Creating Buy-In Across Functions: Aligning HR, WHS and Wellbeing

Dr. Georgi Toma | Director, HeartBrain Works | Honorary Research Fellow, University of Auckland

Introduction

Drawing on a recent HeartBrain Works session, this article covers:

• What each function (WHS, HR, Wellbeing) brings, and what each one misses alone
• How to assess where your organisation sits now
• How to resolve the privacy question that stalls most collaboration attempts
• The governance, triage and accountability structures that make integration hold

A scenario: one report, three responses

A worker reports that their supervisor constantly criticises their work, often in front of the team. Constant criticism of this kind is among the most commonly cited examples of workplace bullying. Different functions have different perspectives and ways of addressing this: 

• The HR Manager sees a potential bullying complaint. The instinct is the grievance procedure: gather statements, assess whether the allegations meet the threshold, determine action. This is treated as an individual matter requiring investigation. There is also hesitation about privacy, and uncertainty about what can properly be shared with WHS.
• The WHS Manager sees a psychosocial hazard and reaches for a risk management approach. Are others in the team affected? What controls are needed? How does this get recorded in the risk register? She would like to be involved, but the HR Manager is holding the matter close.
• The Wellbeing Lead does not know the report exists. She is rolling out resilience training to that exact team this month, planned quarters ago, entirely disconnected from what is actually happening in the team.

On the worker's side, the experience is two weeks of silence. They are still reporting to the same supervisor. No one has taken ownership.

What each function got right. Each response is defensible in its own terms:

• HR correctly identified a matter that may amount to bullying and requires investigation, and correctly followed established policy
• WHS correctly identified a hazard and recognised that the collective picture matters, not just the individual case
• Wellbeing correctly held support capability ready

What each function missed. They missed each other. All three were working on parts of the same problem without knowing what the others held. Beyond that:

• Nobody checked whether the worker was actually okay
• Nobody consulted or communicated with them
• Nobody recognised where their obligations intersect
• Nobody took clear ownership of protecting that worker

The complaint, the risk and the support response are three aspects of one matter, and they were being handled as three separate matters.

The risks of working in silos

There are several ways in which working in silos can have negative outcomes. Hopefully these points provide with useful arguments for anyone needing convincing.

1. Fragmented responses. Workers are unsure where to go or who owns their concern, and get bounced between functions.
2. Investigations miss the system. Complaints addressed one by one as individual cases leave the systemic hazard intact to harm someone else.
3. Half-scope risk assessments. Work design is examined without management practices, or management practices without work design.
4. Privacy as a blocker. Information sharing stalls because protocols were never agreed in advance.
5. Wellbeing disconnected. Programs run in parallel to hazard identification and control rather than being informed by them, which is how a resilience rollout lands in a team that needs something else entirely.
6. Handovers become handballs. Matters are referred between functions and owned by nobody.
7. Parallel processes. Duplicated effort for the functions, and confusion for the worker.

There is a further risk embedded in this, one that can lead to direct harm. When a matter is passed between functions with no single owner, the worker likely has to recount their experience repeatedly. Depending on the nature of the complaint, that repetition carries a real risk of re-traumatisation.

The bad apple is usually a system problem. The most consequential silo failure is the one that treats incivility, bullying or harassment as a personal problem attached to a difficult individual. That theory has been disputed time and again. Personality traits may well underpin some behaviour, but a person behaves that way over time because the system around them permits it. In our audit, when we look at what surrounds high rates of incivility, we usually find some combination of high job demands, a poorly managed organisational change that produced job insecurity, increased workload on the remaining team, or a lack of role clarity that has tipped into role conflict. All of that drains the reserves people rely on to be patient, supportive and clear in how they communicate. Incivility starts with abrupt responses from people who have less time than they need, and it festers from there.

This is why the scope of the risk assessment matters so much, and it leads to a principle we'd like to emphasise: a complaint, a grievance or an incident is usually the outcome of exposure to a cluster of psychosocial hazards. Psychosocial hazards very rarely exist in isolation. Look beyond the individual matter to the system underneath it, and to the conditions that allowed the so-called bad apple to develop.

What each function brings

Psychosocial risk sits at the intersection of WHS, HR and wellbeing. No single function owns it entirely, and none holds the full toolkit alone. Ultimate accountability sits with the PCBU and with officers and executive leaders, which is the fact that unites the three functions in purpose. Their job is to support those officers to meet their due diligence obligations, and none of them can do that on their own.

Three lenses on the same risk:

• WHS: hazards and systems of work. Risk methodology, the hierarchy of controls, the codes of practice, and the specific mandate to demonstrate that higher order controls have been considered.
• HR: conduct and the employment relationship. Grievances, policy, procedural fairness and return to work.
• Wellbeing: support and intervention. Early intervention, EAP, mental health literacy, training, and often the return to work interface as well.

Treat this as a conversation starter for your own organisation rather than a fixed framework. Part of the value in mapping it out jointly is that each function is deeply fluent in its own framework and largely unfamiliar with the others. When you sit down for this conversation, explain the regulatory requirements you operate under and how you are trained to look at a problem. Assume your colleagues do not know, because in most organisations they do not.

The trap each function falls into alone:

• WHS alone: hazards without the human dimension. Risk assessments cover work design but miss conduct, capability and the employment relationship.
• HR alone: cases closed, hazards open. Each complaint is resolved at individual level while the hazards and risk management process required under WHS legislation are not addressed.
• Wellbeing alone: support without redesign. Individual support cannot substitute for system level controls. Training does not fix a systemic problem, though it is often asked to.

Self-assessment: where your organisation sits now

Before designing anything, it helps to know where the gaps actually are. We designed a short quizz to help you identify where you are now and what to tackle first. Score each statement below from 1, meaning not at all, to 5, meaning fully in place.

1. WHS, HR and wellbeing have clearly defined roles in psychosocial risk management.
2. Workers know where to report concerns, regardless of which function receives them.
3. Information is shared appropriately between functions, with privacy protections in place.
4. Investigations examine both conduct and complaints and the underlying hazards.
5. Psychosocial risk data is reported jointly to leadership.

Your total out of 25:

• 20 or above: strong
• 13 to 19: developing
• Under 13: significant gaps

Take this with a grain of salt. Rather than a diagnostic tool, it's meant to be a conversation starter with your colleagues about where to go next and what to prioritise. 

Two things to keep in mind. When we ran this quiz live, most organisations landed in the developing or significant gaps range, so don't feel bad if you got a low score. It simply means you've got an opportunity to create meaningful change in your organisation. Secondly, when session participants were asked who currently owns psychosocial risk in their organisation, the most common answer by a clear margin was that ownership was shared between WHS and HR but not well defined. The least common answer was that it was shared and well defined. Ambiguity is the norm at the moment, and hopefully the resources below will help you build a system to address it.

Privacy and information sharing

Privacy is the barrier raised most often, and it is frequently raised by HR colleagues who are not fully across the health and safety legislation and its obligations. Bullying is now squarely a health and safety matter as well as an HR matter (at least in Australia), which changes what information sharing is for. Privacy constraints are real and necessary, but they are a design constraint to be worked through rather than a reason not to collaborate.

There is no cookie cutter answer here. Use the following as the agenda for a dedicated conversation involving HR, WHS, wellbeing and whoever holds workers compensation claims and return to work in your organisation.

• Necessity. Share what is needed for health and safety purposes, and no more.
• De-identify by default. Summaries and category level information are usually sufficient for hazard assessment. You rarely need specific details to take informed action. Build de-identification into the intake process so it happens automatically when a report arrives, rather than being negotiated afterwards.
• Consent where practicable. Where you share without it, be explicit about the health and safety justification.
• Document it. What was shared, with whom, and why.
• Health information is the strictest tier. Consent based, purpose specific, stored separately.
• Aggregate data should flow freely. Trends inform executive reporting, control decisions and the training schedule for the year, with no individual identifiable.
• Agree the protocols in advance. This is the most important point of the seven. You do not want to be designing an information sharing approach under pressure, after the next report has already arrived.

If you are a member of the Healthy Work Community of Practice, a full information sharing protocol template is included here. If you'd like to find out more about the community, check out this page. 

How to start the conversation with other functions

How you open the conversation with another function can have a significant impact on how your request is received. Two openings tend to fail:

• Collaboration as a request for help. Asking whether the other team can take something on makes the whole thing depend on goodwill, which is a scarce resource in a busy workplace.
• Collaboration as a jurisdictional claim. Asserting that psychosocial risk is legislated under WHS and therefore belongs to you might not be well-received (and also is not fully accurate).

The alternative is to open with what is in it for them and with how the functions can achieve their goals together*. Find where you already pursue overlapping outcomes. Employment law matters, many psychosocial hazards genuinely fall across both HR and WHS remits, and above both of them sits an executive team carrying accountability that neither function can discharge alone. That shared driver is the strongest opening available.

*This framing comes from Desleigh White, an HR leader interviewed for Dr. Georgi Toma's forthcoming book, Psychosocial Risk Management for a Healthier Workplace: A Practical Implementation Guide (Routledge, in press).

The three levels of integration

Effective integration operates at governance, operational and process levels simultaneously. A practical way to approach this is to schedule a short series of meetings with all the functions involved and map one level per meeting.

• Governance: shared accountability. Joint reporting on psychosocial risk to leadership, shared KPIs, and a standing agenda item or standing meeting dedicated to it.
• Operational: joint triage of every report. One pathway, whichever door the report came in through.
• Process: connected, not parallel. What triggers a referral between functions, who does what at each point, and what a warm handover actually looks like. This is the level that eliminates duplication and gives everyone clarity about their part.

Joint triage: the first 48 hours

Let's take an example from a mid-sized utilities company that established a Workplace Health Response Team drawing on WHS, HR and claims. Every report, whether lodged as a hazard or as a grievance, was routed to this team for collective triage, with a coordinated response guaranteed within 48 hours.

Why it works:

• One decision, made together. Investigation, risk assessment, immediate controls, or a combination of all three.
• The entry point stops mattering. The worker can use whichever reporting pathway they are comfortable with.
• 48 hours eliminates the silence. That gap is where trust dies and matters escalate.

Designing the first 48 hours. Applied to the scenario presented in the introduction (the report about repeated supervisor criticism in front of others), a potential design could look like this:

1. Acknowledge within 24 hours. A named person contacts the worker, explains the process, and confirms who their single point of contact will be, so they never have to re-explain their experience.
2. Assess jointly within 48 hours. HR and WHS assess the matter together and determine whether immediate controls are needed.
3. Put immediate controls in place. Protect the worker while the matter is assessed, whether that means changed reporting lines, increased oversight or temporary separation.
4. Provide wellbeing support. Wellbeing offers support to the worker without taking over the investigation.
5. Investigate and manage the risk in parallel. HR leads the complaint process and protects procedural fairness, while WHS monitors and manages the psychosocial risk.
6. Review and prevent recurrence. All three functions review the outcome together, update controls, and address anything systemic the case exposed.

Given the nature of this report, a team level risk assessment is warranted rather than optional, in my opinion. Where a complaint points to bullying, it would be surprising to find no other psychosocial hazards present in that team. Assume a cluster until the assessment tells you otherwise.

The underlying principle is straightforward. HR manages the complaint, WHS manages the risk, wellbeing supports the worker, and one designated case owner coordinates the whole response.

The complete joint triage process, including the decision guide, the information sharing protocol, the RACI template and a meeting agenda, is set out in The Collaboration Toolkit for Community of Practice members, alongside a companion toolkit on structured incident investigation. To join the community, click here. 

Responsibility mapping with RACI

Designing an integrated process is the first step. Keeping it running smoothly requires relationship-building and structured touchpoints. The first of those structures is a RACI matrix applied to every psychosocial risk activity. It is a very useful tool that helps you map together with your colleagues the role each function plays in all tasks related to managing psychosocial risk. RACI stands for:

• R, Responsible: does the work
• A, Accountable: owns the outcome
• C, Consulted: provides input before or during
• I, Informed: kept across progress and outcomes

The rule that makes it work is that there is only ever one accountable party per activity.

Let's explore how this can be applied in practice by coming back to our cristicism-complaint scenario: 

• Hazard identification and risk assessment. WHS accountable and responsible, HR responsible alongside them, staff and line managers consulted.
• Conduct investigation. HR accountable and responsible, WHS consulted on the hazard dimension with its own assessment triggered where needed, wellbeing informed with support standing by.
• Worker support response. HR or wellbeing accountable and responsible depending on how your organisation is structured, HR consulted on any return to work implications, WHS informed so the hazard review can proceed.

All three functions appear on every activity, but only one ever owns the outcome. When you run this exercise, map every activity that actually needs doing in your context. A blank RACI template covering eleven psychosocial risk activities is available in The Collaboration Toolkit.

A regular meeting rhythm

The single biggest enabler of sustained collaboration is a regular meeting:

• Meet monthly or fortnightly, for 60 minutes or less. Work through open matters, new concerns to triage and emerging trends. Document decisions and actions.
• Rotate the chair. Ownership is shared by design, so that it's not perceived as one function's meeting.
• Ask about upcoming change every time. Are there organisational changes coming that might affect psychosocial risk? Change is the only constant in organisational life, so my recommendation is to treat it as a standing item rather than an exception. This helps you mitigate the likelihood of upcoming change going bad, or address residual issues from the previous change program. 

The human element matters as much as the agenda does. Seeing colleagues regularly and checking in on how they are, builds the connection and trust that make the difficult conversations possible later.  

Four design features of integration

Four things distinguish an integrated system from a well-intentioned one:

• Clear escalation criteria. Developed from how grievances and incidents actually arrive in your organisation, so that routine matters are handled efficiently, complex matters get coordinated attention, and everyone agrees on which is which.
• Named accountability. Someone owns the matter at every stage. Attach the ownership to the position description rather than the individual, so it survives when that person leaves.
• Information sharing protocols. Defined in advance, covering what is shared, how, and at what point.
• Joint training. Each function teaches the others its framework and constraints. Being able to see a matter from a colleague's point of view does what protocol alone cannot.

Where to start

If the self-assessment produced a low score, here are a few ideas for how to proceed:

1. Take your two lowest scoring statements and convene the functions with a stake in them.
2. Use the mapping conversation to establish what each function brings and what regulatory requirements each operates under.
3. Settle the privacy protocols.
4. Design the first 48 hours if a grievance/report comes in.

If you would like support navigating any of these priorities, we are here to help. Get in touch with us! 

About HeartBrain Works 

We have supported high-profile clients including Myer, RMIT University, Hitachi Energy, and Environment Canterbury to create mentally healthy workplaces. We offer Alice, your psychosocial risk team in software, training for leaders and staff, and the scientifically validated Wellbeing Protocol. 

About the Healthy Work Community of Practice 

The Healthy Work Community of Practice is a professional community for health and safety professionals. Members access quarterly knowledge-sharing sessions, a psychosocial risk controls library, real-world case studies, regulatory alerts, practical toolkits, a job board, research summaries, and ongoing training and workshops. Intake opens three times per year. To learn more, visit https://www.heartbrainworks.org/Healthy-Work-CoP