Psychosocial Risk Assessment: How to Run One (With a Working Template)

A psychosocial risk assessment is the documented process of working out which work-related factors could harm your people psychologically, how serious that risk is for each group of workers, and what you will change to control it. Under Australian WHS law and the psychosocial codes of practice, it is the assess step of a legally required risk-management cycle, and the document a regulator will ask for first.

This guide walks through the five steps and gives you a working template to copy. It also answers the question every Australian organisation hits early ("can't we just run People at Work?") and ends with an honest note about effort, because the process below is real work, and there is help for it.

Three ground rules before you start. Consult as you go, not at the end: consultation with workers and health and safety representatives during identification, assessment and control selection is a WHS duty in itself. Assess groups, not the organisational average: risk lives in specific teams, sites, rosters and roles. And remember the output is change, not a document: an assessment that ends in a register nobody actions is worse than none, because it documents that you knew.

Step 1: Who and what are you assessing?

Define the work groups by whatever actually shapes exposure: team, site, role type, roster pattern. Then nominate an owner with authority to change work design, not just to write reports, because every control that matters in step 4 is a change to how work happens. Record the scope in the register header.

Step 2: How do you identify the hazards?

No single channel finds everything, and the codes expect multiple. Use at least three of these five:

• A structured survey. The free, government-endorsed People at Work survey is validated for Australian workplaces and benchmarked: a genuinely good identification input at zero cost.
• Consultation sessions with teams and HSRs, walked through the hazard list. Use the 17 psychosocial hazards with examples as the prompt sheet.
• Your lagging data: incidents, complaints, grievances, workers compensation claims, absence and turnover patterns by team.
• Your leading data: trends from regular check-ins, such as workload pressure clusters or teams drifting toward burnout-zone patterns. Continuous signals show hazards forming between assessment cycles; on why once-a-year instruments structurally miss this, see why annual engagement surveys miss psychosocial risks.
• Observation of work as actually performed: rosters, real hours, real interruptions, not the position description.

Step 3: How do you assess the risk?

For each hazard, for each work group, assess four things: duration (how long people are exposed), frequency (how often it recurs), severity (how serious the harm could plausibly be), and combinations (which hazards co-occur). The codes are explicit that interacting hazards raise risk: high demands plus low control plus poor support is a different risk from any one alone. Assess the combination for the group, not each hazard in a vacuum.

Rate each hazard-group pairing. A simple High / Medium / Low is defensible if you apply it consistently and record your reasoning. Resist false precision; the reasoning you write down matters more than the number.

Step 4: How do you choose controls?

Order candidate controls by the hierarchy: eliminate or redesign the work itself first (workload rebalancing, role clarification, roster change, staffing the gap), administrative controls second (training, procedures), individual supports last (assistance programs, resilience training: legitimate supplements, never the primary control). Our guide to applying the hierarchy of controls to psychosocial hazards has worked examples per hazard. For every control, record an owner and a date.

Step 5: How do you review, honestly?

Set the review before you file the register: a date, a metric, and a trigger list (after incidents, after organisational change, when consultation or check-in trends flag movement). The review question is not "were the actions completed" but "did exposure go down", which is only answerable if you have data flowing between review dates. This is the step that separates programs that work from programs that laminate well.

The working template

Copy this structure into your risk register tool or a spreadsheet: one row per hazard per work group.

Register header: organisation and site · work groups in scope · assessment owner · consultation record (who, when, how) · date · next review date.

Field	What to record	Example entry
Work group	The specific team, roster or role	Claims processing team (14 people, hybrid)
Hazard	From the regulator list	Job demands plus poor support (combined)
Evidence	What identified it	People at Work scores; three consultation mentions; overtime up 30% since March; check-in trend declining for eight weeks
Exposure	Duration and frequency	Daily, sustained about four months
Who is affected	Everyone in group, or a subset	Whole team; two members acutely
Risk rating	H / M / L with reasoning	High: sustained combined exposure, early absence signal
Controls: work design	The change to the work	Backfill vacancy; rebalance portfolio allocation; cap concurrent case load
Controls: supporting	Administrative and individual	Manager check-in cadence; MHFR support offered
Owner and date	Named person, deadline	Ops manager, 30 Nov
Review	Date, metric, trigger	Feb review: overtime hours, check-in trend, absence; earlier if the trend worsens

That is the whole discipline: specific group, evidenced hazard, honest rating, work-design control, named owner, measurable review.

Is the People at Work survey enough on its own?

Use it: it is free, validated, benchmarked and regulator-endorsed, and it makes step 2 rigorous. Be equally clear about what it is not: a point-in-time survey, typically run annually or less, dependent on response rates and disclosure trust, and silent between administrations. It identifies; it does not monitor.

The organisations that handle step 5 well pair a periodic instrument like People at Work with continuous, privacy-preserving signals: regular check-ins aggregated into de-identified team trends, so the register is fed by live data rather than reconstructed at review time. That pairing is what a defensible identify-and-review capability looks like, and it is precisely the gap Emotional Pulse is designed to fill, with themes mapped to the ISO 45003 psychosocial factor taxonomy so what surfaces lands in register-ready language.

An honest note about the effort, and an offer

Everything above is real work: scoping, consulting, gathering four kinds of data, assessing combinations, negotiating controls with the people who own rosters and budgets, and keeping the data flowing until the next review. Most of the HR and WHS leads we meet are doing it alongside a full-time job, and the gap between the process on paper and the process as lived is usually not willingness. It is hands and systems.

That is work we do every week, so if it would help, bring your context to a discovery call. We will walk through the process with you: where your existing data already answers steps 2 and 3, where a check-in layer and a proactive EAP can carry identification and review for you, and what the first ninety days would look like. No proposal until you ask for one; the walk-through is the useful part.

CONCLUSION

A defensible psychosocial risk assessment is five steps run honestly: scope by real work groups; identify hazards through multiple channels (a validated survey, consultation, lagging data, continuous leading signals); assess duration, frequency, severity and, critically, hazard combinations; control at the level of work design with named owners; and review against the only question that matters, whether exposure fell. The template above is enough to start this week. The hard part is not the document; it is keeping data flowing between reviews so the document stays true.

FAQ

Is a psychosocial risk assessment legally required in Australia?

Managing psychosocial risk through the identify, assess, control, review cycle, in consultation with workers, is required under WHS law, and the codes of practice describe the expected process. The assessment is the documented evidence of the assess step; a regulator investigating will ask to see it.

How often should we run one?

Formally, at planned intervals and whenever triggers fire: significant organisational change, incidents, new information from consultation, or deteriorating trends. Mature programs run a full assessment annually or biennially and keep it live between cycles with continuous indicators rather than treating it as an annual event.

What is the difference between a psychosocial risk assessment and an engagement survey?

An engagement survey measures broad sentiment. A psychosocial risk assessment measures exposure to specific, legally defined hazards, by work group, with severity reasoning and controls attached. Regulators care about the second; sentiment data can inform it but cannot replace it.

Who should run the assessment?

The PCBU owns the duty; in practice a WHS or HR lead coordinates. The essential participants are the workers and HSRs being consulted and the line leaders who control workloads, rosters and roles, because the controls that matter are changes to the work, and only they can make them.

Quick Answer: To run a psychosocial risk assessment in Australia: (1) scope by real work groups; (2) identify hazards through multiple channels, including a validated survey such as the free People at Work tool, worker consultation, incident and absence data, and continuous check-in trends; (3) assess duration, frequency, severity and hazard combinations per group; (4) control at the level of work design first, with named owners and dates; (5) review against whether exposure actually fell. Document it in a register (template above), consult workers throughout, and keep live data flowing between reviews.