WHS risk management — Work Health and Safety risk management — is the ongoing process of identifying hazards in your workplace, understanding the risk they pose to workers, putting controls in place to reduce that risk, and checking those controls are actually working. In Australia it’s a legal requirement, not a best practice, under the Work Health and Safety Act 2011 and its state and territory equivalents. What’s changed in recent years is the scope: psychosocial hazards — stress, bullying, fatigue, isolation — are now just as enforceable as the physical ones, and regulators are actively pursuing businesses that haven’t addressed them.

WHS obligations also vary significantly by industry. Construction companies face Safe Work Method Statements, licensed high-risk work requirements, and new silica register rules. NDIS and aged care providers have sector-specific incident management and governance obligations. Healthcare businesses carry AHPRA practitioner compliance duties on top of their WHS framework. See our full breakdown of compliance obligations by industry across Australia.

WHS risk management is no longer something you can treat as a back-office compliance exercise. In 2026, Australian businesses face a regulatory environment that is stricter, broader, and better enforced than at any point in the country’s history. The rules now cover not just physical hazards — falls, machinery, chemical exposures — but psychological ones too. Psychosocial hazards are now enforceable in every state and territory.

The stakes are real. Safe Work Australia data shows there were 146,700 serious workers’ compensation claims in 2023–24 — that is more than 400 serious claims every single working day. 188 workers lost their lives to traumatic workplace injuries in 2024. Mental health claims have surged 161% over the past decade, and the median time off work for a mental health claim is almost five times longer than for a physical injury.

This guide gives Australian safety managers, HR professionals, and business owners everything they need to understand, implement, and maintain an effective WHS risk management program. We cover the legal framework, the step-by-step process, risk ratings, psychosocial hazards, documentation, and the most common mistakes businesses make.

---

Table of Contents

1. What Is WHS Risk Management?
2. The Legal Framework: WHS in Australia
3. The WHS Risk Management Process Step by Step
4. Understanding Risk Ratings: Likelihood and Consequence
5. Psychosocial Hazards: The New WHS Priority
6. WHS Risk Register: What It Must Include
7. WHS Documentation: What Regulators Actually Want to See
8. Common WHS Risk Management Mistakes
9. How Lahebo Supports WHS Risk Management
10. Frequently Asked Questions

---

What Is WHS Risk Management? 

WHS risk management is the systematic process of identifying hazards in your workplace, assessing the risk those hazards pose to workers, implementing controls to eliminate or minimise that risk, and reviewing those controls over time. It sits at the heart of every organisation’s work health and safety obligations in Australia.

Think of it this way: your workplace is not static. People, processes, equipment, and environments change constantly. WHS risk management is the ongoing discipline that keeps your hazard controls current, your people safe, and your business on the right side of the law.

The term “WHS” (Work Health and Safety) replaced “OHS” (Occupational Health and Safety) in most Australian jurisdictions following the adoption of the model WHS Act from 2011 onwards. You will still see “OHS risk management Australia” used interchangeably, particularly in Victoria, which retained its own OHS Act. For practical purposes, WHS and OHS risk management refer to the same core process.

Who Is Responsible?

Under Australian WHS law, the primary duty holder is the Person Conducting a Business or Undertaking — the PCBU. That term covers sole traders, partnerships, companies, and not-for-profits. PCBUs must ensure, so far as is reasonably practicable, the health and safety of workers and others affected by their work.

Officers — directors, executives, board members — carry their own positive duty to exercise due diligence. They cannot simply delegate WHS responsibility downward and wash their hands of it. Officers face personal fines of up to $600,000 for Category 2 offences and up to $6 million for PCBUs for the same.

Workers also have duties: to take reasonable care for their own health and safety and for others who may be affected by their actions or omissions. WHS risk management is not a one-person job — it requires genuine participation from the entire organisation.

Why It Matters Beyond Compliance

Good WHS risk management reduces injuries, absenteeism, and workers’ compensation costs. It protects your business reputation. It builds worker trust and retention — a significant factor in the current labour market. And it positions your organisation as one that treats people as its most valuable asset, not just its biggest liability.

---

The Legal Framework: WHS in Australia 

Australia’s WHS framework is built on a model law — the Model Work Health and Safety Act — developed by Safe Work Australia and adopted (with variations) by most states and territories. Understanding the structure of this framework is essential for any business operating across multiple jurisdictions.

The Model WHS Act

Safe Work Australia is the national policy body that develops the model WHS laws, national guidance material, and codes of practice. It does not enforce the law — that responsibility sits with each state and territory regulator. Safe Work Australia sets the policy framework; the regulators give it teeth.

The Model WHS Act creates a risk-based, outcomes-focused legislative framework. Rather than prescribing exactly how you must manage every hazard, it requires you to achieve a result: health and safety risks reduced so far as is reasonably practicable.

State and Territory Variations

This is where it gets complicated for businesses operating across state lines.

New South Wales — Regulator: SafeWork NSW. NSW adopted the model WHS Act and overhauled its regulations in August 2025, replacing the 2017 Regulation with a modernised psychosocial-first framework. From 1 July 2026, approved Codes of Practice — including the Managing Psychosocial Hazards at Work Code — become legally enforceable compliance benchmarks rather than advisory guidance.

Victoria — Regulator: WorkSafe Victoria. Victoria retains its own Occupational Health and Safety Act 2004 and has not adopted the model WHS Act. In December 2025, Victoria introduced standalone psychosocial health regulations that completed the national framework. Employers in Victoria now face the same duty to manage psychological risks as physical ones, but under a different legislative vehicle.

Queensland — Regulator: Workplace Health and Safety Queensland. Queensland adopted the model WHS Act and has enforceable psychosocial hazard provisions under its WHS Regulation 2011 (as amended).

South Australia — Regulator: SafeWork SA. The WHS (High Risk Construction Work) Amendment Regulations 2025 changed the threshold for high-risk construction from a fall risk of more than three metres to more than two metres, effective 1 July 2026.

Western Australia — Regulator: WorkSafe WA. WA adopted the model WHS Act from 2022. Psychosocial hazard provisions apply.

Tasmania, ACT, Northern Territory — Each has adopted the model WHS Act with minor jurisdictional variations.

The bottom line: regardless of where your business operates in Australia, you are now subject to legally enforceable obligations to manage psychosocial hazards using the same rigour applied to physical risks.

The Hierarchy of Controls

Australian WHS law and guidance uses the Hierarchy of Controls to determine the adequacy of risk management measures. Controls are ranked from most to least effective:

1. Elimination — remove the hazard entirely
2. Substitution — replace it with something less hazardous
3. Isolation — separate people from the hazard
4. Engineering controls — physical modifications to the workplace or equipment
5. Administrative controls — work procedures, training, scheduling
6. Personal protective equipment (PPE) — last resort, not a primary control

Regulators expect you to work down the hierarchy, not start at PPE and call it done.

---

The WHS Risk Management Process Step by Step

The WHS risk management process follows four core steps: identify, assess, control, and review. This is the framework prescribed in the Code of Practice: How to Manage Work Health and Safety Risks, published by Safe Work Australia. Every business in Australia should be working within this structure.

Step 1: Identify Hazards

A hazard is anything with the potential to cause harm. Hazards fall into several broad categories:

• Physical hazards — noise, manual handling, machinery, working at heights, electricity, thermal environments
• Chemical hazards — dusts, vapours, solvents, aerosols, biological agents
• Psychosocial hazards — job demands, poor support, workplace violence, bullying, fatigue (more on these below)
• Environmental hazards — weather exposure, uneven surfaces, poor lighting

Hazard identification should not be a single annual event. It should be triggered by workplace changes, near-miss incidents, worker concerns, inspection findings, and routine workplace monitoring. Workers are often your best source of hazard intelligence — they see things managers do not.

Effective identification tools include:

• Workplace inspections and walkthroughs
• Review of incident and near-miss records
• Health monitoring data
• Worker surveys and consultation
• Job Safety Analyses (JSAs) and Safe Work Method Statements (SWMS)
• Manufacturer safety data sheets

Step 2: Assess the Risk

Not every hazard poses the same level of risk. Risk assessment gives you a way to prioritise — to direct your resources towards the hazards most likely to cause serious harm.

Risk is typically assessed on two dimensions:

• Likelihood — how probable is it that harm will occur?
• Consequence — how severe would the harm be if it did?

Combining these two dimensions gives you a risk rating: low, medium, high, or extreme. This rating drives how urgently you need to act and how robust your controls need to be.

Risk assessments should be documented. If a regulator or insurer ever asks for evidence of your WHS risk management practices, a well-structured risk assessment is one of the first documents they will request.

Step 3: Implement Controls

Once you have assessed your risks, you implement controls using the hierarchy described above. The goal is to eliminate the hazard if at all possible. Where elimination is not reasonably practicable, you work down the hierarchy.

A few things to keep in mind here:

• Controls must be selected based on their effectiveness, not their cost alone
• Multiple controls layered together (known as a “swiss cheese” model) are often more effective than a single control
• Consulting with workers in selecting controls is both a legal requirement and a practical one — workers understand the real-world constraints better than any policy document

Step 4: Review Controls

Controls are not set-and-forget. They degrade, become irrelevant, or get bypassed as workplaces evolve. Australian WHS law requires you to review risk controls:

• After any incident or near-miss
• When a new hazard is identified or risk level changes
• When consultation reveals controls are not working
• When there is a change to the workplace, work processes, or workforce
• At regular intervals appropriate to the risk level

This review cycle is where many businesses fall short. They complete the first three steps diligently, then file the paperwork and move on. Regulators are increasingly focused on whether controls are actually being monitored and maintained over time.

---

Understanding Risk Ratings: Likelihood and Consequence {#risk-ratings}

Risk ratings turn subjective judgements into structured, defensible decisions. They are the engine of your risk assessment process.

The Risk Matrix

A risk matrix plots likelihood against consequence to produce a risk rating. Most Australian WHS frameworks use a five-by-five or four-by-four matrix, though the exact number of levels can vary.

Likelihood levels typically range from:

• Rare — could happen but probably won’t (once every many years)
• Unlikely — could happen at some time
• Possible — might happen occasionally
• Likely — will probably happen at some time
• Almost certain — expected to happen in most circumstances

Consequence levels typically range from:

• Negligible — first aid only, no time off work
• Minor — medical treatment required, limited time off work
• Moderate — significant injury, extended time off work
• Major — serious injury, permanent disability
• Catastrophic — death or multiple serious injuries

Combining these dimensions gives you risk ratings from low through to extreme.

Acting on Risk Ratings

Risk ratings are meaningless unless they drive action. A sensible framework looks like this:

Risk Rating	Required Action
Extreme	Immediate action; cease activity if necessary; escalate to senior management
High	Urgent action required; controls must be implemented before or very soon after work resumes
Medium	Implement controls within a defined timeframe; monitor closely
Low	Manage through routine procedures; review at scheduled intervals

One editorial note worth making: many organisations fall into the trap of anchoring their risk ratings too conservatively, rating everything as “low” or “medium” to avoid having to take action. This is not just poor practice — it is a liability. If a regulator investigates an incident and finds your risk matrix rated that hazard as “low” when the evidence suggested otherwise, your documentation becomes evidence against you, not for you.

---

Psychosocial Hazards: The New WHS Priority

If there is one area of WHS risk management that has fundamentally shifted in the past three years, it is psychosocial hazards. What was once treated as an HR sensitivity issue is now a hard legal obligation — and the enforcement environment is tightening.

What Are Psychosocial Hazards?

Psychosocial hazards are aspects of work design, the work environment, and workplace relationships that can cause psychological or physical harm. The Safe Work Australia model Code of Practice identifies the following primary psychosocial hazards:

• High and low job demands — excessive workload, time pressure, emotionally demanding work, or conversely, under-stimulating work
• Low job control — workers having little say over how or when they do their work
• Poor support — inadequate support from supervisors or colleagues
• Low role clarity — workers not knowing what is expected of them
• Poor organisational change management — poorly communicated or handled restructures
• Low reward and recognition — work not being valued or acknowledged
• Poor organisational justice — procedural unfairness, lack of consultation
• Traumatic events or material — exposure to distressing events, violence, or graphic content
• Remote or isolated work — physical isolation or lone working
• Violent or aggressive behaviour — from customers, clients, or co-workers
• Bullying, harassment, and sexual harassment
• Conflict or poor workplace relationships
• Fatigue — excessive hours, shiftwork, inadequate rest

Why They Are Now Enforceable

From 1 December 2025, psychosocial hazards became legally enforceable in every Australian jurisdiction. Victoria’s standalone psychosocial health regulations came into force in December 2025, completing the national picture. NSW transformed its Codes of Practice — including the Managing Psychosocial Hazards at Work Code — into enforceable compliance benchmarks from mid-2026.

This is not a small change. Regulators now expect you to manage psychological risks using the same four-step process — identify, assess, control, review — that you apply to physical hazards. “We have an EAP” is not a control. Neither is a wellness newsletter. The Regulation requires PCBUs to use higher-order controls: redesigning work, addressing structural causes, not just providing reactive support.

What Evidence Do You Need?

Regulators investigating a psychosocial hazard complaint or incident will want to see:

• Evidence of hazard identification — how did you know the hazard existed? What consultation did you conduct with workers?
• A documented risk assessment — what was the risk level, and why?
• Control measures — what controls did you put in place, and where do they sit on the hierarchy of controls?
• Consultation records — evidence that workers were involved in the process
• Review activity — when were the controls last reviewed, and what triggered that review?

The data supports the urgency here. Over the last decade, mental health claims have increased by 161%. The median time lost for a mental health claim is nearly five times longer than for other injuries. The median compensation paid is more than four times higher. Psychosocial hazards are not a soft issue — they are one of the most expensive categories of workplace harm in Australia.

---

WHS Risk Register: What It Must Include {#risk-register}

A risk register is the central repository for all identified risks in your business. For WHS purposes, it is the living document that captures every hazard, its assessed risk level, the controls in place, and the review history. It is also one of the first things a regulator or auditor will ask for.

Your WHS risk register should include, at minimum:

1. Hazard identification details
– A clear description of the hazard
– Where it was identified (location, task, work area)
– How it was identified (inspection, incident review, worker report, etc.)
– The date of identification

2. Risk assessment
– Inherent risk rating — what is the risk level before any controls are applied?
– Likelihood and consequence ratings, with the basis for each rating documented
– Who conducted the assessment and when

3. Control measures
– A description of each control measure in place
– Where each control sits on the hierarchy of controls
– The responsible person for implementing and maintaining each control
– Implementation date

4. Residual risk rating
– The risk rating after controls are applied
– Is the residual risk acceptable, or are further controls required?

5. Review information
– When are controls next due for review?
– When were controls last reviewed?
– What triggered the review?
– What changes (if any) were made as a result?

6. Incident linkage
– Any incidents or near-misses associated with this hazard
– Whether those incidents triggered a control review

A well-maintained WHS risk register is not just a compliance document — it is a management tool. It tells you where your highest-risk exposures are, where your controls are weakest, and where your next inspection effort should be focused.

---

WHS Documentation: What Regulators Actually Want to See 

Australian WHS regulations do not always mandate specific documents. What they mandate are outcomes: that you have identified hazards, assessed risks, implemented controls, and reviewed them. Documentation is how you prove you have done that.

Here is what regulators and insurers will typically ask for in a workplace investigation or compliance audit:

1. Risk Register

As described above. It should be current, dated, and show evidence of regular review. A risk register that has not been updated in two years is often worse than no risk register at all — it shows you created documentation and then ignored it.

2. Safe Work Method Statements (SWMS)

Required for all high-risk construction work. An SWMS identifies the high-risk construction work activities, the hazards and risks, and the control measures to be put in place.

3. Incident and Near-Miss Records

Complete records of every incident and near-miss, including the date, what happened, who was involved, what immediate action was taken, the investigation findings, and the corrective actions implemented. Incident records are a goldmine of hazard data — and a regulator will use them to assess whether your controls are working.

4. Worker Consultation Records

Evidence that workers have been genuinely consulted. This can include toolbox talk records, safety committee minutes, sign-on sheets for training sessions, or survey results. “We consulted informally” is not an answer that satisfies a regulator.

5. Training Records

Who has completed what WHS training, when, and whether their training is current. Induction records for contractors and visitors. Competency evidence for workers operating high-risk equipment.

6. Inspection Records

Regular workplace inspection reports, corrective action logs, and evidence that identified issues were followed up and closed out.

The key word across all of these is “current.” Documents that are outdated, incomplete, or clearly produced in a hurry after an incident carry very little evidentiary weight. Good WHS documentation is maintained continuously, not assembled in a panic.

---

Common WHS Risk Management Mistakes {#common-mistakes}

After years of working with Australian businesses, the same patterns of failure appear again and again. Here are the most common WHS risk management mistakes — and why they are so costly.

1. Treating Risk Management as a Once-a-Year Event

A risk register reviewed annually is almost certainly out of date. Workplaces change. Personnel change. Processes change. Hazards emerge and evolve. Your risk management process needs to be embedded in everyday operations, not treated as an annual compliance ritual.

2. Mistaking Documentation for Management

Creating a risk register, safe work procedures, and training records does not make your workplace safe. Those documents only have value if they reflect actual practice. Regulators are increasingly sophisticated at spotting the gap between paper compliance and real-world performance.

3. Ignoring Psychosocial Hazards

This remains the single biggest gap in most Australian businesses’ WHS programs. The regulatory environment has fundamentally changed. An organisation that has a comprehensive physical hazard program but no psychosocial hazard management process is now non-compliant — and exposed.

4. PPE as a First Response

Reaching for personal protective equipment before exhausting higher-order controls is both legally insufficient and practically ineffective. PPE fails. It is worn incorrectly, damaged, or simply not worn. Hierarchy of controls exists for good reason.

5. Poor Contractor Management

Many businesses apply rigorous WHS processes internally but extend minimal oversight to contractors and labour hire workers. Under Australian WHS law, the PCBU has duties to contractors working on their premises or under their management or control. Those duties are real and regularly prosecuted.

6. No Follow-Through on Corrective Actions

Incidents are investigated. Actions are identified. Nobody closes them out. This is one of the most common findings in WHS audits — a graveyard of corrective actions with no completion dates, no responsible person, and no evidence of resolution.

---

How Lahebo Supports WHS Risk Management {#how-lahebo-helps}

Managing WHS risk effectively across a growing business requires more than spreadsheets and shared drives. Lahebo is GRC software built specifically for Australian businesses — and WHS risk management sits at its core.

Risk Register

Lahebo’s risk register gives you a single, structured repository for all your identified WHS risks. Each risk entry captures the hazard description, likelihood and consequence ratings, control measures, responsible owners, and review dates. Nothing falls through the cracks. Nothing sits in someone’s inbox. Every risk is visible, tracked, and owned.

WHS Management

Lahebo’s WHS module supports the full four-step risk management cycle. Identify hazards, assess risks, assign controls, and schedule reviews — all in one place. Safety managers get a real-time view of their risk exposure. Executives get the oversight they need to exercise their due diligence duty.

Incident Reporting

Workers can log incidents and near-misses directly in Lahebo — from any device. Every report triggers a structured investigation workflow, ensuring corrective actions are assigned, tracked, and closed out. Your incident records become a searchable asset, not a pile of paper forms in a filing cabinet.

Compliance Register

Stay across your WHS legislative obligations with Lahebo’s compliance register. Track which laws, regulations, and codes of practice apply to your business, assign ownership of compliance tasks, and maintain evidence of what you have done and when.

Policy Management

Create, version, and distribute WHS policies and procedures through Lahebo. Get confirmation that workers have read and acknowledged critical documents. Ensure your policy library reflects current law — and that you can prove it.

Lahebo is designed for Australian SMEs, safety managers, HR teams, and the directors who carry personal liability for WHS outcomes. It is practical, purpose-built, and priced for businesses that are serious about safety without wanting enterprise software complexity.

---

Frequently Asked Questions {#faq}

Frequently Asked Questions

Q: What is WHS risk management?

A: WHS risk management is the systematic process of identifying workplace hazards, assessing the likelihood and consequence of harm, implementing controls to eliminate or minimise that risk, and reviewing those controls over time. It is a core legal obligation for all Australian businesses under the Work Health and Safety Act and equivalent state legislation. The goal is to protect the physical and psychological health of everyone in your workplace.

Q: Is WHS risk management a legal requirement in Australia?

A: Yes. Every business in Australia that employs workers — or has contractors, visitors, or members of the public on their premises — has a legal duty to manage WHS risks. The primary duty sits with the Person Conducting a Business or Undertaking (PCBU), who must ensure health and safety so far as is reasonably practicable. Officers of a PCBU have an additional personal duty of due diligence. Failure to meet these duties can result in significant fines and, in serious cases, criminal prosecution.

Q: What are psychosocial hazards under Australian WHS law?

A: Psychosocial hazards are aspects of work design, the work environment, and workplace relationships that can cause psychological or physical harm. Examples include high job demands, low job control, poor workplace support, bullying and harassment, workplace violence, role ambiguity, and poorly managed organisational change. Since December 2025, psychosocial hazards are legally enforceable in every Australian state and territory. PCBUs must manage them using the same four-step risk management process applied to physical hazards — and regulators expect documented evidence of identification, assessment, controls, and review.

Q: What should a WHS risk register include?

A: A WHS risk register should include: a description of each identified hazard; the location and date of identification; the inherent risk rating (before controls); the likelihood and consequence ratings with documented reasoning; the control measures in place and where they sit on the hierarchy of controls; the residual risk rating (after controls); the responsible person for each control; the next review date; and any linked incidents or near-misses. The register should be a live document, updated whenever new hazards are identified, incidents occur, or controls are reviewed.

Q: How often should WHS risk assessments be reviewed?

A: There is no single prescribed review frequency in Australian WHS law — the requirement is that you review controls when there is reason to. Specifically, you should review when: an incident or near-miss occurs; a new hazard is identified; consultation with workers reveals controls are not working; there is a change to the workplace, work processes, or workforce; or at regular intervals appropriate to the risk level. For high-risk activities, quarterly or more frequent reviews may be appropriate. For lower-risk activities, an annual cycle may suffice. What is not acceptable is setting a review date and then missing it without any follow-up.

---

Take Control of WHS Risk Management with Lahebo

WHS risk management is not getting simpler. The regulatory framework is expanding — psychosocial hazards are now enforceable, codes of practice are becoming compliance benchmarks, and regulators are better resourced than ever. Australian businesses that continue to manage WHS risk through spreadsheets, shared folders, and annual rituals are running out of runway.

Lahebo is purpose-built GRC software for Australian businesses that take their WHS obligations seriously. From risk registers and incident reporting to compliance tracking and policy management, Lahebo gives safety managers, HR professionals, and executives the tools they need to manage WHS risk with confidence — and the documentation to prove it.

Ready to replace the spreadsheets? Book a free demo and see how Lahebo works for businesses like yours.

Book a Demo with Lahebo

---

Sources used in this article:
– Safe Work Australia — Key Work Health and Safety Statistics Australia 2025
– Safe Work Australia — Psychosocial Hazards guidance
– SafeWork NSW — WHS Regulations 2025
– Safe Work Australia — Model WHS Regulations and Code of Practice for psychological harm
– WorkSafe Victoria — Psychosocial Health Regulations 2025
– SafeWork SA — WHS (High Risk Construction Work) Amendment Regulations 2025