Psychosocial hazards at work: the full list

Key takeaways

• Psychosocial hazards are the specific, recognised conditions of work that can harm someone's mental health. The Model Code of Practice sets out 14 of them.
• They're concrete, not abstract. Each one shows up as an identifiable pattern you can point to in a real team.
• Hazards rarely arrive alone. They tend to combine and concentrate in particular teams or roles, which is exactly where the risk gets serious.
• Managing them is a legal duty, not good practice: Work Health and Safety Act 2011 section 19, and regulations 55A to 55D of the WHS Regulations.
• Naming the hazard correctly is the first step in the assessment process. You can't control what you haven't identified.
• A breach is graded into three offence categories, with industrial manslaughter above them. Maximum penalties are set by each state and territory separately, are indexed annually, and differ between them.
• Every industry has all 14 in theory. In practice they cluster, and your industry's usual cluster is the fastest place to start looking.
• Once you can see the pattern, the fix is usually more specific, and more achievable, than "improve culture."

What is a psychosocial hazard?

A psychosocial hazard is anything in the design, management or organisation of work, or in the working environment, that could cause psychological harm. It's not about someone's personality or resilience. It's about the conditions of the job itself, grouped by the Model Code of Practice into a list every state regulator now works from.

That's close to the legal wording. Regulation 55A defines a psychosocial hazard as one arising from the design or management of work, the work environment, the plant at a workplace, or workplace interactions and behaviours, that may cause psychological harm.

In our consulting work, we once sat with an executive team convinced their turnover problem was "just the market." A look at the exit data showed every resignation had left the same team, under the same manager, citing the same thing: no one told them what was actually expected. That's not the market. That's a named, recognised psychosocial hazard, and once you can name it, you can fix it.

What are the 14 psychosocial hazards?

The Model Code of Practice: Managing psychosocial hazards at work sets out 14. In full:

1. High job demands
2. Low job control
3. Poor support
4. Lack of role clarity
5. Poor organisational change management
6. Low recognition and reward
7. Poor organisational justice
8. Traumatic events or material
9. Remote or isolated work
10. Poor physical environment
11. Violence and aggression
12. Bullying
13. Harassment, including sexual harassment
14. Conflict or poor workplace relationships

It's worth knowing that list cold, because you can't manage what you haven't identified. Here's what each one means, and what it actually looks like in a team.

High job demands

What it means. Sustained workload or time pressure that exceeds what's manageable, for long enough to matter.

What it looks like. A team down two headcount for six months, quietly absorbing the gap. The tell isn't a busy week. It's "busy" becoming the permanent state.

Low job control

What it means. Little or no say over how, when or in what order work gets done.

What it looks like. A process worker who can't influence their pace or method, paired with high demands. High demands with high control is often energising. High demands with low control is where the risk lives.

Poor support

What it means. Inadequate support from supervisors, peers, or the organisation, when someone needs it.

What it looks like. A manager who's unreachable, or who reacts badly when someone flags a problem, so people stop flagging problems. Support isn't a policy on paper. It's whether someone feels backed when things go wrong.

Lack of role clarity

What it means. Not knowing what's expected: responsibilities, priorities, or how performance will be judged.

What it looks like. Two people quietly doing the same job with no idea whose call it is. This one hides well, because everyone assumes someone else explained it.

Poor organisational change management

What it means. Change (restructures, system rollouts, leadership shifts) handled without adequate warning, consultation, or support.

What it looks like. A restructure announced by email with no chance to ask questions. People can usually absorb change. What they struggle to absorb is change done to them.

Low recognition and reward

What it means. Effort and contribution going unnoticed, or reward disconnected from what people actually do.

What it looks like. A high performer whose extra effort has quietly become the new baseline, with no acknowledgment it was ever extra. Its absence is more corrosive than people expect.

Poor organisational justice

What it means. Inconsistent, unfair or non-transparent processes and decisions, whether that's how work is allocated or how complaints are handled.

What it looks like. A complaint that visibly goes nowhere. A promotion that bypasses the obvious internal candidate with no explanation. People tolerate a decision they disagree with more readily than one they can't see the logic in.

Traumatic events or material

What it means. Exposure to traumatic incidents, distressing content, or the aftermath of serious harm as part of the job.

What it looks like. Emergency services roles, but also content moderators and claims staff reviewing distressing material. This needs deliberate, specific controls, not a generic wellbeing program.

Remote or isolated work

What it means. Working alone, or with limited access to support, supervision or colleagues.

What it looks like. A single field worker covering a large territory, or a remote employee who goes days without a real conversation about work. Isolation compounds every other hazard on this list, because no one's nearby to notice.

Poor physical environment

What it means. Noise, heat, poor lighting, or unsafe and uncomfortable workspaces adding sustained stress on top of the work itself.

What it looks like. An open-plan office so loud that focused work needs headphones and heroics. It doesn't need to be dangerous to be a hazard, just a constant, low-grade drain.

Violence and aggression

What it means. Exposure to actual or threatened physical violence, from customers, clients, the public or colleagues.

What it looks like. Retail or healthcare staff facing regular aggressive customers, or a tradesperson working alone in an unpredictable setting. This one tends to get taken seriously once named, which is exactly why naming it matters.

Bullying

What it means. Repeated, unreasonable behaviour directed at a person or group that creates a risk to health and safety.

What it looks like. A manager who consistently belittles one team member in meetings, or a pattern of exclusion hard to pin to one incident but unmistakable over time. Often minimised as "personality clash." It rarely is.

Harassment, including sexual harassment

What it means. Unwelcome conduct of a sexual nature, or harassment on the basis of a protected attribute, creating an offensive or intimidating environment.

What it looks like. Comments dismissed as "just a joke" that the recipient experiences very differently. This carries its own legal obligations beyond the psychosocial duty, and needs its own clear reporting pathway.

Conflict or poor workplace relationships

What it means. Ongoing, unresolved conflict between individuals or groups that isn't being managed.

What it looks like. Two team leads who haven't spoken directly in months, routing everything through their teams instead. Unaddressed conflict doesn't stay contained. It leaks into decisions and into who's included.

How do psychosocial hazards combine?

Here's the pattern we see constantly. These hazards are listed separately because that's how the code sets them out. In real workplaces, they don't show up one at a time.

A team with high demands, low control and poor support isn't three problems. It's one compounding one, usually concentrated in a specific team or manager relationship rather than spread evenly across the business. That's good news for you as a leader: the fix doesn't have to be organisation-wide. It has to be precise.

If you see this pattern	It's usually these hazards, combined
High turnover in one team, low elsewhere	Poor support + lack of role clarity
Constant "urgent" requests, no pushback allowed	High demands + low job control
Complaints go quiet, no one raises issues anymore	Poor organisational justice + poor support
Good performers quietly burning out	High demands + low recognition

Once you can see the combination, you're not managing "culture" in the abstract. You're managing a named, addressable risk.

What law makes these hazards your problem?

Australia runs on model work health and safety law. Safe Work Australia writes a model Act, Regulations and Code of Practice, and each state, territory and the Commonwealth enacts its own version. Three documents carry the duty.

The Act. Under the Work Health and Safety Act 2011, section 19, a PCBU (a person conducting a business or undertaking, which in practice means most employers) must ensure health and safety so far as is reasonably practicable. "Health" includes psychological health, so every hazard on this list sits inside that primary duty. Section 27 puts a matching due-diligence duty on officers personally, and section 47 requires you to consult your workers on matters affecting their health and safety.

The Regulations. Regulations 55A to 55D do the specific work. 55A defines a psychosocial hazard, 55B a psychosocial risk, 55C requires a PCBU to manage those risks, and 55D sets the standard for controls: eliminate the risk so far as is reasonably practicable, and minimise what you can't eliminate. Regulation 55D also lists what you must have regard to when choosing controls, including the duration, frequency and severity of exposure, and how the hazards may interact or combine, which is the pattern described just above written into law.

The Code. The Model Code of Practice: Managing psychosocial hazards at work (August 2022) is where the 14 hazards come from. It isn't the law itself, but it's admissible in court as evidence of what was reasonably practicable at the time, which makes it the yardstick you'll be measured against.

Commencement is the part that varies by jurisdiction. NSW's psychosocial regulation commenced 1 October 2022 and has since been consolidated into the WHS Regulation 2025 (in force 22 August 2025). Queensland followed on 1 April 2023, Western Australia on 24 December 2022 and South Australia on 25 December 2023. Victoria runs a separate OHS regime rather than the model law, and its psychosocial regulations commenced 1 December 2025 with no transition period.

We've written the detail up jurisdiction by jurisdiction: New South Wales, Queensland, Victoria, Western Australia, South Australia and, across the Tasman, New Zealand.

What are the penalties for a psychosocial breach?

Two questions get mixed together here, and they have different answers: what the law can do, and what a regulator actually does. Almost every business that gets this wrong meets the second one, not the first.

The law grades a breach into three categories. The psychosocial duty sits inside them the same way a duty about scaffolding or forklifts does. There's no separate, softer regime for mental health.

• Category 1 is the serious end: gross negligence, or recklessness about a risk of death or serious injury or illness. It carries imprisonment as well as a fine.
• Category 2 is a failure to comply with the duty where that failure exposes someone to a risk of death or serious injury or illness. Recklessness doesn't have to be proven.
• Category 3 is a failure to comply with the duty, full stop. Nobody has to have been exposed to serious risk at all.

Sitting above all three is industrial manslaughter, a separate offence where an intentional breach of the duty causes a death and the person was reckless or negligent about that outcome.

Here's what those tiers are worth under the Commonwealth Work Health and Safety Act 2011, which covers Commonwealth agencies and licensed self-insurers.

Offence	Individual PCBU or officer	Other individual	Body corporate
Category 1	$3,000,000, or 15 years, or both	$1,500,000, or 15 years, or both	$15,000,000
Category 2	$418,000	$209,000	$2,090,000
Category 3	$140,000	$70,000	$700,000
Industrial manslaughter	25 years imprisonment	not applicable	$18,000,000

Two caveats that most articles on this subject leave out. First, those are base amounts. Schedule 4 of that Act indexes them to CPI every 1 July, so the current maximum is higher than the number printed in the legislation. Second, and more important: every state and territory sets its own amounts under its own Act, and they don't match. A figure you read on a compliance blog is usually one jurisdiction's number, quoted as though it were national, and often a version that's since been superseded. Take yours from your own regulator or your own Act, not from us and not from a listicle.

In practice, though, the thing that turns up is a notice. SafeWork NSW runs targeted psychosocial checks at workplaces with 200 or more employees, and a late-2025 campaign issued more than 500 non-compliance notices. Where employers appealed those improvement notices, several were upheld. That's the realistic exposure for most businesses: an inspector, a set of questions about workload and complaints, and a notice with a date on it.

Which is the useful way to think about the penalties. You're not being asked to avoid the maximum fine in the table above. You're being asked whether you can show an inspector a dated record of what you identified, what you did about it, and whether it worked.

Which industries carry the most psychosocial risk?

All 14 hazards can turn up anywhere. But they cluster, and knowing your industry's usual cluster is a fast way to work out where to look first.

Hospitality

Violence and aggression from customers, high job demands, and low job control, usually all at once. Rostering is the tell: split shifts, late finishes and a schedule published two days out remove control from people who already can't control the customer in front of them. A young workforce also raises the stakes on harassment, because the people most exposed are often the least confident about reporting it.

Healthcare and aged care

Exposure to traumatic events and material is the defining hazard, layered on high demands and chronic understaffing. Violence and aggression from patients, residents and families is common enough that it gets normalised, which is the danger. Watch for poor support specifically: clinical supervision is often strong while support for the emotional load of the work is assumed rather than provided.

Education

High demands and low job control, with the workload set by someone else and the hours effectively uncapped. Aggression from parents and students is more common than most schools' incident data suggests, because staff under-report it. Poor organisational justice shows up around workload allocation, which is where a lot of teaching-staff grievances actually originate.

Government and public administration

Poor organisational change management is the standout. Restructures, machinery-of-government changes and shifting priorities arrive from outside the agency and land on people with little say in them. That combines badly with lack of role clarity during a transition, and with poor organisational justice when the process for who lands where isn't visible.

Financial and professional services

High job demands and low recognition, in a form that hides well because the pay is good. Long hours become the baseline, extra effort is absorbed rather than acknowledged, and the target or billable-hours model makes the demand permanent instead of seasonal. Poor support is common in flat, lean teams where everyone is billing and nobody has slack to help.

Construction

High demands and remote or isolated work, plus bullying and harassment in a sector where a hard-edged culture has often been treated as part of the job. The subcontracting chain adds a specific problem: when several businesses share a site, the question of who owes the duty gets blurred, and shared duties under WHS law mean it lands on all of them, not none.

Retail

Violence and aggression, low job control and isolated work. Sole trading, late-night shifts and one person on a counter make the aggression hazard sharper and the support hazard worse at the same time. Rostering practices decide most of it, which means the control is usually available and sits with someone who isn't in the store.

What's common to all seven is that the hazards cluster around how work is designed and rostered, not around individual resilience. That's also where the fix is. If your industry isn't on this list, the method doesn't change: start from the 14, work out which ones your work design actually creates, and check them against real data rather than assumption.

What do you do with this list?

Naming the hazard is step one, not the whole job. Once you know which of these are present in your business, and where, the next move is to assess how serious each one is and work out what to do about it. We walk through that process in how to run a psychosocial risk assessment, with a simple template for tracking it.

For the duty in full, see psychosocial safety at work. For where accountability sits once a hazard is identified, duty of care and psychosocial risk covers that directly.

This is general guidance, not legal advice. It'll help you name what you're seeing; it doesn't replace your own legal and WHS advice.

Frequently asked questions

Do all 14 hazards need to be assessed in every workplace?

You should be aware of all of them, but not every hazard will be present, or present at a meaningful level, in every workplace. Identification means working out which ones actually show up in your business, and where, not ticking off a uniform checklist regardless of relevance.

Is one instance of bullying automatically a psychosocial hazard?

The Model Code frames hazards as conditions of work, and bullying specifically involves repeated, unreasonable behaviour, not a single poor interaction. A single serious incident still needs to be taken seriously and managed in its own right, alongside the ongoing hazard framework rather than strictly inside it.

How do we find out which hazards are actually present in our business?

Look at real data rather than guessing: exit interview themes, absenteeism patterns, grievances, incident reports, and well-facilitated conversations with staff. We cover this in how to run a psychosocial risk assessment.

What's the maximum fine for a psychosocial breach in Australia?

There isn't a single national figure. Each state and territory sets its own maximum amounts under its own Act, most of them index those amounts annually, and the number depends on which of the three offence categories applies and whether the defendant is an individual, an officer or a body corporate. Under the Commonwealth Work Health and Safety Act 2011, Schedule 4, a Category 1 offence carries up to $3,000,000 and 15 years imprisonment for an individual PCBU or officer, and $15,000,000 for a body corporate, before indexation. Check your own jurisdiction rather than reusing a figure quoted elsewhere.

Which industries have the highest psychosocial risk?

Hospitality, healthcare and aged care, education, government, financial and professional services, construction and retail all carry well-recognised clusters, though the hazards involved differ sharply between them. Exposure follows how work is designed and rostered rather than the sector label, so a well-designed job in a high-risk industry can carry less risk than a poorly designed one in a low-risk industry.

Is a psychosocial hazard the same as a mental health condition?

No. A hazard is a condition of work that could cause harm, separate from whether a specific person develops a mental health condition as a result. You manage the hazard regardless of whether harm has occurred yet, the same logic as fixing a trip hazard before someone falls.

Once you've named the hazards in your own workplace, Whyser Work's culture module is built to help you track and act on them as part of everyday work rather than a separate compliance project. Or book a demo if you'd rather talk through what you're seeing.

Which of these 14 would your own team name first, if you asked them honestly?