From Law to Practice: Meeting Compliance with Victoria's Psychological Health Regulations

insights regulations Jun 16, 2026

Psychosocial Risk: Meeting Compliance with Victoria's Psychological Health Regulations

Dr. Georgi Toma | Director, HeartBrain Works | Honorary Research Fellow, University of Auckland

Introduction

Victoria now has psychosocial risk regulations. Most organisations have heard about them. Fewer have a clear picture of what they actually require, and fewer still have worked through what that means in practice for their specific context.

This post draws on a recent HeartBrain Works session on meeting compliance with the OHS (Psychological Health) Regulations 2025. It covers the regulatory framework, the hierarchy of controls as Victoria has structured it, and what applying that framework looks like in practice, using two scenarios to make the legal requirements concrete and actionable.

What the regulations actually require

Three regulations sit at the core of the Victorian framework.

Regulation 14 requires employers, so far as is reasonably practicable, to identify psychosocial hazards. Regulation 15 requires them to control the associated risk, using a modified hierarchy of controls. Regulation 16 requires them to review and revise those controls when specific triggers occur.

The regulations are supported by the Psychological Health Compliance Code, which provides hazard-by-hazard guidance and is well worth reading in full. Enforcement sits with a specialist WorkSafe Psychosocial Inspectorate, and it is worth noting that Victoria has a history of enforcing psychosocial risk obligations long before this specific regulatory framework was formalised.

What counts as a psychosocial hazard

The regulations define a psychosocial hazard as any factor or factors in the work design, the systems of work, the management of work, the carrying out of the work, or personal or work-related interactions, that may arise in the working environment and may cause an employee to experience one or more negative psychological responses that create a risk to the employee’s health or safety.

The regulations and the compliance code list 15 examples — aggression or violence; bullying; exposure to traumatic events or content; high job demands; low job control; low job demands; low recognition and reward; low role clarity; poor environmental conditions; poor organisational change management; poor organisational justice; poor support; poor workplace relationships; remote or isolated work; and sexual harassment — but make clear the list is not exhaustive. If you identify a hazard not on the list, the duty to control it still applies.

The Hierarchy of Controls

Victoria’s modified hierarchy has three bands. At the top is elimination, preventing exposure to the hazard entirely. In the middle is a broad band covering controls that reduce risk by altering the management of work, the plant, the systems of work, the work design, or the workplace environment. At the bottom is the use of information, instruction, or training.

The code is explicit about two constraints on that bottom band. Information, instruction or training may be used as the exclusive control only where none of the higher-order altering controls in regulation 15(2)(a) are reasonably practicable (regulation 15(3)). And where a combination of controls is used, information, instruction or training must not be the predominant control measure (regulation 15(4)). In practice, this means training almost always has to supplement higher-order controls rather than carry the program on its own.

A combination of controls across multiple bands is almost always required, in part because psychosocial hazards cluster. Poorly managed organisational change, for example, typically brings with it elevated workload, role ambiguity, job insecurity, and perceptions of poor support. Controls need to address the cluster, not individual hazards in isolation.

Reasonably practicable

Compliance is assessed against what a reasonable person would do — defined as someone committed to providing the highest level of protection and proactively taking action to protect people’s health and safety. The five factors considered are: the likelihood of the hazard or risk occurring; the degree of harm that might result; what the person knows, or reasonably should know, about the hazard and how to control it; the availability and suitability of ways to eliminate or reduce it; and the cost of doing so. Cost alone cannot justify a failure to act.

Knowing when to review

Regulation 16 sets out six triggers that require an employer to review and, if necessary, revise their controls: before any alteration to a thing, process or system of work that is likely to change psychosocial risk; when new or additional information about a hazard becomes available; when an employee, or someone on their behalf, reports a psychological injury or a psychosocial hazard; after a notifiable incident under Part 5 of the Act that involves a psychosocial hazard; when the existing controls do not adequately control the risk for any other reason; and on request from a Health and Safety Representative.

The change management trigger is particularly worth noting. Many change initiatives are rolled out without any psychosocial risk consideration, which creates both legal exposure and real harm for the people absorbing the impact.

Putting it into practice: Two Scenarios

Two immediate actions (within one to two weeks)

Acknowledge the HSR’s request in writing and confirm the review will be undertaken, scheduling the consultation under section 35 of the OHS Act and Regulation 9. The trigger conditions under Regulation 16(1)(c) (a hazard reported on an employee’s behalf), 16(1)(e) (controls that do not adequately control the risk) and 16(1)(f) (an HSR request) are active. This is a formal review obligation, not an optional one.

Then convene a consultation session with the affected team, with HSR involvement as required under Regulation 9, to gather current information about incident frequency, severity, and patterns. Review existing incident and near-miss data. Ensure the officer on leave is being appropriately supported through HR and EAP channels, without any pressure about return to work.

Two medium to longer-term actions (within three to six months)

Complete a documented review of existing risk control measures under Regulation 16 and produce a revised prevention plan covering aggression or violence, high job demands, and poor support. The evidence — the incidents, an absent worker, an HSR request — makes clear the existing controls are inadequate.

Engage senior council leadership on the upstream drivers of ratepayer aggression: how rate notices are communicated, how planning decisions are explained, how parking infringements are reviewed. These design choices sit above the customer service team but generate much of the risk they absorb. Reducing risk at this level requires executive sponsorship.

The psychosocial hazards present

The primary hazard is aggression and violence. Behind it sits a cluster of connected hazards: high job demands from the volume and emotional weight of difficult interactions; poor support, because existing controls leave individual officers to absorb and de-escalate rather than providing systemic protection; low recognition and reward, given that staff are carrying significant emotional labour without acknowledgement or compensation in role design; and the potential for exposure to traumatic events, depending on the severity and nature of specific incidents.

Controls mapped to the hierarchy

Please see below some examples of controls mapped on the Victorian Hierarchy of Controls. These are meant to be suggestions, not an exhaustive list.

Eliminate: Where reasonably practicable, remove face-to-face contact for the transaction types most likely to trigger conflict. Fine disputes, for example, can be routed entirely through a written or online process, eliminating the counter interaction altogether.

Alter the management of work: Implement a documented behaviour-of-others policy with clear thresholds for ending an interaction, visibly endorsed by senior leadership. Introduce post-incident debriefing with a trained supervisor following any reportable incident. Limit any one officer’s continuous time on the front counter to defined blocks — for example, two-hour rotations.

Alter the plant: Install higher counters or controlled-entry barriers and duress alarms at every counter position. Provide screens at seated counter positions where appropriate.

Alter the systems of work: Move high-conflict transaction types — planning disputes, rate disputes — to an appointment-based service model, reducing walk-in volume during the highest-conflict periods. Establish a two-officer protocol for any interaction flagged as high risk based on prior history. Define a clear escalation pathway to a duty manager who can take over the interaction, with no expectation that the customer service officer continues.

Alter the work design: Redesign roles so that the most emotionally demanding transaction types are handled by specialist officers with structured support, rather than rotated across all staff. Build protected recovery time into shifts following high-conflict interactions.

Alter the workplace environment: Provide a private breakout space adjacent to the front counter for officers to step away after difficult interactions. Review sightlines, emergency exit access, and the visibility of duress points from each counter position.

Information, instruction, and training: De-escalation training refreshed regularly and supplemented by practice-based scenarios rather than pre-made videos — staff need to practise under simulated stress, not watch a slide deck. Manager and staff training in psychosocial risk, made bespoke for the context. Briefings on the behaviour-of-others policy, the incident reporting protocol, and the duress and escalation systems. Consistent with regulation 15(4), these sit alongside the higher-order controls above and are not the predominant control.

Two immediate actions (within one to two weeks)

Have a confidential conversation with Sarah. Offer immediate support — EAP, time off, structured debriefing — and ensure she is not expected to continue night shifts unchanged while the review is undertaken.

Ensure the physical assault and the two deaths are properly recorded, including retrospectively where reports were not filed at the time. Make immediate practical adjustments to night-shift staffing or response arrangements pending the review — for example, an on-call clinical manager available by phone, or a second RN scheduled on high-acuity nights.

Two medium to longer-term actions (within three to six months)

Complete a formal review of risk control measures for night-shift work, with documented consultation under Regulation 9. Although there is no HSR on the night shift specifically, any HSR for the workplace must be involved, and direct consultation with night-shift staff is essential.

Develop a prevention plan covering exposure to traumatic events, aggression or violence, remote or isolated work, high job demands, and poor support. Use the review to make a deliberate decision about whether the current night-shift staffing model is itself the primary control issue, and act on that decision.

The psychosocial hazards present

The hazard cluster here is severe. Exposure to traumatic events — resident deaths and aggression — sits at the centre. Around it: aggression and violence from residents, particularly in the context of dementia care; remote or isolated work, with a sole RN responsible for around 60 residents after hours; high job demands from clinical responsibility, decision-making load, and the breadth of overnight resident need; poor support, with no scheduled debriefing, no peer contact overnight, and survey findings left unactioned for six months; and low job control over rostering, staffing levels, and the response model.

The conversation Sarah had with the Director of Nursing is, for regulatory purposes, a report of a psychosocial hazard. The compliance code treats raising a concern directly with a supervisor as a form of report. This is a trigger under Regulation 16(1)(c).

Controls mapped to the hierarchy

Please see below some examples of controls mapped on the Victorian Hierarchy of Controls. These are meant to be suggestions, not an exhaustive list.

Eliminate: Elimination is not reasonably practicable for the core hazards in this environment. Reduction is the regulatory focus.

Alter the management of work: Post-incident debriefing following any resident death, code black, or incident of resident-initiated aggression, with clinical supervision provided. A documented no-blame reporting culture for resident behavioural incidents, with management follow-up rather than an expectation that the RN absorbs the incident alone. Routine clinical check-ins with night-shift staff initiated by the Director of Nursing, not waiting for staff to raise concerns.

Alter the plant: Duress alarms accessible from any point in the building. Two-way communication devices so night-shift staff can maintain contact across floors.

Alter the systems of work: Schedule a second RN on the most demanding nights — when residents are in active palliation, or when residents with known behavioural risks are unsettled. An on-call clinical supervisor available to the night-shift RN for both clinical and psychological support. Documented behavioural support plans for residents with known aggression risks, with agreed responses that do not require the RN to manage alone.

Alter the work design: Make a deliberate decision about whether sole-RN night shifts remain appropriate for the resident profile of the home. Build clinical caseload review into the staffing model so that high-risk situations — active palliation, recent discharge from hospital, new admissions — trigger additional staffing automatically.

Alter the workplace environment: Provide a dedicated debrief and rest space accessible to night-shift staff. Review lighting, visibility, and security around staff entry and exit points for night-shift staff.

Information, instruction, and training: Training on responding to behaviours of concern in dementia care. Training on recognising signs of distress and supporting peers after critical incidents. Training on the use of duress and clinical escalation systems. Manager and staff training in psychosocial risk, bespoke to the aged care context. Briefings on the behaviour-of-others policy and the incident reporting protocol. As in scenario one, these supplement the higher-order controls and are not the predominant control.

What the regulations are telling us

The common thread across both scenarios is the same. The controls most organisations already have in place — training, posters, EAP referrals — sit at the bottom of the hierarchy. They are not without value, but they cannot carry the weight of a control program on their own, and the Victorian regulations are explicit about this.

Working through these scenarios also makes visible how much of the risk sits upstream of the frontline worker. The ratepayer’s anger at the council counter is driven partly by how rate notices are written and how infringement reviews are handled — decisions made well above the customer service team. The night-shift RN’s isolation is partly a product of a staffing model that has not been genuinely reviewed against the resident population it serves. Compliance means addressing those upstream conditions, not just asking the person at the sharp end to manage better.

The other thing the regulations make clear is that reviewing your controls is not a one-off event. The six triggers in Regulation 16 are specific and ongoing. A worker raising a concern with a supervisor is a trigger. A report of a psychological injury is a trigger. An HSR request is a trigger. Keeping track of when those conditions are met, and treating them as the formal review obligations they are, is a non-negotiable part of what the framework requires.

If you would like support navigating any of these priorities, we are here to help. Get in touch with us!

About HeartBrain Works

We have supported high-profile clients including Myer, RMIT University, Uber, Hitachi Energy, Clough Group, MEC Mining, and Environment Canterbury to create mentally healthy workplaces. We offer a validated psychosocial risk tool and support to meet compliance, training for leaders and staff, and the scientifically validated Wellbeing Protocol.

About the Healthy Work Community of Practice