The Psychosocial Hazards Code of Practice: What It Actually Requires of Employers

A code of practice is not guidance you can take or leave. An approved code is admissible in court as evidence of what is known about a hazard and what is reasonably practicable to control it. If a regulator or court asks how you managed psychosocial risk and your approach falls short of the code without an equally good alternative, the code becomes the standard you are measured against.

That is why the Managing Psychosocial Hazards at Work codes (Safe Work Australia's model, Queensland's 2022 code, NSW's code, and the Commonwealth's 2024 code administered by Comcare) matter to every employer, not just safety teams. This guide translates them from regulatory language into the specific things an employer has to do and be able to show.

Is a code of practice legally binding?

An approved code is not a statute, but it sets the benchmark for what is reasonably practicable, it is admissible in proceedings, and inspectors use it when assessing compliance. You may manage a risk another way, but the alternative must deliver an equivalent or better standard of protection, and you carry the burden of showing that. In practice, the code is the standard.

The consequence worth sitting with: "we didn't know poor role clarity was a WHS issue" stopped being a defensible position once the codes were approved. What duty holders ought to know is now written down, by the regulator, in plain language.

Who does the code apply to, and where?

The duty sits with the person conducting a business or undertaking (the PCBU, in practice the employing entity). Officers carry a due-diligence duty of their own: understanding psychosocial risk and verifying that resources and processes exist to manage it. Managers and supervisors carry the day-to-day implementation, because they hold most of the levers.

Jurisdiction matters at the margins. Queensland approved its code in 2022 alongside amended regulations; NSW has an approved code; the Commonwealth jurisdiction has its own 2024 code administered by Comcare; other model-WHS states and territories rely on the Safe Work Australia model code and their own regulations. Victoria sits outside the model WHS framework and has been progressing its own psychological-health regulations under its OHS Act, so Victorian operations should check WorkSafe Victoria's current guidance directly. Multi-state employers can anchor on the model code: satisfy it and you are substantially aligned everywhere, with jurisdiction-specific checks on top.

What does the code actually require us to do?

Strip away the formatting and the code requires a standard risk-management cycle, applied to psychosocial hazards with the same discipline as physical ones, with consultation running through every step. Identify the hazards present in your work. Assess the risks, including how hazards combine. Control them, prioritising changes to the work itself. Review whether the controls actually reduced exposure.

Here is each step in practice.

Identify the hazards present in your work

Not in the abstract: in your actual teams, sites and shifts. The code expects multiple identification channels, including consultation with workers and health and safety representatives, review of incidents, complaints, absence and turnover data, and observation of how work is really performed. The hazard set to check against is the regulator's list; see the 17 psychosocial hazards with examples.

Assess the risks, including how hazards combine

Duration, frequency and severity of exposure all matter, and the code is explicit that psychosocial hazards interact. High demands plus low support plus insecure work is a different risk from any one alone. An assessment that scores hazards one at a time, once a year, without asking who is exposed and for how long, does not meet the intent. Our step-by-step psychosocial risk assessment guide covers a defensible process.

Control the risks, at the source first

The hierarchy of controls applies. The code expects work design and organisational change first: fixing workloads, clarifying roles, changing rosters, improving change management. Information, training and individual supports (including assistance programs) sit lower in the hierarchy. They are legitimate as supplements and inadequate as the primary control. A policy document is not a control; a control changes exposure. See applying the hierarchy of controls to psychosocial hazards.

Review the controls, and keep reviewing

Controls must be reviewed to confirm they are working: after incidents, after change, when consultation surfaces concerns, and at planned intervals. This is where most programs quietly fail. The assessment gets done, the register gets filed, and nobody measures whether exposure actually changed. The review question is not "were the actions completed", it is "did exposure go down", and that is only answerable with data flowing between review dates.

What would a regulator actually ask to see?

Five questions, and for each one a concrete evidence set you either have or don't: how you identified hazards, how you assessed them, what you changed, how you know it worked, and who you consulted along the way. If an inspector, or a court after an incident, examined your psychosocial risk management tomorrow, this table is the conversation.

What they ask	What answers it
How did you identify hazards?	Consultation records, survey and check-in data, incident and absence analysis, a hazard register
How did you assess the risk?	A documented assessment naming exposed groups, duration, frequency, severity, and hazard combinations
What did you do about it?	Controls tied to specific hazards, with work-design changes visible, not only training and support services
How do you know it worked?	Review records, trend data over time, updated assessments after change
Who did you consult, and when?	HSR involvement, team consultation records, feedback loops that visibly influenced decisions

Keep this set current and the code holds no fear. Reconstruct it after something goes wrong and it will show.

Where do people misread the code?

Four misreadings come up constantly: treating an assistance program as the control, treating the annual survey as the identification process, treating the policy document as the control, and treating the whole duty as HR's problem. Each is understandable, each is costly, and each fails for the same reason: the code is about changing the work, not documenting intentions around it.

"We have an EAP, so we're covered." An assistance program is support after exposure, not a control of the hazard. The code expects you to change the work factors causing harm; assistance supplements that. The EAPs themselves are not the problem here; the design that waits to be asked is.

"Our annual engagement survey is our identification process." A yearly sentiment survey is one weak channel. It measures mood, not specific hazard exposure, and it cannot see combinations forming between cycles.

"The policy is the control." Documents describe intent. Controls change rosters, workloads, staffing, role definitions and behaviour consequences.

"This is HR's problem." The duty is the PCBU's, officers carry due diligence, and line managers control most of the levers. HR coordinates; it cannot discharge the duty alone.

How do you keep the monitor-and-review step honest?

This is the step the code makes hardest, because it needs current data, and most organisations only have annual data. The practical answer is a continuous layer alongside the formal cycle: regular, voluntary check-ins whose de-identified trends show whether strain is rising or falling, team by team, between reviews.

That is the specific gap Emotional Pulse exists to fill: check-in trends and de-identified themes, mapped to the ISO 45003 psychosocial factor taxonomy with clinically reviewed definitions, reportable period after period. For organisations that want outreach as well as monitoring, a proactive EAP adds a scheduled, confidential check-in call with every worker each cycle, so identification stops depending on who happens to speak up.

CONCLUSION

The psychosocial hazards codes of practice turn psychological health from an aspiration into an auditable process: identify the hazards present in your work, assess how they combine, control them at the level of work design, review whether exposure actually fell, and consult workers at every step. The code is the benchmark you will be measured against. Meeting it is mostly a matter of running the cycle honestly and keeping the evidence, and the organisations that find it easy are the ones with continuous visibility of how their people are actually travelling rather than a once-a-year photograph.

FAQ

Which states have a psychosocial hazards code of practice?

Queensland approved its code in 2022, NSW has an approved code, and the Commonwealth jurisdiction has the Managing Psychosocial Hazards at Work Code of Practice 2024 administered by Comcare. Other model-WHS jurisdictions work from Safe Work Australia's model code and their own regulations. Victoria runs its own psychological-health regulatory path under its OHS Act.

Does the code require an EAP?

No. Assistance programs are a lower-order support, not a required control. What the code requires is that the hazards themselves are identified, assessed and controlled. A proactive support layer can strengthen identification and review, which is where check-in-based approaches earn their place.

Who enforces the code?

Your WHS regulator: WorkSafe or SafeWork in your state or territory, or Comcare in the Commonwealth jurisdiction. Inspectors use the code when assessing compliance and can issue improvement notices referencing it.

Quick Answer: The Managing Psychosocial Hazards at Work codes of practice (Safe Work Australia model; QLD 2022; NSW; Commonwealth 2024) are admissible benchmarks for what Australian employers must do about psychosocial risk: identify the hazards present in their work through consultation and data, assess exposure and how hazards combine, control risks at the level of work design first, review whether controls actually reduced exposure, and consult workers throughout, keeping evidence of every step. Policies, training and assistance programs alone do not meet the standard; changing the work factors that cause harm does.