What WorkSafe Is Actually Checking Under the Psychosocial Regulations (Six Months In)
The Occupational Health and Safety (Psychological Health) Regulations 2025 took effect in Victoria on 1 December 2025. They have now been in force for several months. Long enough that early enforcement patterns are emerging. Long enough that the difference between businesses that prepared and businesses that didn't is starting to show up in inspector visits, improvement notices, and worker complaints. This piece walks through what's actually being checked, what kind of compliance posture passes scrutiny, and the most common gap I see when employers think they're ready and the inspector finds otherwise.
I worked as an inspector with WorkSafe Victoria, within the psychosocial inspectorate, and I now help Victorian employers prepare for and respond to psychosocial-related inspections and notices. The framing in this post reflects what an inspector is looking for in a workplace they've never seen before, working from first principles of risk and the specific obligations the new Regulations create.
What changed on 1 December 2025
Employers in Victoria always had a duty to provide and maintain a safe and healthy working environment under the Occupational Health and Safety Act 2004. That duty has always extended to psychological health, not just physical safety. What changed with the new Regulations is that the duty is now described in specific terms.
The Regulations require employers to identify psychosocial hazards, assess the risks associated with them, and control those risks so far as is reasonably practicable. They prescribe a tailored hierarchy of controls, set out triggers for reviewing existing controls, and reinforce the requirement to consult workers and Health and Safety Representatives in the process.
Alongside the Regulations, WorkSafe published a Compliance Code for Psychological Health. The Compliance Code is not law in itself, but an employer who follows it is taken to have complied with the Regulations to the extent the Code addresses their obligations. WorkSafe also treats the contents of the Compliance Code as information employers ought reasonably to know when assessing what is reasonably practicable.
WorkSafe Victoria has indicated that, in the early period of the new Regulations, inspectors will take into account factors such as previous experience with psychosocial risk management when determining a compliance and enforcement response. That language matters. It tells you the approach is calibrated, not blanket. But it also tells you the calibration cuts both ways: businesses that have done little, in workplaces with foreseeable psychosocial risk, are not getting the benefit of the doubt indefinitely.
What WorkSafe inspectors are now empowered to do
The same enforcement tools that apply to physical safety apply to psychosocial. An inspector who reasonably believes an employer is contravening, or has contravened, an obligation under the Act or the Regulations may issue an improvement notice. Where there is reasonable belief that an activity involves an immediate risk to health or safety, a prohibition notice is available. In serious or ongoing non-compliance, the matter can be referred for further investigation and potentially prosecution.
What's different in practice is the trigger for an inspector visit. Two paths are now common. The first is a Response Visit, triggered by a worker complaint or report relating to psychosocial harm: a bullying complaint, a sexual harassment disclosure, an aggression or violence incident, or signs of harm from sustained job demands. The second is a Strategic Project Intervention, where WorkSafe targets industries or hazard themes proactively, regardless of whether a specific complaint exists.
In both cases, the inspector's first questions are similar. Show me how you've identified your psychosocial hazards. Show me what you assessed about the risks. Show me what controls you've put in place. Show me how you've consulted with your workers about it. Show me how you would know if any of this needed to be reviewed.
If those five questions can't be answered with operational evidence, the inspector has a basis of belief that the duty isn't being met. From that point, the conversation moves from advisory to enforcement.
The single most common gap I see
If I had to name one issue that distinguishes employers who pass scrutiny from those who don't, it isn't the absence of policies. Most employers have policies. It's the predominant use of information, instruction, and training as the control measure for psychosocial risks.
Under the new Regulations, this is specifically constrained. The Regulations require employers to first consider eliminating the risk. If elimination isn't reasonably practicable, the employer must reduce the risk by altering the management of work, the system of work, the work design, or the work environment. Information, instruction, or training can only be used as the predominant control measure when none of the higher-order options are reasonably practicable. Where multiple controls are used, training cannot be the predominant one.
This is more prescriptive than equivalent obligations in some other states, and it has direct implications. A psychosocial program built around training modules, an Employee Assistance Program, posters in the lunchroom, and an annual mental health awareness week is not, on its own, a compliant program under the Victorian Regulations. Those measures are valid as supporting controls. They are not adequate as the predominant ones if higher-order changes to work design or management are reasonably practicable.
What "higher-order" actually looks like for psychosocial
Higher-order controls for psychosocial hazards address the conditions that produce the risk in the first place. For high job demands, that might mean reviewing workload allocation, revising deadlines, redesigning roles, or adjusting staffing. For aggression or violence, it might mean physical separation of staff from members of the public, redesigned customer-interaction processes, or controlled-entry procedures. For bullying or harassment, it might mean changes to supervision arrangements, performance management practices, complaint handling processes, and behavioural standards enforced consistently.
Training is not absent from any of this. It supports the changes in work design. But the change in work design is the control. Training is what helps the change land.
If your psychosocial system would still function unchanged in a workplace with a different culture and different work design, it isn't really controlling the risk. It's wrapping a generic response around whatever the workplace happens to be. The Regulations expect controls that are specific to the work and the workforce.
What inspectors are looking at, in practice
Below are the operational areas an inspector typically explores in a psychosocial-focused visit. None of these are surprises if you've read the Compliance Code. The pattern that distinguishes prepared employers is not whether they've thought about these areas, but whether they can show the work, not just describe the intention.
Hazard identification specific to your work
The inspector wants to see that you've identified psychosocial hazards as they actually arise in your operation. A retail business has different exposure from a hospital. A logistics yard has different exposure from a contact centre. Generic hazard lists copied from a template don't satisfy the obligation. The expectation is that your hazard identification reflects your actual roles, work environments, and known risk indicators (incident data, absenteeism patterns, exit interview themes, complaint history).
Risk assessment and prioritisation
Once hazards are identified, the inspector wants to see that risks have been assessed in a structured way. What's the likelihood of harm given the work and workforce? What's the severity if harm occurs? Are there interactions between hazards that compound risk? The assessment doesn't have to follow a particular template, but it does have to be more than a tick-the-box rating exercise.
Controls applied at the right level of the hierarchy
This is where the predominant-control test becomes operational. For each significant psychosocial hazard, the inspector wants to understand what control has been applied, why that control is at the level it is, and whether higher-order options were considered before lower-order ones. The justification matters. "We chose training because elimination wasn't reasonably practicable" is a defensible position if you can articulate why. "We chose training because that's what we already had" is not.
Genuine consultation with workers and HSRs
Consultation under the Regulations is not a one-way briefing. The inspector will look for evidence that workers and HSRs have been involved in identifying hazards and developing controls. They may ask HSRs directly, separately from management, what they've been involved in. The gap between "we communicated to staff" and "we consulted with staff" is exactly where many employers fall short.
Triggers for reviewing existing controls
The Regulations require risk controls to be reviewed in prescribed circumstances, including when an incident occurs, when a hazard is reported, when a system of work changes, or when other information suggests existing controls are not adequate. The inspector wants to see that those review triggers are recognised in your system and that recent triggers, if any, were acted upon.
The reporting and incident question
One area where I see confusion is around reporting and complaints. Earlier draft regulations included a requirement for employers to report psychosocial complaints to WorkSafe periodically. That requirement was not included in the final Regulations.
What remains is the existing framework. Notifiable incidents under the OHS Act must still be notified. Workers' compensation claims still flow as they always have. Internal reporting and response processes still need to function. What hasn't changed is your duty to take internal reports seriously, investigate them appropriately, and use them as a trigger for reviewing whether your existing controls are adequate.
An inspector reviewing your psychosocial system will ask how you handle internal reports. A system that records reports but doesn't visibly act on them is sometimes worse than no formal system at all, because it demonstrates that the employer was on notice and didn't respond.
Recording a complaint creates a duty to respond to it. If a worker raises a psychosocial concern and your system captures it without a documented response, that record can be used to establish what you knew and when. Internal reporting systems need to be matched with internal investigation and review processes that actually operate.
Why the EAP-led approach falls short
Many businesses I work with treat psychosocial compliance as a wellbeing question. They have an Employee Assistance Program. They run mental health awareness campaigns. They have a wellbeing committee. None of this is wrong, and a credible psychosocial system will usually include some version of it. But none of it is sufficient, and treating it as the spine of compliance creates a gap the inspector will see.
The reason is the predominant-control rule. EAP, awareness campaigns, and wellbeing programs are all forms of information, instruction, training, or after-the-fact support. They sit at the lower end of the control hierarchy. Used as supporting controls alongside changes to work design, they're useful. Used as the primary mechanism for controlling psychosocial risk, they don't satisfy the Regulations.
The shift many employers haven't yet made is from a wellbeing posture to a risk-management posture. Wellbeing asks "how do we support people coping with the work?" Risk management asks "how do we change the work so it doesn't produce avoidable harm in the first place?" Both have a place. The Regulations require the second to lead, with the first supporting it.
What a credible psychosocial system shows
A system that holds up to inspection generally has the following features. The hazards relevant to the actual work are identified, with documentation that reflects how they were identified. Risks are assessed, with reasoning visible. Controls applied are at the highest order of the hierarchy that is reasonably practicable, with justification for choices made. Consultation with workers and HSRs is documented and observable, not just claimed. Internal reports are captured and acted upon, with records that match. Reviews happen when triggering events occur, with evidence of the review and any resulting changes. Workers can describe, in their own words, what the workplace does about psychosocial risk, and their description aligns with the documented system.
None of this requires a perfect system. It requires a real one. Inspectors are practiced at distinguishing between systems that exist on paper and systems that exist in operation. The latter is what closes a visit cleanly.
The honest summary
Six months in, the picture is reasonably clear. The Regulations are real, the Compliance Code is detailed, and the inspectorate is calibrated rather than punitive. Employers who have made genuine progress on hazard identification, higher-order controls, and consultation are passing scrutiny. Employers who relied on EAP, training, and policy templates are starting to see the gap exposed.
The path forward isn't dramatic. It's a structured review of what your business actually does to identify and control psychosocial risk, an honest assessment of where the controls sit on the hierarchy, and where higher-order changes would be reasonably practicable. The Compliance Code is detailed enough to guide most of the work. What it can't do is decide for you which controls are reasonably practicable in your specific operation. That's the judgement call, and it's where most of our work with clients sits.
If you'd like to walk through where your current system stands relative to the Regulations and Compliance Code, that's the conversation we have. Practical, focused on the gap between what you have and what an inspector expects, and shaped by knowing how a psychosocial-focused inspection actually unfolds.
If you're already responding to a psychosocial-related improvement notice, we've written separately on how to respond to a psychosocial improvement notice, and on improvement notice response more broadly.
Want a structured view of where your psychosocial system stands?
Fifteen minutes. No charge. We'll talk through your current controls, the gaps an inspector would notice, and what's worth prioritising under the new Regulations.
Book a 15-min CallFor HR consultants and HR business partners
If you're advising businesses on the people side of psychosocial risk and you want a partner on the OHS-compliance side, that's a working relationship I value. The split is usually clean: HR handles culture, behaviour standards, complaint resolution, and employee experience; OHS handles hazard identification, risk assessment, control selection at the right hierarchy, consultation under the Act, and the documented system that holds up to WorkSafe scrutiny.
I work with several HR consultants in Victoria where the model is exactly that. Their clients get a coherent response across both functions, and neither of us is doing the other's job.
Inspector at the door, or one expected soon?
If you've had a psychosocial complaint escalated, an inspector visit scheduled, or you simply want a former inspector's view before the matter develops further, talk to us early. Earlier is always cheaper than later.
Talk to a Former InspectorDisclaimer: This article reflects RAS-OHS guidance based on professional experience as a former WorkSafe Victoria inspector. It is general information only, is not official WorkSafe Victoria material, and should not be treated as legal advice. References to the Occupational Health and Safety Act 2004 (Vic), the Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic), and the WorkSafe Victoria Compliance Code for Psychological Health are accurate as at the date of publication, but legislation and guidance can change. For specific obligations or advice on your circumstances, refer to worksafe.vic.gov.au, the current text of the Regulations and Compliance Code, or seek formal legal advice.
Structured. Risk-Based. Enforcement-Aligned.
