The psychosocial code of practice, in plain English

Key takeaways

• A Code of Practice isn't a suggestion. It's admissible in court as evidence of what was "reasonably practicable", which is the exact test your duty is measured against.
• Safe Work Australia's Model Code of Practice: Managing psychosocial hazards at work (August 2022) is the backbone. Most states adopted it close to word for word.
• Victoria runs its own OHS regime and wrote its own Compliance Code, which commenced later and adds requirements the model doesn't have.
• Underneath the legal language, the Code asks for five things: identify the hazards, assess the risk, put in controls, review them, and keep records. Consult your workers the whole way through.
• You don't need to read the whole document to comply with it. You need a system that does those five things on a loop.

We get asked some version of the same question a lot: "Do I actually have to read the Code of Practice, or can someone just tell me what it says?"

Fair question. So we'll save you the read. Here's what it actually says, and what it asks you to do. For the wider picture first, start with what psychosocial safety actually means for your organisation.

What a Code of Practice actually is

A Code of Practice sits underneath the law but above a guideline. It's not the Act, and it's not the Regulations. It's a practical, approved document explaining how to meet a duty that's already in the law.

Here's the bit that makes it matter more than a normal guidance document: it's admissible in court. If a psychosocial injury claim or a regulator investigation ever asks whether you did what was "reasonably practicable", the Code is the yardstick a court reaches for. You can depart from it if you've got a better way. But if you've never looked at it, that's a hard argument to make.

The Model Code, and why Victoria is different

Safe Work Australia writes model laws. Each state and territory then enacts its own version, usually close to identical, sometimes with local tweaks. The Model Code of Practice: Managing psychosocial hazards at work, published in August 2022, is the version most jurisdictions built on. It sets out around 14 common psychosocial hazards, from role overload to poor support to workplace violence, managed using the same identify, assess, control, review cycle that's used for physical safety.

New South Wales, Queensland, Western Australia, Tasmania, the Northern Territory, the ACT, South Australia and the Commonwealth (via Comcare) all have their own Code, commenced at different dates, but built on that same structure.

Victoria is the exception. It runs a separate Occupational Health and Safety regime, not the model WHS Act, and it wrote its own Compliance Code rather than adopting the national one. Victoria's psychosocial regulations commenced 1 December 2025, with no transition period, and its Code includes a few things the model doesn't: for example, training on its own can't be your only control, and larger employers need a written, prospective prevention plan rather than a reactive one. If you operate in Victoria, don't assume the national version covers you. See what's different for Victorian psychosocial hazards.

Every jurisdiction in Australia now has an in-force psychosocial duty and a Code behind it. There's no state left where this is still theoretical.

What the Code actually asks you to do

Strip away the legal framing and the Code is really asking for five things, done in a loop rather than once.

Identify the hazards. Not "do we have a wellbeing problem", but specifically: where does role overload show up, who's carrying poor support, is there exposure to remote or isolated work, harassment, bullying, or poorly managed change. You can't control what you haven't named.

Assess the risk. Once a hazard is identified, you need to understand how likely it is to cause harm and how serious that harm could be. A vague sense that "engineering feels stretched" is not a risk assessment.

Put in controls. The hierarchy of controls that applies to physical safety applies here too. Eliminate the hazard where you can, and where you can't, minimise it. Redesigning a workload beats a wellness webinar, because it changes the actual exposure rather than coaching people to tolerate it.

Review the controls. A control you set six months ago and never checked on isn't a control, it's a hope. The Code expects you to revisit whether what you put in place actually worked.

Keep records. Not for their own sake. Records let you show, later, that you did what a reasonable employer would do, and they turn a vague sense of "things feel better" into something you can actually track.

Running underneath all five: consult your workers. Not survey them once a year and move on. Genuinely consult, at each stage, particularly the people closest to the hazard. The Code is explicit that this isn't optional either.

Where most employers actually fall down

In our consulting work it's rarely the identify step that trips people up. Most leaders can name their psychosocial hazards if you ask them directly. It's the review step. Controls get put in, a policy gets written, a training session gets run, and nobody checks whether any of it changed anything on the ground.

That's the gap continuous measurement is built to close. A once-a-year survey tells you the temperature in July. It doesn't tell you whether the control you put in during March actually worked. See why continuous measurement beats an annual survey.

It's also worth being honest about what the underlying hazards actually are before you try to manage them. If you want the practical list, not the legal summary, see the full list of psychosocial hazards.

What this means for who's accountable

The Code doesn't just describe a process. It implies who's supposed to be running it. Officers have a due diligence obligation to make sure this system exists and is actually being used, not filed away. We've written a separate piece on what duty of care actually means for leaders.

None of this works well as a standalone compliance exercise bolted onto whatever you're already doing. The Code's identify-assess-control-review cycle only holds up if it's connected to how you actually run culture, workload, and support day to day, which is what our Culture module at Whyser Work is built to carry.

Frequently asked questions

Do I have to follow the Code of Practice exactly, word for word?

No. A Code sets out one way to meet the duty, and you can use a different method if it achieves an equal or better standard. Most employers are better off starting from the Code and adjusting, given a court will use it as its reference point either way.

Is the Code the same as the law?

No. The law is the WHS Act and Regulations, which set the duty. The Code explains how to meet it, and is used as evidence of what "reasonably practicable" looks like when that question comes up.

My business is small. Does the Code still apply?

The duty applies regardless of size, though what's "reasonably practicable" scales with size and resources. A larger organisation is generally expected to do more than a five-person team. Neither is exempt from the cycle.

We're in Victoria. Can we just use the national Model Code?

Not safely. Victoria runs a separate regime with its own Compliance Code and some requirements the model doesn't have, including limits on using training as a standalone control and prevention-plan obligations for larger employers. See the Victorian psychosocial hazards specifics rather than assuming national coverage.

This is general guidance to help you understand your obligations. It supports your duty of care, it doesn't replace your own legal and WHS advice.

Once you've read the Code, the real question isn't whether you understand it. It's whether the system running underneath your business could show a regulator, honestly, that you're doing what it describes.