What do Victoria's psychological health regulations require employers to do?

Victorian employers must identify psychosocial hazards, eliminate associated risks so far as reasonably practicable or reduce them where elimination is not reasonably practicable, and review and revise controls in specified circumstances. The Occupational Health and Safety (Psychological Health) Regulations 2025 took effect on 1 December 2025. WorkSafe Victoria's psychological health compliance code sets out a practical identify–assess–control–review process with employee and health and safety representative (HSR) consultation throughout. The regulation concerns hazards arising from the way work is designed, managed and carried out, rather than simply whether a business offers counselling.

This is a Victorian OHS guide. Victoria operates under its Occupational Health and Safety Act 2004 and these specific regulations, rather than applying another state's model WHS provisions word for word. A separate P4 guide addresses Western Australia under its own law. The existing Complys AU WHS software page explains generic product coverage; this article explains the distinct Victorian employer task. It is not medical advice or a replacement for a fair, confidential process for an individual's complaint.

What is a psychosocial hazard under the Victorian approach?

WorkSafe Victoria describes a psychosocial hazard as a factor or combination of factors in work design, systems of work, management, how work is carried out, or personal or work-related interactions, arising in the working environment and capable of causing negative psychological responses that create a health or safety risk. See the current regulator information sheet and code introduction.

Examples include high job demands, low job control, poor support, unclear roles, poorly managed change, bullying, harassment, occupational violence and exposure to traumatic events or material. These can combine: a customer-facing worker may face aggression more often when staffing is low, queues are long and they lack authority to escalate. A policy labelled “zero tolerance” does not by itself remove the exposure if the service model repeatedly puts workers alone with angry customers.

A worker may experience stress for reasons outside work, but the employer's duty is to identify and manage work-related hazards it controls. The business should avoid diagnosing an employee or using a personal medical history as a substitute for assessing the work system. WorkSafe's examples appendix illustrates how work design and management can create risk.

Step 1: identify hazards with employees and HSRs

Observe the work, consult the people who do it, and review the information the organisation already holds. A team survey may help, but it can miss small high-risk groups or a rare severe event. WorkSafe's hazard-identification code section describes internal data, workplace observation, job-specific requirements and validated tools as possible sources. Complaints, incident reports, absence patterns, turnover, overtime, customer threats and restructuring plans may all provide useful signals. Handle individual health information confidentially.

Ask what actually happens on different shifts, at remote sites and in contractor-facing work. A procedure may say staff can take breaks, while service levels make a break impossible. An employee may not use a complaint route if they fear retaliation. Invite HSRs and affected employees into the analysis, and give them enough information to comment on plausible controls. Consultation is not satisfied by telling employees a decision after it has already been made.

Record the hazard in terms that guide action. “Psychological safety risk” is too broad for a control owner. “One person closes the facility after aggressive customer incidents, with no reliable backup” describes the exposure. The same group might also face fatigue and high demands; note their interaction rather than filing each under a separate box with no combined assessment.

Step 2: assess how harm could occur

Examine who is exposed, how often, for how long, and how severe the potential harm could be. Consider existing safeguards and whether they work in practice. A single serious threat may require immediate action even if it is uncommon; frequent lower-level demands may accumulate over months. A numerical risk matrix can support prioritisation, but it cannot decide “reasonably practicable” on its own or make an ineffective control effective.

Look at the source. If high job demands come from understaffing and an unrealistic response target, the employer should test those conditions. If workplace aggression comes from a service environment with no protective barrier or escalation, assess layout and staffing. WorkSafe's psychological health code gives a whole-process framework. Use competent OHS or psychological-health expertise where the risk is complex, while involving employees who know the work.

Example: a call-centre target that defeats breaks

A Victorian customer-service team reports repeated abuse and no time to recover between calls. The employer's initial proposal is a resilience webinar. A proper assessment would also examine call volumes, staffing, targets, ability to terminate abusive calls, escalation, break design and supervisor support. It might find that the target itself causes an unsafe pace and limits reporting. Effective controls could include redesigning the performance measure, adding surge staffing, creating a reliable aggression-escalation route and checking whether breaks actually occur. Training may support those controls, but it cannot carry the whole burden.

Step 3: control risks by changing the work

WorkSafe's control step explains that the employer must eliminate risk where reasonably practicable, or reduce it so far as reasonably practicable. This may involve redesigning tasks, workloads, staffing, supervision, physical layout, communication or customer-response processes. Use controls matched to the hazard. A stand-alone employee assistance programme can support someone experiencing harm, but it rarely removes an excessive workload, repeated aggression or an unsafe shift pattern.

For low job control, consider giving workers a meaningful say in task order and method within safe limits. For poor role clarity, fix conflicting instructions, reporting lines and escalation. For foreseeable violence, consider barriers, staffing, access control, duress arrangements and a procedure that lets workers leave or end an unsafe interaction. For major change, consult early, explain the effect on workload and provide training. These are examples, not guaranteed solutions for every workplace.

Assign each measure to an owner with resources and a date. Explain it to affected employees and HSRs. If a longer-term redesign will take weeks, implement proportionate interim protection. Do not leave a known high-risk exposure in place while waiting for a policy committee. Keep evidence of what was considered, why a measure was chosen and how it was put into operation.

The code is a compliance code, not merely a casual checklist. WorkSafe explains that following it can provide deemed compliance to the extent it deals with the relevant OHS duties, while other lawful ways to meet duties may exist. Read the whole code, not just a single example table, when making a defensible decision.

Step 4: review when the regulation requires it

WorkSafe's review step cites regulation 16. It lists triggers including a proposed change likely to alter psychosocial risk, new information, a report of injury or a hazard by an employee or someone for them, a notifiable incident involving a psychosocial hazard, evidence that controls are inadequate, or a request from an HSR. If review shows the measure is not adequately controlling risk, revise it. Do not wait for an annual scheduled review when one of these triggers occurs.

The review should test real outcomes. Did the changed staffing pattern reduce missed breaks? Are aggressive incidents being reported and addressed? Do workers trust the escalation route? Are managers actually applying the new workload rule? Consult affected employees and HSRs and distinguish a control that exists on paper from one that works on shift. If risk remains, revisit the original design decision rather than merely repeating awareness training.

A report of bullying or a psychological injury is information that triggers review of relevant risk controls; the risk-management review does not determine the truth of allegations or replace a fair investigation. Protect confidentiality and procedural fairness while examining what systemic safeguards may need improvement. WorkSafe's reports and incidents code section addresses these parallel processes.

What records are useful?

A practical file should identify the work group and hazard, evidence used, consultation, risk reasoning, controls, owner, implementation and review outcomes. Keep versions when the work changes. For a sensitive matter, record the system-level hazard in a controlled OHS register and protect personal complaints, medical details and witness accounts separately. A team risk assessment should not become an open repository of individual diagnoses.

There is no reason to invent a universal form or one-size-fits-all psychosocial risk score. A small business may maintain a concise documented process; a multi-site organisation may need group-specific assessments and central action tracking. What matters is that the measures reflect the real work and the employer can show the process is active, consulted and reviewed.

The verified Complys AU risk-assessment software describes recording hazards, risk ratings, controls and review reminders. It may support the administrative OHS record if its current configuration and access controls suit the task. The live product page does not establish a dedicated psychological-health clinical module, confidential complaint investigation system, automatic Victorian-law mapping or regulator certification. The employer remains responsible for the legal process, employee consultation and effective work changes.

Frequent errors

• Applying a model-WHS page to Victoria without checking the OHS Act and 2025 regulation. Use the state's current sources.
• Calling a wellbeing benefit the whole risk control. Support can help, but change the work conditions causing exposure.
• Using a generic checklist without consultation. Actual employees and HSRs know whether controls are workable.
• Treating all stress as individual weakness. Examine job demands, control, supervision, change and interactions.
• Waiting for a formal claim before acting. Foreseeable work-related hazards should be identified and controlled.
• Publishing private health details in the risk register. Separate the system hazard from confidential personal records.
• Never reviewing a control after a report or change. Regulation 16 has event-driven triggers.
• Assuming software certifies compliance. It can hold records, while the employer must implement and test controls.

Next step

Choose a work group where job demands, aggression, poor support or another psychosocial hazard is plausible. Consult its employees and HSRs, identify the work conditions producing exposure, select controls that change those conditions, and set an owner and review trigger. Use the current WorkSafe Victoria compliance code with the 2025 regulation for the legal decision. If a digital register would help with agreed actions and reviews, assess the confirmed scope of Complys risk-assessment software without assuming it makes the workplace psychologically safe.

For the related Complys product, see Risk Assessment Software. This guide is general information, not legal advice; verify current requirements against the official sources linked above.