Our risks are pretty low. We are just an office.

It is a common view across office-based businesses, retail stores, warehouses and customer-facing environments. The work appears organised and controlled, and serious incidents may never have occurred. Over time, that becomes a belief: we are low risk.

But under Australian WHS legislation, that belief can leave a business significantly exposed. Low risk is not a legal category, and the obligations under the WHS Act do not reduce because a workplace feels safe or well-managed. The WHS Act and Regulations apply to all businesses, regardless of size or industry.

What has shifted in recent years is the psychosocial space. Many businesses that had their physical hazards reasonably under control now have real gaps in how they identify and manage risks to psychological health, and most do not know it yet.

Under WHS laws, businesses (referred to as PCBUs, Persons Conducting a Business or Undertaking) must ensure, so far as is reasonably practicable, the health and safety of all workers, contractors, visitors and members of the public. In Victoria, the same duties exist under the Occupational Health and Safety Act 2004. Importantly, health under WHS legislation includes both physical and psychological health.

Many businesses are not aware of all the WHS Regulations that apply to them

One of the most common issues I see is that businesses do not fully understand which WHS Regulations apply to their operations. The Regulations contain detailed legal requirements covering areas such as:

  • hazardous manual tasks (manual handling)
  • plant and equipment safety
  • workplace layout and housekeeping
  • traffic management and vehicle interaction
  • hazardous chemicals and substances
  • emergency planning and response
  • incident notification requirements
  • worker training, instruction and supervision
  • consultation with workers on health and safety matters
  • psychosocial hazards and psychological health risks

Most businesses are aware they have general safety responsibilities. However, many are not familiar with the specific Regulations that apply to their workplace. This can leave organisations exposed if an incident occurs or if a regulator attends the workplace.

When regulators inspect a workplace, they do not simply consider whether the business intended to operate safely. They examine whether legal duties under the WHS Act and Regulations have been met.

Psychosocial hazards are now a legal obligation

This is the area where I see the biggest gap right now, particularly in office-based organisations. The legislation has moved faster than most businesses have. The law requires businesses to identify psychosocial hazards, assess the risks, implement appropriate control measures and review their effectiveness.

Examples of psychosocial hazards include:

  • bullying
  • sexual harassment and other forms of harassment
  • aggressive customers or clients
  • excessive workload or unrealistic deadlines
  • poor organisational change management
  • unclear roles or responsibilities
  • lack of management support
  • fatigue and long working hours
  • exposure to traumatic material or situations
  • workplace conflict
  • isolated or unsupported work

These risks cannot simply be managed informally after a problem arises. Regulators require organisations to be able to demonstrate how psychosocial hazards are being identified and managed.

Worker consultation is a legal requirement

Consultation with workers is another core requirement under WHS legislation. Businesses must consult workers when:

  • identifying hazards and assessing risks
  • making decisions about control measures
  • introducing new equipment or work processes
  • making changes that may affect health and safety

Consultation involves more than informing workers about decisions that have already been made. Workers must be given a genuine opportunity to raise concerns and contribute to decisions that affect their health and safety. Effective consultation is also one of the most practical ways to identify risks before incidents occur.

Good culture is not the same as good systems

Many small and medium businesses pride themselves on strong workplace relationships. Managers know their teams well and often prefer to resolve issues informally. While this culture can be positive, it can also create situations where informal responses replace structured safety systems.

In practice, this often sounds like: we are like a family here. We will just have a quiet word. Let us not make this a big issue.

However, if an incident occurs, regulators will ask questions such as:

  • Were hazards identified?
  • Were risks assessed?
  • Were control measures implemented?
  • Were workers trained and supervised?
  • Were issues recorded and followed up?

Good intentions do not replace systems. In a regulatory investigation, evidence is what matters.

Directors and officers have personal obligations

WHS legislation also places personal duties on company directors and officers. Under WHS laws, directors and officers must exercise due diligence to make sure their organisation complies with its health and safety obligations. These responsibilities apply regardless of the size of the business.

Due diligence requires leaders to:

  • stay informed about WHS matters
  • understand the hazards and risks within their operations
  • make sure the organisation has appropriate resources and processes to manage those risks
  • make sure systems exist for reporting incidents and hazards
  • verify that safety systems are being implemented and are working in practice

Directors and officers can be prosecuted if they fail to meet these due diligence obligations. Penalties for WHS offences can be significant and may apply personally to directors and officers. Importantly, WHS penalties are generally not insurable across most Australian jurisdictions. While insurance policies may assist with some legal defence costs, the financial penalty itself is typically required to be paid by the business or the individual.

WHS prosecutions also occur in everyday workplaces

Many people associate WHS prosecutions with major industrial accidents. In reality, enforcement action also occurs across a wide range of industries, including retail, hospitality, office-based businesses and service environments.

Published examples include:

  • A toy retailer, Blisspell Pty Ltd, was fined $100,000 in relation to sexual harassment risks in the workplace
  • A hospital cafe operator, Whitelom Investments, was fined $290,000 following findings relating to sexual harassment and failures to provide a safe workplace
  • Court Services Victoria was fined $379,157 in relation to failures to manage psychological health risks
  • A retailer, the Danebritt Group, was prosecuted by SafeWork NSW after workers were placed at risk of a wall display collapsing, and was fined $90,000

These matters show that WHS enforcement can involve everyday workplace risks rather than catastrophic industrial accidents.

Why systems matter

In many businesses, WHS failures do not occur because leaders do not care about safety. They occur because the organisation lacks systems that operate consistently when workplaces become busy or pressured.

When regulators investigate incidents, they typically examine whether a business had:

  • appropriate risk assessments
  • safe systems of work
  • training and supervision
  • consultation processes
  • incident reporting systems
  • documentation showing how risks were managed

If these systems do not exist, or cannot be demonstrated, organisations may struggle to show that they have met their legal obligations.

A final word

Many businesses assume they are low risk because their work does not involve obvious hazards. However, WHS legislation applies to every business, regardless of size or industry, and requires organisations to manage both physical and psychological risks.

Businesses that genuinely want to reduce their exposure must be able to demonstrate that hazards have been identified, risks controlled and those controls reviewed. Because when a regulator asks how risks were managed, culture alone will not be enough. Evidence will.

If you are unsure whether your WHS systems meet current legal expectations, an independent review can help identify gaps and areas of exposure. At Evolve Safety & Wellbeing, we work alongside organisations to strengthen their WHS systems so both physical and psychosocial risks are being managed.

A practical place to start. The NSW Psychosocial Code Compliance Checklist walks through the Code requirement by requirement so you can record your evidence and note the gaps. Free, no sign-up. Designed for NSW; check the Code that applies in your state.