Ask any board or senior leadership team in a high-risk industry if they are managing psychosocial risk and most will say yes. They have an employee assistance program. They ran a wellbeing day. There is a value statement on the wall. They run an annual employee satisfaction survey. All good things. None of them is what the law is actually asking for.

There are two ideas hiding inside the same words, and the difference now carries legal weight.

Psychosocial safety is the older idea, the felt experience of a supportive culture where people feel respected and able to speak up. As Healthy Workplaces SA, a South Australian Government initiative, defined it in 2024, psychosocial safety is "a management practice that prioritises organisational policies, procedures, and practices to protect workers' psychological health and safety."

Psychosocial risk management is the specific legal duty under work health and safety law, to manage the psychosocial hazards in a workplace the same way you manage any other safety risk.

Both matter. Only one is what a regulator checks.

The duty is a defined cycle, not a sentiment. Under work health and safety law, through the WHS Regulations and the model Code of Practice for Managing Psychosocial Hazards at Work in each state/ territory, a business has a clear and ongoing obligation. In plain terms, it is to:

• Identify the psychosocial hazards

• Make reasonable efforts to control them

• Consult your workforce throughout

• Monitor and review effectiveness of controls

• Document it all as an active, ongoing system

What is a control?

The word control does a lot of work here, so it is worth being precise. In work health and safety, a control, or control measure, is an action you put in place to eliminate or minimise a risk. It is not a document, and it is not an intention. It is something that actually changes the level of risk.

The term is not ours to define. It comes from occupational health and safety practice, and in Australia it is set out in the WHS Regulations and explained by the regulators, Safe Work Australia (and your state WHS regulator). They also set out the hierarchy of controls, which ranks control measures from the most effective and reliable to the least. Redesigning or removing the source of the risk sits at the top. Administrative measures such as policies and training sit near the bottom, because they rely on people behaving differently rather than removing the hazard. That is why a policy, an EAP or a training session, on their own, are not controls in the eyes of the regulator. They can support a system, but by themselves they do not reduce the risk at its source.

The scale of this is not theoretical. It shows up in weeks of work lost, in real dollars, and in people harmed. Safe Work Australia data shows a psychological injury claim takes a median of 37 weeks off work, against 7 weeks for other injuries, and carries a median cost of $65,400. In high risk sectors the human cost is starker still, with the Western Australian Enough is Enough parliamentary inquiry in 2022 finding sexual harassment and assault in the fly in fly out mining industry both widespread and under reported. Behind those numbers, and that finding, is a simple truth. People are being harmed at work, often in ways their organisation cannot see until it is too late. And that is why this is now enforced. The duty exists because the harm is real, and the enforcement is arriving.

Compliance is a powerful motivator, but it should not be our only reason for doing the right thing.

So why do capable, well meaning organisations get caught. Because you cannot control a hazard you cannot see, and you cannot see it if you are assuming how your people feel rather than asking them. In 20 years inside organisations, the single most common failure in culture work has been leaders acting on their assumptions about the mood on the ground, assumptions that are confident, reasonable, and often wrong. An annual engagement survey, or the analysis that lands three months after a survey closes, cannot close that gap. By the time the report is written, the risk has typically already escalated, or resolved on its own, either way you were not there to act on it.

Genuine psychosocial risk management starts with genuine curiosity, real time identification of risk and real consultation, not an assumption and not out of date data.

It requires a mechanism your people can use to tell you what they have experienced or observed, and how concerned they are, so organisations (and their leaders) can take informed action. It means understanding the nuance between what head office thinks and how the night shift in a regional operational centre feels, without needing to identifying a single person. And it means capturing that gap and designing a workable solution, because the same data that shows you the culture also documents your compliance.

If you sit on a board or lead a business, three moves are worth making this quarter.

1. Separate the two ideas in your own governance.

A healthy safety climate and a working risk management cycle are not the same thing, they are not the same concept, and they cannot be monitored or reported on in the same way. Treating them as one is how the gap hides.

2. Understand your psychosocial hazards and risks, and what causes them.

It helps to be clear on two words that get used interchangeably, and often confused, even in industry. A hazard is the thing that can cause harm, for example an unrealistic workload, a bullying dynamic, or a lack of role clarity. A risk is the likelihood that the hazard will actually cause harm, and how serious that harm could be. Safe Work Australia puts it simply, hazards are things and situations that could harm a person, and risk is what could happen if someone is exposed to a hazard and the likelihood of it happening.

Once you know your hazards and the risk each one carries, ask the real question. What are we doing to mitigate the impact of these, and do we have a genuine control in place, or are we loosely pointing to a policy no one follows, an EAP no one accesses, or a training session that was delivered for compliance and has no living meaning for the workforce who encounter the hazard every day.

3. Put in place a live mechanism to identify, consult, monitor and document.

That is the intent of the legislation, it is the compliance evidence required, and it gives you genuine culture insight, in one place.

Psychosocial safety is the destination. Psychosocial risk management is the road to that destination. The hard part is that we cannot know in advance which way it will go, whether a given risk will escalate or resolve on its own, and the duty now carries implications not only for the organisation but for the managers and officers within it, personally. The organisations that will do well are the ones that stop confusing the two and start measuring what is really happening, in real time.

Not because they have compliance requirements but because they care about the impact of doing nothing.

To see what real time psychosocial risk and culture data looks like, book a short Archispeaks demo.