and safety professionals. Members access quarterly knowledge-sharing sessions, a psychosocial risk controls library, real-world case studies, regulatory alerts, practical toolkits, a job board, research summaries, and ongoing training and workshops. Intake opens three times per year. To learn more, visit https://www.heartbrainworks.org/Healthy-Work-CoP