How to Do a Psychosocial Risk Assessment at Work, Step by Step

What is a psychosocial risk assessment?

A psychosocial hazard is something in the way work is designed, organised or managed, or in the work environment or relationships, that can harm mental or physical health. Typical examples are heavy or unpredictable workloads, little say over how or when work is done, poor support from managers, conflict or aggression, unclear or conflicting roles, and change that is badly planned or explained. A psychosocial risk is the combination of how likely harm from that hazard is and how serious it could be.

A psychosocial risk assessment applies the same logic you would use for a slippery floor or a noisy machine: identify the hazard, decide who could be harmed and how, evaluate the risk, decide controls, record it and review it. The difference is that the hazards are less visible, so you need better ways of finding them.

ISO 45003:2021, published in June 2021, gives international guidance on managing psychosocial risk within an occupational health and safety management system. The World Health Organization's Guidelines on mental health at work, published on 28 September 2022, recommend organisational interventions that address risks such as heavy workloads, alongside training for managers and support for return to work. Neither replaces your local law, which in many countries already places a duty on employers to assess risks to health.

Why is fixing the work better than a wellbeing app?

Because an app does not change the hazard. If overtime is concentrated on the same people every peak, or rotas are published two days ahead, a meditation session does nothing about either. It may help someone cope for a while, which is worth something, but it leaves the cause in place.

There is evidence for caution about relying on individual programmes. In a 2024 study in the Industrial Relations Journal, William Fleming of the University of Oxford's Wellbeing Research Centre looked at 46,336 workers in 233 UK organisations and found no evidence that individual-level programmes such as mindfulness, resilience and stress management classes, relaxation and wellbeing apps left participants better off than colleagues who did not take part. The study did not test changes to the work, so it is not proof that work redesign succeeds. It is a strong reason not to stop at individual support.

The scale of the problem makes the choice matter. WHO and the International Labour Organization estimate that 12 billion working days are lost every year to depression and anxiety, at a cost of nearly US$1 trillion to the global economy.

What are the main psychosocial hazards at work?

A practical way to search is to use a fixed set of work-design areas, so you look everywhere and not only where people complain loudest. Similar areas appear in common frameworks; the UK HSE Management Standards, for example, use six: demands, control, support, relationships, role and change. Splitting support into manager and peer support gives seven.

• Also check: the physical environment, lone or remote work, exposure to traumatic events or distressing content, and job insecurity.

How do you find where the risk is highest?

Use at least three team-level sources and look for agreement. A short work-design survey tells you which areas people find hardest. Absence against the site rate, overtime per full-time equivalent and case data (for example absence episodes with a stress-related recorded reason, and workload or rota concerns raised, as team totals only) show where strain may already be turning into harm.

A simple rule works well: count a signal for each source that crosses a threshold you set in advance, and treat a team as a hotspot when three agree, and as one to watch when two do. One source alone is a question. High absence in a small team can be two long-term cases; a low survey score can be one bad week.

Protect privacy from the start. Set a minimum group size of 5 for every report, including survey results, and hide any smaller team. Never try to identify who said what. Keep health information on confidential HR or occupational health records, never in team reports. And compare each team with the same quarter a year earlier, because absence and overtime follow the seasons.

Why talk to the team before you finalise the assessment?

Data tells you where to look; the people doing the work tell you what is causing the problem and what would fix it. A 45-minute conversation with 6 to 12 people from the team, led by someone they trust who is not their line manager, usually surfaces the real causes and cheaper, better-targeted ideas than any spreadsheet.

Set ground rules: talk about the work, not anyone's health or a named person; record themes, not quotes; promise a written reply on every idea by a set date, including the ones you turn down. If the room is cynical because past surveys led nowhere, acknowledge it and ask what single change would show this time is different.

How do you rate a psychosocial risk?

Rate each hazard with its existing controls in place, using likelihood from 1 (rare) to 5 (almost certain) and severity from 1 (minor and short-lived) to 5 (serious or lasting harm). Multiply them for a rating from 1 to 25. Common bands are 1 to 4 low, 5 to 9 medium, 10 to 14 high and 15 to 25 very high, but agree your own and keep them the same between rounds.

Agree ratings with the manager, a worker representative or volunteer from the team, and your health and safety lead. Note which hazards interact: long hours combined with short-notice rota changes are worse than either alone. Then set a target rating for after the controls, so you know what success looks like.

What controls work best?

Control in order. Work design first: change the work so harm is less likely. Then support: build skills and support around the work. Then treatment: help people who are already affected. Every high or very high risk should have at least one work-design control, with an owner, a date, a cost and a measure with a baseline and a target.

• Cost each control next to what the hazard already costs: overtime premium, agency cover, absence and turnover.
• If a control is refused, record the reason and the next-best control; the risk stays open.

What should managers do, and not do?

The WHO guidelines recommend training managers, and their role is clear: notice changes at work, open a private and supportive conversation, listen, change what they can about the work, signpost to the employee assistance programme, occupational health and the person's own doctor, and follow up on a set date. They should not diagnose, ask about medication or decide what someone's problem is.

Managers also need to know when to stop. If someone is at risk of harming themselves or others, or is in danger now, call emergency services first and then the safeguarding or designated lead. Disclosures of health conditions go to HR and occupational health, with consent, to discuss adjustments; health details stay off team records.

How do you know if it is working?

Measure the hazard first, because that is what you changed: overtime per FTE, rota notice, the survey score in the main hazard area. Outcome measures such as absence and leavers follow more slowly and with more noise. Compare with the same season last year, never a peak with a quiet quarter, and say plainly when several controls landed at once so no single one can take the credit.

Review each risk at least every 90 days and after any significant change, run a short pulse survey for hotspot teams after about six months, and repeat the full survey every year with the same questions and thresholds. Report quarterly to your board with the share of actions at work-design level and an honest note on what is not yet known.

If you want every file for this already built, The Workplace Wellbeing Programme Kit from Bodhih Training includes the workbook with a heat map that hides groups under 5, a hotspot scorer, a 28-item survey, the assessment and action plan forms, a manager conversation guide and a board report template. Reading team data well is a skill in itself: the AssessAll People & Performance Data Judgment assessment is one way to check yours, and a Jobulary individual development plan can help you build the facilitation and analysis skills the programme needs.