Duty of care and psychosocial risk: what leaders now own

Key takeaways

• The organisation itself, the PCBU, carries the primary duty. Officers and directors carry a separate due diligence obligation to make sure that duty is actually being met.
• "Reasonably practicable" isn't a vague get-out. It's a specific test, weighing the likelihood and severity of harm against what's genuinely available to fix it.
• Psychological health now sits on the same legal footing as physical safety. That's a recent and deliberate shift, not a soft add-on to existing WHS obligations.
• SafeWork NSW's own enforcement activity, workplace checks and hundreds of notices issued, shows this is being tested in practice, not sitting quietly on the books.
• A board or exec team shouldn't be asking "do we have a wellbeing program". They should be asking "can we show, with data, that we identified our psychosocial risks and did something about them".

In our consulting work last month, a CEO asked us, half joking, "Who's actually on the hook if this goes wrong?" It wasn't really a joke. Most leadership teams haven't sat down and answered it properly, and it only makes sense once you understand what psychosocial safety actually requires. So let's start with who's answering it.

Who carries the duty

The primary legal duty sits with the PCBU, the person conducting a business or undertaking, in practice the organisation itself. The PCBU has a positive duty to eliminate psychosocial risk so far as reasonably practicable, and where it can't be eliminated, to minimise it.

Sitting alongside that is a separate obligation on officers, typically directors and others who make or participate in decisions affecting a substantial part of the business. Officers carry a due diligence duty. That doesn't mean they personally run the risk assessments. It means taking reasonable steps to make sure the organisation has the systems in place to manage the risk, and that those systems are actually being used, resourced, and reviewed, not written up once and filed.

Then there's the day-to-day layer: managers. They don't carry the same formal legal weight as officers, but they're closest to where psychosocial hazards actually show up: workload, support, role clarity, how change gets handled. A system that only exists at board level and never reaches a team leader isn't managing anything. It's a document.

Put simply: the organisation owns the duty, officers own making sure the system exists and works, and managers own running it where the risk lives.

What "reasonably practicable" actually means

This phrase does a lot of legal work. "Reasonably practicable" isn't "whatever's convenient" and it isn't "everything humanly possible" either. It's a weighing exercise: how likely is the harm, how severe could it be, what's known about managing it, and what's available to fix it, weighed against the cost and effort of doing so.

In practice, this means:

• You don't need to eliminate every possible source of stress. That's not the test, and it's not achievable.
• You do need a genuine, documented process for identifying your actual hazards and doing something proportionate about them.
• "We didn't know" is a weak defence once the Code of Practice exists and sets out what a reasonable employer is expected to look for. We've broken down what the Code specifically asks for.
• Cost isn't an automatic excuse. A large, well-resourced organisation is expected to do more than a five-person team facing the same hazard, because more is reasonably available to it.

This is where leaders get nervous, because "reasonably practicable" sounds subjective. It is, to a point, but it's not arbitrary. It's tested against what the Code says, what similar organisations do, and what you genuinely had available.

Why psychological health now sits alongside physical safety

For a long time, workplace safety meant hard hats, machinery guards, and incident reports. Psychological health sat somewhere in the HR wellbeing column, adjacent to safety but not really part of it.

That's changed, deliberately. Every Australian jurisdiction now has an in-force psychosocial duty and a Code of Practice behind it, the same legal category as physical hazards, assessed with the same identify, assess, control, review cycle. A psychosocial hazard, role overload, poor support, exposure to workplace violence, is now managed under the same duty of care as a trip hazard on a factory floor.

If you wouldn't accept "we didn't get around to fixing the trip hazard" as an answer, the same logic now applies to "we didn't get around to addressing the chronic overload in that team".

This isn't theoretical: what enforcement actually looks like

It's tempting to treat all of this as a compliance formality until it's tested. It's already being tested.

SafeWork NSW runs psychosocial workplace checks at businesses with 200 or more employees, and a campaign in late 2025 issued more than 500 non-compliance notices. Improvement notices have been upheld on appeal. That's active enforcement with real consequences, in a jurisdiction most Australian businesses of any size operate in, and it's the practical reason this belongs on a board agenda, not just an HR one.

What a board or exec should actually be asking for

If you're in a leadership or governance role, here's where we'd point the questions, not "do we have a wellbeing program", which tells you almost nothing about whether the duty is being met.

• Can we name our top psychosocial hazards, specifically, by team? Not a vague sense of "morale's a bit low in ops", an actual identified list.
• When did we last assess the risk, and how? A validated instrument, like the free People at Work assessment, not a hallway impression.
• What controls have we put in, and did we check whether they worked? Reviewing a control is part of the duty, not an optional extra. More on why a once-a-year check misses this.
• Could we produce a record of all of this if asked? Not assembled retrospectively after an incident, an ongoing one.
• Who owns this day to day, with the authority and resourcing to act on what they find?

If the honest answer to more than one of those is "not really", that's worth acting on before a regulator or a claim forces the question.

None of this holds up as a one-off compliance exercise. A board can ask the right questions once and still have nothing to show twelve months later if there's no ongoing system underneath, running at the level where the risk actually lives and connected to how the organisation manages culture and workload day to day, which is what our Culture module at Whyser Work is built to support.

Frequently asked questions

Can an individual director be personally liable for a psychosocial failure?

Officers carry a due diligence duty distinct from the organisation's own duty, and failing to meet it can carry personal consequences under WHS law. This depends on the specific facts and jurisdiction, so treat it as a reason to seek your own legal advice rather than a definitive answer.

Does this apply to small businesses, or just large employers?

The duty applies regardless of size. What counts as "reasonably practicable" scales with size and resources, so a small employer isn't expected to do what a large one can, but no business is exempt from the underlying duty.

What's the difference between the PCBU's duty and an officer's duty?

The PCBU, generally the organisation, has the primary duty to eliminate or minimise psychosocial risk. Officers have a separate due diligence duty to make sure the organisation has the systems in place to do that, and that they're resourced and working, not existing only on paper.

Is a wellbeing program enough to satisfy the duty of care?

Not on its own. A wellbeing program that offers support after the fact doesn't identify or control the underlying hazards, which is what the duty requires. It's a useful complement to a genuine identify, assess, control, review system, not a substitute for one.

This is general guidance to help you understand your obligations. It supports your duty of care, it doesn't replace your own legal and WHS advice.

So if a regulator walked in tomorrow and asked what your organisation has actually done about psychosocial risk this year, who in your leadership team could answer that with evidence, rather than an impression?