Class 2

The Rulebook with Teeth: Legal Duties, Codes, and Standards You Need to Know

Why managing psychosocial hazards is not optional goodwill - it is a legal obligation with real consequences.

The Legal Foundation: Duty of Care Under WHS Law

The cornerstone of Australian work health and safety regulation is the concept of the primary duty of care. Under the model Work Health and Safety Act, a Person Conducting a Business or Undertaking (PCBU) must ensure, so far as is reasonably practicable, the health and safety of workers - and that health explicitly includes psychological health. This is not a suggestion. It is a positive obligation, breach of which can attract significant penalties, including criminal prosecution in the most serious cases.

As McDaid et al. (2021) note in their comparative international review, Australia's harmonised WHS framework requires employers to execute "various risk assessment and management procedures, and consultation with their employees, their representatives and other duty holders." The key phrase here is so far as is reasonably practicable - a legal test that weighs the likelihood of a hazard occurring, the degree of harm, what the duty holder knew or ought to have known, and the availability and suitability of controls. A court determining what is "reasonably practicable" will look at what guidance was available. And that brings us to the Code.

---

The Code of Practice: Your Practical Roadmap

The Safe Work Australia Model Code of Practice: Managing Psychosocial Hazards at Work (Safe Work Australia, 2022) is the single most important practical document for psychosocial risk management in Australia. Approved under model WHS law, a code of practice is not itself the law - but it carries evidential weight. This means that in legal proceedings, a court may regard the Code as evidence of what is known about a hazard and what constitutes "reasonably practicable" action. Ignore it at your peril.

The Code follows the familiar four-step risk management cycle: identify hazards, assess risks, implement controls, and review effectiveness. What makes it distinctive is how it applies this cycle to the particular messiness of psychosocial hazards. It defines fourteen common psychosocial hazards - including high job demands, low job control, poor support, role conflict, and exposure to traumatic content - and provides scenario-based examples that ground abstract categories in recognisable workplace situations (Safe Work Australia, 2022).

Critically, the Code was introduced alongside new model WHS Regulations that create a positive duty - meaning PCBUs cannot wait for harm to materialise before acting. The obligation is prospective: identify and control psychosocial risks before they injure someone. This shifts the legal logic from reactive compensation to proactive prevention.

---

The International Standard: ISO 45003

While the Code of Practice is Australia-specific, ISO 45003:2021 is the world's first international standard dedicated to managing psychosocial risk within an occupational health and safety management system (International Organization for Standardization, 2021). Built on the broader framework of ISO 45001, it provides guidelines - not certifiable requirements - for identifying, assessing, and controlling psychosocial hazards across three domains: how work is organised, social factors in the workplace, and the physical work environment.

What makes ISO 45003 particularly valuable is its systems-level thinking. It does not treat psychosocial hazards as isolated problems to be patched with individual programmes. Instead, it embeds psychosocial risk management within the broader management system - alongside physical, chemical, and biological hazards - ensuring that psychological health receives the same systematic attention (Nebbs et al., 2025). A recent Australian case study of six regional organisations found that implementing ISO 45003 through structured planning teams produced tailored, evidence-informed psychosocial risk management plans, though it also revealed the challenge of treating implementation as an ongoing system rather than a one-off project (Nebbs et al., 2025).

The Scholarly Foundation: OHS Body of Knowledge

Underpinning both the Code and the standard is the scholarly knowledge base captured in the OHS Body of Knowledge, particularly Chapter 19 on psychosocial hazards (HaSPA/AIHS, 2020). This peer-reviewed resource identifies ten key psychosocial hazards - including time pressure, cognitive and emotional demands, poorly defined work roles, interpersonal conflict, and lack of job control - and draws on decades of research in work organisation, job design, and occupational stress. It provides the conceptual architecture that makes the Code's practical guidance intelligible: you need to understand why low job control is harmful before you can meaningfully assess how to control the risk it creates.

---

The Hierarchy of Controls: Aspiration Meets Messy Reality

Every OHS professional learns the hierarchy of controls early in their career: elimination is best, followed by substitution, isolation or engineering controls, administrative controls, and finally personal protective equipment. The principle is simple - control the hazard at its source rather than asking individuals to cope with it downstream. But when applied to psychosocial hazards, this hierarchy reveals a profound tension.

Schulte et al. (2024), in a major NIOSH-authored commentary, argue that work-related psychosocial hazards are "on the verge of surpassing many other occupational hazards" in their contribution to ill health, and recommend applying the Hierarchy of Controls within a Total Worker Health framework that prioritises organisational-level interventions. LaMontagne et al. (2014) make a complementary case, critiquing the prevailing overreliance on individual-level interventions - such as Employee Assistance Programs and resilience training - and arguing that OHS law obligations are fundamentally about controlling stressors at the upstream, organisational level.

Yet here is the rub: you can remove an unguarded machine from a workshop floor. Can you "eliminate" role ambiguity? Can you "substitute" interpersonal conflict? Kjærgaard et al. (2025) engage directly with this tension, proposing a revised Psychosocial Hierarchy of Controls (P-HOC) through a study of nine Danish companies. Their critical finding is that "not all psychosocial hazards can be eliminated" - but this does not excuse organisations from trying. The hierarchy remains the aspiration that disciplines our thinking: always ask whether you can redesign the work before you resort to training the worker to endure it.

The interactive widget below will give you practice applying this logic. Try sorting real-world psychosocial interventions into their correct level on the hierarchy.

---

Consultation: Workers as Knowers, Not Just Subjects

Every framework discussed in this chapter - the WHS Act, the Code of Practice, ISO 45003 - mandates consultation with workers. ISO 45003 states that worker consultation and participation is "essential for the development, planning, implementation, maintenance, evaluation and continual improvement" of psychosocially safe workplaces (International Organization for Standardization, 2021). The Code requires consultation at each stage of the risk management cycle: identifying hazards, assessing risks, deciding on controls, and reviewing outcomes (Safe Work Australia, 2022).

But consultation is not merely a compliance checkbox. It is an epistemological necessity. Psychosocial hazards are, by their nature, experienced subjectively and shaped by context. A manager reviewing an organisational chart cannot see role ambiguity; the worker living it can. A policy document cannot reveal that the night shift's real problem is not the hours themselves but the isolation created by a supervisor who refuses to communicate. The people experiencing the hazards hold irreplaceable knowledge about their nature, severity, and - crucially - their interaction with one another.

This point will become central to later chapters when we explore how Bayesian networks model the interdependencies between psychosocial hazards. For now, hold this insight: any risk assessment that does not draw on worker knowledge is not just legally deficient - it is epistemically impoverished. It will miss the very interactions and contextual factors that determine whether a hazard produces harm.

---

Putting It Together: Obligations in Practice

Let us return to the scenarios from Chapter 1 and ask what the law actually requires. The overloaded case worker? Her employer must identify the psychosocial hazards in her role - high emotional demands, role ambiguity, inadequate support - assess the risk they create, implement controls that prioritise upstream redesign of the work, and review whether those controls are working. The paramedic exposed to repeated trauma? The PCBU must consider whether the nature of the exposure can be reduced (elimination), whether debriefing structures and roster design can limit cumulative impact (engineering and administrative controls), and whether individual supports like psychological services are available as a last line of defence - not the first and only response (LaMontagne et al., 2014).

The pattern is consistent. The law does not demand perfection. It demands a systematic, reasonably practicable, consultation-informed process. As Schulte et al. (2024) warn, the burden of psychosocial harm is escalating - and the organisations that treat compliance as a poster on the wall will find that the rulebook has teeth.