From engagement data to audit-ready psychosocial evidence

Key takeaways

• Most organisations already sit on the data a psychosocial duty needs. What they're missing isn't information, it's the record that proves they looked at it and acted.
• Engagement data and psychosocial evidence aren't the same thing. One tells you how people feel about work. The other shows you identified a hazard, did something, and checked whether it worked.
• The Code of Practice doesn't ask for a perfect workplace. It asks you to identify hazards, control them, and review the controls. That review loop is the bit an engagement survey almost never captures.
• The strongest evidence isn't a glossy annual report. It's a plain, dated trail: here's what we saw, here's what we changed, here's what happened next.
• If a regulator asked you tomorrow to show how you manage psychosocial risk, the honest test is simple. Could you show a trail, or just a survey result?

A CPO said something to us last year that we still think about. "We run more surveys than anyone I know. If someone asked me to prove we're managing psychosocial risk, I'd have no idea what to hand them."

That's the gap in a sentence. Plenty of data, very little evidence. And the two are not the same thing, which is exactly why so many well-run organisations are quietly exposed.

Data and evidence are not the same thing

Engagement data tells you how people feel about working for you. It's useful, and most organisations have years of it sitting in a platform somewhere. But feeling data on its own doesn't satisfy a psychosocial duty, because the duty isn't about sentiment. It's about hazards.

Evidence is narrower and more demanding. It's the record that shows you identified a specific psychosocial hazard, put a control in place, and then checked whether that control actually worked. A high or low engagement score doesn't do that. It's a temperature reading, not a story of what you did about the fever.

Here's the practical version of the difference. An engagement dashboard says "manager support is down four points this quarter." Evidence says "we saw support falling in the operations team in March, we changed the reporting lines and coached the team lead in April, and by June the same measure had recovered." Same starting data. Only one of them would help you in a review.

What a regulator is actually looking for

The psychosocial Codes of Practice across Australia are built on a loop, not a score. Safe Work Australia and the state regulators ask you to identify hazards, assess the risk, control it, and then review those controls. That last step, review, is where most organisations come up short, and it's the step an annual engagement survey was never designed to capture.

Notice what's not on that list. Nobody expects a workplace with zero stress or a perfect score. The duty is about reasonable, active management, and being able to show it. A regulator or a court asking whether you took reasonable steps isn't looking for a flawless culture. They're looking for a trail.

That reframes the whole exercise. You're not trying to prove your people are happy. You're trying to prove you were paying attention, and that when something moved in the wrong direction, you did something and checked the result. For the plain-English version of what those obligations actually say, we've written up what the Code of Practice expects.

Why the annual survey can't carry this

The annual engagement survey has three problems as an evidence source, and they compound.

• It's too slow. Psychosocial risk moves in weeks, and a project blowout or a manager change can tip a team into overload long before the next survey lands. Evidence built on a twelve-month lag is evidence you can't act on in time.
• It's too broad. A single org-wide wellbeing number hides the burnt-out team sitting next to a comfortable one. Hazards live at the team and role level, so evidence has to live there too.
• It doesn't close the loop. The survey tells you the baseline. It almost never tells you whether the thing you changed in response actually worked, because the next data point is a year away.

None of this means the annual survey is worthless. A periodic, validated instrument like the free People at Work assessment, backed by Comcare and Safe Work Australia, is a genuinely good baseline. The problem is only ever relying on it as your single source of truth for something that changes far faster than once a year. We've gone deeper on that contrast in measuring psychosocial risk without another annual survey.

The bridge: everyday data, deliberately turned into a record

Here's the shift that closes the gap, and it's smaller than most leaders expect. You don't need more data. You need the data you already gather to be shaped into a record, on purpose, as you go.

In practice that means a few things running together:

• Read at the team level, regularly. Short, frequent pulses that show you where risk is actually moving, not a company-wide average once a year.
• Track the response, not just the baseline. When you act on a hazard, capture what you did and when, so the next read tells you whether it worked.
• Keep it dated and connected. A hazard, a control, a follow-up, all linked in time. That sequence is the evidence. Assembled after the fact from memory, it's a guess. Captured as you go, it's a record.

The quiet benefit is that this isn't a separate compliance chore bolted onto the real work. Done properly, the record is a byproduct of managing risk well. You're not building a file for the regulator on the side. The file is the same thing as doing the job.

A short example

In our consulting work, we partnered with an organisation that had, on paper, everything. Engagement platform, annual survey, a wellbeing strategy in a deck. When a serious complaint landed, they went looking for their evidence and found a folder of survey PDFs, none of which showed they'd acted on anything specific.

We didn't add a single new survey. We changed the shape of what they already did: team-level reads every few weeks, a simple log of what changed when a risk showed up, and a follow-up read to check it. Six months later, when their board asked the hard question, they had a plain, dated trail for every team. Not a perfect workplace. A demonstrably managed one. That's the difference that matters when someone is actually asking.

If you want to see what that looks like as an operating system rather than a spreadsheet, it's the shape we've built into the Culture module at Whyser Work, with the reporting side over in Insight.

Where to start if you're behind

Don't try to build the whole system in a quarter. Start with your highest-risk teams, the ones where workload, change, or a difficult transition is obvious right now. Get a regular read going there, log what you do about what you find, and follow up. One good, dated trail on your riskiest team is worth more than a shallow score across the whole organisation.

The point isn't to look busy for a regulator. It's that the same discipline that produces the evidence also produces a better-run workplace, because you're finally acting on risk while it's still moving, instead of reading about it a year late. Accountability for that sits higher than most people assume, which we've written about in duty of care and what leaders now own.

Frequently asked questions

Does our engagement survey count as psychosocial evidence?

On its own, usually not. A survey shows sentiment at a point in time. Evidence needs to show the full loop: a hazard identified, a control applied, and a review of whether it worked. A survey can be one input into that, but it isn't the evidence by itself.

What does audit-ready actually mean here?

It means you could show a regulator or a court a clear, dated trail of how you managed a specific psychosocial risk, not just that you measured mood once a year. Identified, acted, reviewed. The Codes of Practice point to exactly that review loop.

Do we need new software to do this?

Not necessarily, though it gets hard to keep a genuine, connected trail across many teams in spreadsheets. What matters is the discipline: regular team-level reads, a record of what you changed, and a follow-up. Software helps mostly by making that loop the default instead of a manual chore.

Is this legal advice?

No. This is general guidance to help you understand your obligations and manage risk well. It supports your duty of care, it doesn't replace your own legal and work health and safety advice for your specific situation.

So here's the question worth sitting with. If someone asked you today to prove you're managing psychosocial risk, would you reach for a survey result, or could you show them the trail of what you actually did about it?