Psychosocial Risk Is Becoming a Hazard, Not a Programme
If no psychosocial finding at your site has ever changed how work is designed, staffed or scheduled, you are running a wellbeing programme and not a hazard control.
Two things are arriving on the same desk at the same time, and they are not the same thing.
The first is a wellbeing programme. It treats distress as a condition an individual has, and responds by offering that individual support. The second is a management system control. It treats the same distress as evidence of an exposure, and responds by changing the exposure. Both can be sincere. Only one of them is occupational health and safety.
The standards moved first, and they are not law
ISO published ISO 45003:2021, Occupational health and safety management, Psychological health and safety at work, Guidelines for managing psychosocial risks in June 2021. Read the title. It says guidelines. It is a guidance document, not a requirements standard, and there is nothing in it to certify against. ISO’s technical committee for occupational health and safety management describes it as the first guidance standard on psychological health, safety and well-being, written to support ISO 45001 so that psychological health sits inside an OH&S management system where one exists.
Neither document is law in its own right. Both are voluntary international standards, and ISO states plainly that certification to ISO 45001:2018 is voluntary, and that ISO does not certify organisations at all.
The legal duty is a separate question, and it is jurisdictional. In Great Britain it is specific. The Health and Safety Executive states that employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it, assessed in the same way as any other work-related risk, and written down if you have five or more workers. HSE’s Management Standards frame that assessment around six areas of work design: demands, control, support, relationships, role and change. Every one of those is a property of the job, not of the person holding it.
Australia is the case people cite loosely and get wrong. The model WHS Regulations now include psychosocial hazard provisions, but Safe Work Australia is explicit that the model WHS Regulations and model Code of Practice do not automatically apply in a jurisdiction. They are national policy. Whether they bind a given site depends on which state, territory or Commonwealth regulator it sits under. Check before quoting them.
The hierarchy of controls does not stop at the physical
Here is the structural difference. ISO is blunt about the failure mode: responding to psychosocial issues through support programmes and individual interventions addresses the consequences rather than the cause.
NIOSH says the same from the exposure side. Its 2024 science bulletin adapts the hierarchy of controls to psychosocial hazards and states that efforts should start with interventions that alter the working conditions, rather than individually-focused psychosocial supports, because organisational-level solutions are likely to be more effective and more sustainable.
So the source-level controls are already named. Workload. Staffing levels. Shift pattern and roster design. Role clarity. Who sets the pace and who can stop it. These are elimination and substitution in everything but name. Support offers, awareness sessions and resilience training sit at the education end of the hierarchy, where we have always placed our weakest controls.
Monday morning check
Pull every psychosocial finding from the last twelve months, from surveys, exit interviews, grievances and absence data, and lay them beside your corrective action log. Then ask which of those findings changed a workload, a staffing level, a roster or a role definition, and which produced only an offer of support?
An annual survey is a lagging indicator
Most sites already collect psychosocial data. They call it an engagement survey, it runs once a year, and it returns a score. That is a lagging indicator sampled at an interval no EHS director would accept anywhere else in the system. Nobody measures dust once a year and calls it exposure monitoring.
The tell is not the score. It is what the score is wired to. A hazard finding produces a corrective action with an owner, a due date and a verification step. A wellbeing metric produces a slide.
Why this lands on the EHS desk
The argument that moves this out of HR is the injury route, and it should be made honestly, because the evidence is uneven. A prospective cohort of 7,051 workers in the Netherlands found that high psychological job demands, high emotional demands and conflicts with a supervisor or colleagues were risk factors for being injured in an occupational accident after adjustment for demographics, fatigue and work environment, with conflicts with colleagues at a relative risk of 2.62. Low decision latitude looked like a risk factor at a crude relative risk of 2.02, then almost vanished once confounders went in.
That is one cohort, in one country, resting on 108 reported injuries. Treat it as a signal, not a settled literature. It is enough to say psychosocial exposure has a plausible route to conventional injury through fatigue and time pressure, and that route runs through the roster you already control.
NIOSH’s list of recommended actions ends with developing a national regulatory or consensus standard to control work-related psychosocial hazards. Guidance tends to precede requirement. The sites that find that transition cheap will be the ones already carrying a psychosocial hazard in the register with a work design control against it, rather than a programme with a participation rate.