How to manage psychosocial hazards at work: a step-by-step guide

What are the steps to manage psychosocial hazards?

The same nine steps work for a 30-person clinic and a 2,000-worker operator. The order matters: consultation comes first because the people exposed know the hazards best, and controls come after assessment so you fix the right thing.

• 1. Commit: name an owner, set a budget and get leadership to sign a short decision memo.
• 2. Consult: brief your health and safety representatives first and agree how you will involve every shift.
• 3. Self-assess: score your current practice honestly, so you know where to start.
• 4. Identify hazards by work group, using sick leave, overtime, incident and turnover data, walk-throughs at peak times and short paid huddles.
• 5. Survey work conditions (not people's health) with a privacy threshold, and find the hotspots.
• 6. Assess each risk with workers: likelihood, consequence, exposure and hazards that combine.
• 7. Control from the top of the ladder: eliminate, redesign the work, change the environment, then systems and training, with individual support always available.
• 8. Respond: one pathway for every report, fair investigation, support after traumatic events and planned returns to work.
• 9. Monitor and review: check controls with workers, report to the board each quarter, re-survey yearly.

What counts as a psychosocial hazard?

Safe Work Australia's model Code of Practice lists 14 common hazards: job demands, low job control, poor support, lack of role clarity, poor organisational change management, inadequate reward and recognition, poor organisational justice, traumatic events or material, remote or isolated work, poor physical environment, violence and aggression, bullying, harassment including sexual harassment, and conflict or poor workplace relationships. WorkSafe New Zealand's 2025 guidelines group hazards under work design, social factors and the work environment, and add examples such as shift work without enough rest and digital surveillance. Many organisations add fatigue as its own hazard.

The UK's Health and Safety Executive frames the same ground as six Management Standards areas: demands, control, support, relationships, role and change. EU-OSHA's list includes excessive workloads, conflicting demands, low involvement in decisions, poorly handled change, job insecurity, harassment and difficult customers, patients or pupils. The labels differ; the hazards are recognisably the same.

Is psychosocial risk management a legal requirement?

In most markets, yes, as part of general health and safety duties, though the detail differs and changed recently. Always check the official source and an adviser for your jurisdiction.

How do you assess psychosocial risk?

Assess each hazard for each work group with the workers exposed and their representative. Score likelihood from 1 (rare) to 5 (almost certain) and consequence from 1 (minor, short-lived) to 5 (severe or lasting), then multiply. Likelihood depends on exposure: how often the hazard occurs, how long each episode lasts and how intense it is. Australia's regulations make duration, frequency and severity an express consideration, and say hazards that interact or combine must be considered too.

Score with the controls already in place, as they really work. A behaviour support plan that night staff have never read is not a working control. And score consequence on the worst realistic outcome: a pattern of assaults can end a career even if most incidents are minor.

What does a worked example look like?

Here is a small, quotable example from a fictional 300-worker aged-care provider. Its secure dementia unit has 34 workers. Most assaults by residents happen between 4pm and 8pm, when meals, medicines and bedtime cares overlap with two caregivers for 20 residents. The survey gave the unit 31% favourable on workload and 24% on aggression and distress.

• The two biggest changes were at level 2: they redesigned the evening rather than training people to cope with it.
• The float caregiver costs about NZ$31,000 a year in this example; the provider's own estimates, not a benchmark.

Which controls work best for psychosocial risk?

Work down a hierarchy, the same idea as in physical safety. Level 1 eliminates the hazard (ending 14-hour doubles). Level 2 redesigns the work: staffing at peak times, roster rules, task order, allocation, reporting lines. Level 3 changes the environment or equipment: duress alarms, quiet rooms, check-in apps, cooler kitchens. Level 4 is systems, training and information. Level 5 is individual support: the employee assistance programme, debriefs and return-to-work plans.

Level 5 is always needed and never enough on its own. If most of your controls are training and posters, you are adding support without changing the work. Write one sentence of reasoning whenever you choose a level 4 or 5 control for a High risk, and check with workers 90 days later that each control actually works.

How should you run a psychosocial survey?

Ask about conditions of work, not anyone's health, and never use the results to judge individuals. Set a privacy threshold (eight responses is a common choice) and merge smaller groups before anyone sees results. Ask only work group and shift pattern as background. Keep it open for at least two weeks, reachable on every shift, in paid time and in your workforce's main languages.

Report % favourable by work group and scale, mark hotspots below your red threshold, share results with health and safety representatives first, and run an action-planning workshop for each hotspot within a few weeks. If you also want an external, scored measure of work environment and job demands, AssessAll's Work Environment and Job Demands Assessment is one option.

How should you respond when someone reports bullying or harassment?

Make every route lead to one pathway. Whether the concern reaches a manager, a health and safety representative, HR or an anonymous form, someone should have a first conversation with the person within a set time, such as three working days. In that conversation, listen, check whether anyone is at risk right now, offer support (the employee assistance programme, a support person, medical care if they were hurt), explain the options and be honest about the limits of confidentiality. Do not promise an outcome.

Then triage with two people, not one, and write down the reasons. A pattern, a power imbalance, a possible crime, a risk to others or a report about a senior person points to a formal, independent investigation. Other reports may suit early resolution, manager action on workload or rosters, a health and safety review of the hazard, or support only. Interim measures should never punish the person who reported, and everyone involved should be told that retaliation is a serious matter.

Finally, close the loop on three levels: tell the person who reported what you can, tell the person reported about the outcome and their next steps, and fix the system that allowed the harm. In the worked example above, the most important outcome of a bullying report was a new rule that a registered nurse, not a senior caregiver, allocates the heaviest residents. Expect reports to rise when reporting becomes easier and safer; read the categories and response times before you conclude that conditions are worse.

What are the most common mistakes?

• Treating psychosocial risk as a wellness campaign instead of a health and safety programme with a register, owners and board reporting.
• Relying on training and the EAP as the only controls.
• Running a survey and then doing nothing visible, which kills the next survey.
• Reporting results for small groups, or lowering the threshold to see one team.
• Leaving out nights, weekends, home-based and agency workers.
• Consulting after the decision is made.
• Investigating with someone too close to the matter, or moving the person who reported.
• Returning someone to the same unfixed work after an absence.
• Letting an AI tool judge individuals or pasting identifying details into an unapproved tool.

How do you keep the programme going after the first year?

Run a yearly cycle. Each month, review open reports, return-to-work plans and overdue evidence. Each quarter, check control effectiveness with workers, report to the board and check the official sources for changes. Each year, re-score your self-assessment, re-run the survey with the same items so the trend is comparable, and review policies with your committee. Managers carry most of this day to day, through monthly check-ins about the work; tools such as Jobulary's individual development plan can help them turn training into measured habits.

The Psychosocial Risk Management Kit from Bodhih Training puts this whole cycle into one workbook, five forms, four templates and a dated rules sheet, with a worked example that runs through every file.