Part 4 of a 4-Part Series – What Good Psychosocial Risk Governance Looks Like in Practice
Written By Niru Tyagi
Psychosocial hazards are now recognised as a critical element of workplace health and safety. Australian laws require organisations to identify and control these hazards just as they would physical risks. Boards and senior executives must understand that psychosocial risk governance is not simply a compliance exercise. It is about preventing harm and creating a culture where workers feel safe, respected and heard. This article outlines what good psychosocial risk governance looks like, based on legal duties, international standards and Australian guidance. It offers practical steps for boards, executives and WHS practitioners.
Legal Duties and Due Diligence
Under Australia’s model WHS laws, persons conducting a business or undertaking (PCBUs) have a primary duty of care to ensure the health and safety of workers. Psychological health is included in this definition. Directors and officers have a personal duty to exercise due diligence. According to the Australian Institute of Company Directors (AICD), officers must take reasonable steps to understand psychosocial hazards, ensure that resources and processes are in place to manage them, and verify that those processes are working[1]. Failure to meet these duties can result in personal liability.
The AICD emphasises that board decisions directly affect how psychosocial risks are managed[2]. Waiting for an incident or compensation claim is too late; governance must focus on prevention[3]. Boards should therefore integrate psychosocial risk into their risk management frameworks and oversight arrangements. Directors should also be aware of state-specific codes and regulations, such as the Queensland code of practice requiring written prevention plans.
Principles of Good Governance
Effective psychosocial risk governance rests on several principles:
- Prevention over treatment – Focus on eliminating or minimising hazards rather than treating symptoms[3].
- Integration – Embed psychosocial risk into existing WHS systems and business processes, rather than treating it as a separate initiative.
- Clear accountability – Assign responsibility at executive and board levels; include psychosocial safety in performance objectives.
- Participation and consultation – Involve workers in identifying hazards, assessing risks and designing controls.
- Continuous improvement and assurance – Monitor, review and improve controls through audits and feedback.
Embedding Psychosocial Risk into WHS Management Systems
Policies and risk registers
Organisations should incorporate psychosocial hazards into their WHS policies and risk registers. A risk register should specify the hazard, its source (e.g., high workload due to understaffing), the risk assessment and the control measures. Avoid overloading registers with minor issues or control failures (such as missing policies); focus on significant hazards and link them to controls[4]. Board members should review the register regularly and ensure that actions are tracked.
Consultation mechanisms
Consultation is a legal requirement and a cornerstone of effective governance. Engage health and safety representatives, committees and workers in hazard identification, risk assessment and control design. Participatory approaches build trust and improve the quality of information. The European Agency for Safety and Health at Work notes that employee readiness and involvement are key drivers of psychosocial risk management[5].
Incident reporting and investigation
Psychosocial incidents, such as bullying reports or stress complaints, should be recorded and investigated with the same rigour as physical incidents. Investigations should identify systemic causes (e.g., poor leadership or excessive workload) and result in specific control actions. Boards should receive aggregated data on incidents and corrective actions.
Integration with ISO 45001 and ISO 45003
International standards provide a framework for systematic management. ISO 45001 sets out the Plan–Do–Check–Act cycle for occupational health and safety management systems. ISO 45003 offers guidance on managing psychosocial risks and lists categories of hazards, including high job demands, low control, poor support, unclear roles, harmful behaviours and inadequate recognition[6]. Integrating these standards ensures that psychosocial risk management is comprehensive and aligned with other safety processes.
Board‑Level Oversight and Reporting
Clarifying roles and responsibilities
Boards should designate a committee (e.g., WHS or Risk Committee) to oversee psychosocial risk. They should assign a senior executive (such as a Chief People Officer) responsibility for psychosocial safety. Responsibilities should be reflected in job descriptions and performance reviews. Establishing clear roles avoids ambiguity and ensures accountability.
Setting risk appetite and strategy
Boards need to define their risk appetite for psychosocial harm. This involves deciding the level of risk they are willing to tolerate and the resources they will allocate to control it. For example, a board may adopt a zero-tolerance stance on bullying and harassment. Psychosocial risk should be integrated into the organisation’s broader risk strategy and considered when planning projects, restructures or technology changes. Board decisions can increase or reduce risk, so a psychosocial lens should be applied to strategic choices[2].
Monitoring performance and assurance
Directors should receive regular reports on psychosocial indicators. Metrics may include survey results, rates of bullying complaints, workload measures (e.g., overtime hours), use of employee assistance programs, turnover and absenteeism. External audits or reviews can assess whether controls are effective and whether management is implementing recommendations. The OSHwiki analysis notes that management support and recognition of the business case are drivers of psychosocial risk management[5].
Building a just culture and psychological safety
Policies and systems will not succeed without the right culture. A just culture encourages employees to speak up about hazards and near misses without fear of reprisal. Psychological safety means workers feel safe to raise issues, admit mistakes and ask for help. Boards and leaders must model respectful behaviour and set expectations for managers. Recognition programs that reward positive behaviours and supportive leadership can reinforce the desired culture. Investigations should focus on system failings rather than blaming individuals, encouraging learning and improvement.
Practical Steps For Boards and Executives
To implement good psychosocial risk governance, boards and leaders can:
- Educate themselves; Attend training on psychosocial hazards, legal requirements and best practices; Stay informed about state and federal codes; Understand the categories of hazards in ISO 45003[6].
- Develop a psychosocial risk strategy; Incorporate psychosocial objectives into the WHS strategy; Define risk appetite, responsibilities and resourcing; Align with the organisation’s values and goals.
- Integrate risk into decisions; Require psychosocial risk assessments for major projects, restructures and technology changes; Evaluate how changes may affect workload, autonomy, role clarity, culture and support.
- Implement and monitor controls; Ensure controls follow the hierarchy of control; For example, reduce excessive workloads through staffing changes before offering resilience training; Monitor the effectiveness of controls and adjust as needed.
- Report and review; Set regular reporting cycles to the board on psychosocial risk indicators; Seek independent assurance through audits; Use dashboards that integrate psychosocial indicators with physical safety metrics.
- Foster a supportive culture; Model respectful communication; Encourage open dialogue; Provide training for managers on psychosocial safety; Recognise and reward supportive leadership and safe behaviours.
- Continuously improve; Regularly review the psychosocial management system; Learn from incidents and near misses; Engage external experts when needed to benchmark practices.
Psychosocial risk governance is a core responsibility for Australian boards and executives. It requires more than compliance: it demands a proactive, integrated approach that prevents harm and promotes psychological safety. Directors and officers must exercise due diligence by understanding hazards, ensuring resources and verifying effectiveness. Good governance involves embedding psychosocial risk into WHS systems, clarifying roles, setting risk appetite, monitoring performance and fostering a just culture. By following the principles and practices outlined here, organisations can meet their legal obligations, protect their people and enhance productivity.
References
Australian Institute of Company Directors. (2024). Governing WHS psychosocial risks: A primer for directors[1][6]. AICD.
Ernst & Young. (2025). Psychosocial hazards: Think risks, not lists[4]. EY Insights.
International Organization for Standardization. (2021). ISO 45003:2021 Occupational health and safety management — Psychological health and safety at work[6].
European Agency for Safety and Health at Work. (2023). Managing psychosocial risks: Drivers and barriers[5].
Safe Work Australia. (2023). Model Code of Practice: Managing psychosocial hazards at work.
[1] [2] [3] [6] governing-whs-psychosocial-risks-web
[4] ey-psychosocial-hazards-think-risks-not-lists-august-2025-final.pdf
[5] Managing psychosocial risks: Drivers and barriers – OSHwiki | European Agency for Safety and Health at Work
https://oshwiki.osha.europa.eu/en/themes/managing-psychosocial-risks-drivers-and-barriers
About the Author
Niru Tyagi is a Psychosocial Risk and WHS Governance Strategist and founder of WHS Guard. She works at the intersection of governance, risk, and regulatory accountability helping boards and executive leaders build defensible psychosocial risk management systems aligned with ISO 45003 and Australia’s WHS legislative framework.
Specialising in complex and high-risk industries, Niru architects integrated governance systems that strengthen due diligence under the WHS Act (s 27) and the Corporations Act. Her work goes beyond policy. She designs measurable assurance structures, leading indicators, and board-level reporting frameworks that make psychosocial risk visible, auditable, and proactively managed.
