Psychosocial risk has moved from the HR report into the risk report. If you sit on a board, you now carry personal duties for how your organisation manages it – and a single annual survey is no longer enough.
From 1 July 2026, businesses in New South Wales have operated under an enforceable Managing Psychosocial Hazards at Work Code of Practice (Code of Practice), and the underlying duty to identify, assess, control and review psychosocial hazards applies nationally under model work health and safety laws.
If you are a director, executive or senior legal adviser, the Code of Practice has impacted what you need to know about your organisation’s psychological risk position, and how to demonstrate your knowledge to a regulator.
The blind spot in most Boards
As an expert in the field of organisational culture, psychosocial risk and mental health, the single most consistent blind spot I encounter at board level is not denial. It is the assumption that a well-regarded annual employee survey has answered the question of psychosocial risk.
My own peer-reviewed field research —an eight-month study of a large NSW public sector organisation, involving 74 interviews across six organisational levels, published in the Journal of Organizational Ethnography — shows why that assumption is unsafe. Well-intentioned organisations routinely misread the signals of psychosocial risk. Exhaustion is treated as a motivation problem. Rising errors are treated as a capability problem. Falling morale is treated as a culture problem. The response becomes engagement programs, additional training and values workshops when the underlying hazard is workload, working conditions or a structure that has drifted past what it was designed to carry.
If the annual engagement score in your last board pack was reported as green, and everyone concluded the position was under control, that reading may be wrong. The evidence in the field, and the evidence regulators look for, often tells a different story.
On 2 October 2026, Safe Work Australia closed a psychosocial assessment platform used by around 5,000 Australian organisations since 2020. The platform’s retirement removes the most convenient shortcut boards had to demonstrating action. What the regulator expects is a process — one that identifies hazards, controls them, reviews them and evidences the loop over time.
Your regulator is not looking for an employee sentiment score. Your regulator is looking for governance.
Why the shift has happened now
Three forces to consider:
- Regulators. SafeWork NSW and its counterparts have moved into psychosocial territory with enforceable codes, inspections and, increasingly, prosecutions.
- Insurers. Underwriters of workers’ compensation, D&O and management liability are pricing psychosocial risk as an enterprise risk and asking for more from their insured organisations.
- Litigation. Class action activity around workplace mental health has grown in ways that make directors and their advisers pay attention.
What section 27 asks of you
Under section 27 of the Work Health and Safety Act 2011 (NSW), if you are an officer of a person conducting a business or undertaking, you must exercise due diligence to ensure that the business complies with its work health and safety duties. That duty is personal. It does not delegate to management. It now demonstrably covers psychosocial risk.
You are not expected to run a hazard identification process yourself. You are expected to take reasonable steps to ensure the organisation has the systems, resources and information it needs to manage the risk. In practical terms, you should be able to describe five things:
- The psychosocial hazards that are reasonably foreseeable in your organisation’s operations.
- The systems in place to identify where those hazards are accumulating, at a level of detail beyond a single organisation-wide score.
- The controls that have been applied, and how the organisation reviews whether they are working.
- The reporting line that brings any material psychosocial risk to the board or a properly constituted committee.
- The evidence trail that would be available if a regulator asked to see it.
If you cannot answer those five questions with confidence, you are not necessarily failing your duty. But you are exposed — and the window for bringing your organisation’s psychosocial risk governance up to the standard now expected by regulators, insurers and the courts is narrowing.
Where psychosocial risk accumulates
Psychosocial risk does not distribute itself evenly across your organisation. It accumulates.
It gathers in particular teams, under particular leaders, in particular functions, and in the gap between what your organisation formally says it values and what it in practice rewards. Two teams reporting to the same executive can carry very different psychosocial risk profiles. Averaging their experience into a single organisation-wide score produces a number that is not really true of either team.
That averaging effect makes psychosocial risk different, in governance terms, from most other operational risks. A liquidity issue in a subsidiary shows up as a hard number on a treasury report. A cyber incident triggers a system alarm. A psychosocial risk concentration in one team may not surface at all until it produces an unusual pattern of unplanned leave, an unexplained departure of key people, a formal complaint or, in the worst outcome, a psychological injury claim your board did not see coming.
Where to place the risk in your governance architecture
There is no single right answer. Some Australian organisations have located psychosocial risk oversight with the risk committee, alongside operational and cyber risk. Others have expanded the remit of the people and culture committee. A smaller number have created a dedicated safety and wellbeing subcommittee. The regulator does not prescribe the committee. It expects you to name one. Safe Work Australia sets out the underlying regulatory expectations that apply nationally.
In my work with boards over the last twelve months, the organisations doing this well share three features. Look for these in your own governance architecture:
- Location. Psychosocial risk information has moved out of the people section of the board pack and into the risk section.
- Granularity. A single annual score has been replaced with local, hazard-specific and ongoing information that reveals concentrations rather than smoothing them out.
- Ownership. Every material psychosocial hazard has a named management owner, in the same way a cyber risk or a compliance risk would.
The next twelve months
The shift underway is not a temporary regulatory fashion. It is the belated arrival of psychosocial risk into the mainstream of Australian corporate governance.
Cyber risk went through the same transition roughly a decade ago. It moved from being an IT problem to being a board-level risk with dedicated committees, board education, insurance implications and, in some cases, personal liability for officers. Psychosocial risk is now on the same trajectory. The compression of that trajectory is being driven by regulators who have signalled they will not wait for practice to catch up.
For you as a director, the practical implication is straightforward. If the conversation at your next board meeting about workplace psychological health is still framed as an HR update — and if the assurance offered is still a single survey score — your governance architecture has not yet caught up with the risk. Put it on the agenda before someone else puts it there.
