WHS Code of Practice: Managing Psychosocial Hazards at Work

What Is the Code of Practice?

The Model Code of Practice: Managing Psychosocial Hazards at Work is a practical guide published by Safe Work Australia in August 2022. It tells employers exactly how to identify and manage psychosocial risks in their workplace — just like the Code of Practice for manual handling or hazardous chemicals.

A code of practice is different from a regulation. It doesn't create new legal duties — rather, it provides practical guidance on how to meet existing duties under the WHS Act. In jurisdictions where the code is formally adopted, it carries significant legal weight: you can be judged against it in court or tribunal proceedings.

What Changed?

Before the Code, psychosocial hazards were technically covered by the general WHS duty of care, but regulators rarely enforced it — largely because there was no clear standard to measure against. The Code changed that by:

• Naming the specific hazards employers must manage
• Defining a clear risk management process (identify, assess, control, review)
• Setting expectations for consultation, training, and reporting
• Providing a benchmark that regulators and courts can use to judge compliance

Who Does the Code Apply To?

The Code applies to all persons conducting a business or undertaking (PCBUs) — which in plain language means every employer, business, and organisation in Australia. Small businesses are not exempt. Sole traders are not exempt.

The duties extend beyond employees to cover:

• Direct employees
• Contractors and subcontractors
• Labour hire workers
• Volunteers
• Visitors and any other person at the workplace

The 14 Psychosocial Hazards

The Code identifies 14 specific psychosocial hazards that PCBUs must manage. These are the recognised risk factors that can cause psychological or physical harm if not addressed:

The Risk Management Process

The Code prescribes a four-step risk management process. This is the same framework used for physical WHS hazards — now formally applied to psychosocial risks:

Step 1: Identify Psychosocial Hazards

You can't manage what you haven't found. The Code expects PCBU to use a combination of methods:

• Consult workers — talk to them directly about what's causing stress or difficulty
• Use surveys and questionnaires — anonymous tools can surface hazards workers won't raise in person
• Analyse existing data — incident reports, workers' compensation claims, absenteeism patterns, turnover rates, exit interviews
• Review job design — examine demands, control, support, and clarity in each role
• Observe the workplace — look for signs of high stress, conflict, or disengagement

Step 2: Assess the Risks

Once hazards are identified, you need to understand the severity and likelihood of harm. This involves:

• Determining who might be harmed and how severely
• Understanding which hazard combinations create higher risks
• Considering the characteristics of your workforce (e.g. young workers, new parents, isolated staff)
• Applying a risk assessment matrix (likelihood × consequence)

Step 3: Control the Risks

The Code applies the hierarchy of controls — just like physical safety:

1. Eliminate — remove the hazard entirely. Can you redesign a role to reduce unsustainable demands?
2. Substitute — replace the hazard with something less risky. For example, rotating emotionally demanding work across team members.
3. Engineer — design safer systems. Automate manual data entry to reduce workload; create clear escalation pathways.
4. Administrative — change policies and procedures. Implement clear anti-bullying policies; provide training for managers.
5. PPE — personal protective equipment is rarely relevant for psychosocial hazards (except in trauma-exposed roles), but psychological support services (EAP) can be considered a form of last-resort control.

Step 4: Review Controls

Controls must be regularly reviewed to ensure they remain effective. The Code recommends review:

• After any significant workplace change (restructure, technology change, growth)
• When new information about hazards or controls becomes available
• When health and safety representatives request a review
• At regular intervals (at least annually, or quarterly for higher-risk workplaces)

Penalties for Non-Compliance

This is where the Code bites. Under Australian WHS legislation, penalties for failing to manage psychosocial hazards can be severe. The exact amounts vary by jurisdiction, but the model legislation sets these maximums:

State-by-State Adoption

The model Code of Practice is just a model — it needs to be formally adopted by each state or territory to have direct legal effect. Here's where things stand:

Even in jurisdictions still finalising formal adoption, regulators can still prosecute under the general WHS duty (Section 19) — and courts can refer to the Code as evidence of what "reasonably practicable" means.

Practical Action Plan for Employers

If you're a PCBU reading this and wondering where to start, here's a practical action plan aligned with the Code's expectations:

Week 1–2: Gap Analysis

• Review your current WHS policies — do they explicitly cover psychosocial hazards?
• Check your existing risk register for psychosocial risks
• Look at your incident reporting system — does it capture psychosocial concerns?
• Review absenteeism, turnover, and workers' compensation data for patterns

Week 3–4: Worker Consultation

• Conduct an anonymous psychosocial hazard survey (the Code expects genuine consultation)
• Hold focus groups or team discussions (with a safe, confidential structure)
• Engage with Health and Safety Representatives (HSRs) if you have them

Month 2: Risk Assessment & Control Plan

• Document the psychosocial hazards present in each work group or role
• Assign a risk rating (likelihood × consequence) for each hazard
• Identify and implement controls using the hierarchy
• Document the process and make it available to workers

Month 3+: Monitor, Review, Repeat

• Set a review cadence (monthly for higher-risk hazards, quarterly minimum)
• Track leading indicators (pulse scores, check-in responses) not just lagging indicators (incidents, claims)
• Update your risk register as new information emerges
• Report progress to leadership and workers

How Technology Can Help

Traditional WHS compliance relies on annual surveys, manual reporting, and reactive incident logs. The problem: psychosocial hazards move fast. A hazard that emerges today won't show up in next quarter's survey — but it's already causing harm.

Modern AI-powered platforms like Tortoise & Hare Wellness transform this process by:

• Weekly pulse checks — ongoing, lightweight data collection instead of once-a-year surveys
• Automated hazard identification — AI detects patterns in team wellbeing signals and flags emerging psychosocial risks in real time
• Anonymous reporting — workers can flag concerns without fear of reprisal
• Trend analysis — spot hazards across teams, departments, or the whole organisation before they become systemic
• Audit-ready reporting — structured documentation that demonstrates compliance with the Code's risk management process
• Actionable dashboards — leadership gets a clear picture of psychosocial risk, not a spreadsheet

Related Resources

• Complete Guide to Psychosocial Hazards in Australia — Everything you need to know about the 13 psychosocial hazards, your WHS duties, and how to manage them.
• Psychological Safety in the Australian Workplace — Understanding the team culture that prevents psychosocial hazards from taking hold.
• AI Wellness Coach vs EAP — How continuous, data-driven support compares to traditional employee assistance programs.

If you're ready to move from compliance checklists to real, ongoing hazard management — book a 25-minute demo and see how the AI Wellness Coach can help your team.