Psychosocial Hazards: What Safety Managers Must Log
Psychosocial hazards sit inside the same WHS management framework as falls and chemical exposures, yet most organisations still track them in a shared drive folder nobody maintains or a spreadsheet that never triggers a corrective action. Regulators and auditors are paying much closer attention to this gap, and in industries like construction, mining and transport the expectation is no longer to acknowledge the risk in a policy document and move on. You need a log, an investigation workflow, assigned ownership, and evidence that something was done. This article walks through what to capture, how to structure it, and where a psychosocial hazard record fits inside an ISO 45001 aligned system.
What counts as a psychosocial hazard in practice?
Psychosocial hazards are workplace conditions that have the potential to harm a person's psychological or physical health. That definition covers a wide field: high job demands with inadequate resources, poor role clarity, workplace violence and aggression, bullying and harassment, fatigue from shift design, traumatic event exposure, and low levels of support or control over work. In construction and mining, fatigue and aggression reports are the most common. In transport, fatigue combined with isolation is a chronic source. Healthcare and education sites often surface emotional exhaustion and role overload.
The important thing for logging purposes is that a psychosocial concern is a hazard the moment it is reported or observed, not only after it has caused measurable harm. Your incident and hazard register should treat a report of persistent unreasonable workload the same way it treats a spill on a walkway: log it, assess severity, assign an owner, set a due date, and close it out with evidence. Check the legislation that applies to your jurisdiction, because the specific duty language varies across Australian states, New Zealand and other markets.
What fields belong in a psychosocial hazard record?
A well structured record gives an auditor confidence that the organisation is managing the hazard rather than just acknowledging it exists. At minimum, each entry should capture:
- Date and location, including the site, shift or work area
- Source or hazard type, for example workload, conflict, traumatic exposure, fatigue, isolation
- Who reported it, whether a worker, supervisor, return to work coordinator or EAP referral, while protecting the individual's privacy
- Initial risk rating, using the same consequence and likelihood matrix your system uses for physical hazards
- Controls applied or proposed, with a named owner and a due date so action does not stall
- Verification that controls were effective, which may be a follow up conversation record, a re-assessment, or a closed corrective action
If your register lacks a category field for psychosocial hazards, add one. Grouping these records separately makes trend reporting possible, which is exactly what a surveillance auditor reviewing your ISO 45001 implementation wants to see.
Does ISO 45001 specifically require psychosocial hazard records?
Yes. ISO 45001 is the international standard for occupational health and safety management systems, and it explicitly includes psychological health within its definition of worker health. The standard requires organisations to identify hazards, assess OH&S risks and determine controls, and that obligation covers psychosocial hazards in the same way it covers physical and chemical ones. Surveillance audits increasingly test whether an organisation can produce evidence of identification and control, not just a policy statement that says we take mental health seriously.
For organisations already certified or working toward certification, this means the hazard and incident management module in your WHS system needs to be capable of capturing psychosocial reports as a distinct category, running them through a risk assessment, generating corrective actions with tracked owners and due dates, and producing a trend report by hazard type. If your current system cannot do that without manual workarounds, that gap will show up in an audit.
How does this fit inside a WHSEQ management system?
A WHSEQ system, which covers Work Health, Safety, Environment and Quality in a single connected framework, is built to handle exactly this kind of lifecycle management. When psychosocial hazards flow through the same incident and hazard management module as physical hazards, you get consistent documentation, workflow and reporting without building a parallel process. The corrective action module closes the loop: every finding gets a tracked action with an owner and a due date, so nothing sits open indefinitely.
Policies and procedures that address psychosocial risk also need a home inside the documentation control layer, with version control and review dates, rather than living as separate Word documents. Inductions should reference the relevant procedure so workers know the reporting pathway before an issue arises. All of this is standard architecture inside an ISO 45001 aligned WHSEQ system. If you are running Donesafe, there are modules purpose built for hazard reporting, corrective actions and register management that can be configured to include psychosocial hazard categories without rebuilding your entire system from scratch. For organisations looking to build or strengthen this capability end to end, the WHSEQ and ISO systems work KIS Group does covers exactly this compliance lifecycle, from framework design through to live reporting dashboards.
Common logging mistakes that create audit exposure
The most frequent problem is under reporting, where psychosocial concerns are handled informally through a manager conversation and never reach the register. That leaves the organisation unable to demonstrate it identified and controlled the hazard. A second issue is inconsistent classification: some sites log a bullying complaint under incident, others under hazard, and some under HR. When records are split across systems, trend analysis becomes impossible and auditors have to take your word for it.
A third mistake is closing actions prematurely. Writing resolved in the corrective action field after one meeting, without a follow up record confirming the situation improved, is thin evidence. A review conversation a few weeks later, even a brief one documented in the system, is far stronger. Finally, failing to aggregate data at the organisational level matters in multi-site operations in construction, mining or transport, where a pattern visible across sites may not be obvious at any single site.
Building a practical reporting culture around psychosocial risks
The best designed register is only useful if people actually use it. Workers in physically demanding industries often associate reporting with weakness or assume psychosocial concerns are not safety issues. Framing the reporting pathway clearly during induction, making the form quick to complete on any device, and ensuring that early reports are handled without embarrassing the reporter all influence whether the data in the system reflects reality.
Supervisors play a significant role here. If a team leader is the first point of contact for a workload or conflict concern, they need to know how to log it formally rather than manage it off the record. Training and onboarding for system users, including how to raise a psychosocial hazard and what happens next, is a practical step that reduces the gap between policy and practice. Psychosocial risk assessment is a capability KIS Group lists on its /about page as part of its broader consulting work, which sits alongside strategic WHS consulting and EHSQ management system development.
Frequently asked questions
Do psychosocial hazards need to go through the same risk assessment process as physical hazards?
Yes. The risk assessment process, evaluating likelihood and consequence and deciding on controls, applies to psychosocial hazards exactly as it does to physical ones. The consequence categories may look slightly different, but the fundamental assessment and control hierarchy remain the same under an ISO 45001 aligned system.
What is the difference between an incident and a hazard for psychosocial logging?
A hazard is a condition or situation with potential to cause harm, for example a chronic pattern of excessive overtime or isolated work conditions. An incident is when harm has already occurred or nearly occurred, such as a disclosure of significant distress or a reported aggression event. Both need to be logged, investigated and closed out, though the workflow steps may differ slightly. Your system should handle both categories within the same module.
Can we use Donesafe to manage psychosocial hazard records?
Donesafe has modules for incident and hazard management, corrective actions and risk registers that can be configured to include psychosocial hazard categories, custom form fields and automated workflows. A Platinum Partner like KIS Group can customise naming, questions and workflows so the module matches your process rather than requiring you to adapt your process to a generic template.
How do we handle confidentiality when logging a psychosocial hazard report?
The hazard record needs enough detail to allow a genuine risk assessment and a traceable corrective action, but it does not need to name the individual who reported it or the individual whose conduct is the subject of the report. General practice is to log the hazard type, location, contributing factors and controls, while keeping personal details in a restricted access HR record. Your system permissions should reflect that split. Check your jurisdiction's privacy legislation for the specific requirements that apply to you.
Will a surveillance auditor specifically look for psychosocial hazard records?
Increasingly, yes. ISO 45001 auditors are trained to test whether the hazard identification process covers psychological health, and many now ask to see the hazard register filtered by psychosocial category and ask how trends are reviewed. Having a populated register with completed corrective actions is far stronger evidence than a policy document alone.
Sources
This article draws on the following pages.