Identifying psychosocial hazards is only step one. The WHS obligation extends to implementing and verifying controls — and that is where most psychosocial risk programs stall.
The Safe Work Australia Code of Practice tells you what to do. This guide tells you how to do it in a real workplace — with specific control examples for mining, healthcare, construction, and transport, and a documentation framework that satisfies regulators.
Before implementing controls, you need to know which hazards are elevated. If you have not yet completed a validated psychosocial risk assessment, read the assessment guide first.
What does not count as adequate control
Before covering what works, it is worth being direct about what does not satisfy the WHS obligation — because these responses are extremely common:
EAP as primary control
An Employee Assistance Program is a tertiary control — it supports workers after harm has occurred. It does not eliminate or reduce the hazard. An organisation with an EAP and no upstream controls has not met its WHS obligations. EAP data (utilisation rates) is also confidential — it cannot be used to measure psychosocial risk levels.
Wellbeing programs as the response
Yoga, mindfulness, and resilience training address individual coping capacity. They do not address workplace conditions. ISO 45003 requires primary controls targeting root causes. Resilience training applied to a high job demands hazard is the occupational health equivalent of giving earplugs to someone working next to a jackhammer and calling it noise management.
A one-off survey with no program
Deploying a psychosocial survey and producing a report is not a risk management program. The report is the hazard identification step — step one of four. Without a documented control program and re-measurement, you have a compliance gap, not a program.
Generic training not matched to identified hazards
Leadership training on "mental health awareness" is a valid administrative control for some hazards. It is not a valid control for low job control, poor predictability, or inadequate reward and recognition — unless the training directly addresses those conditions. Controls must be matched to the specific hazards identified.
The hierarchy of controls for psychosocial hazards
The WHS hierarchy of controls applies to psychosocial hazards in the same order as physical ones. Controls higher in the hierarchy are more effective because they address the hazard rather than the worker's response to it.
Elimination
Most effectiveRemove the hazard entirely. The most effective control — and the most challenging to implement.
Substitution
Replace the hazardous condition with one that creates less risk.
Isolation
Limit who is exposed to the hazard, or how often.
Administrative controls
Change how work is organised, communicated, or managed. The most commonly used level — but not sufficient on its own.
Individual supports (EAP, counselling)
Least effective as primary controlSupport workers who have been harmed. Do not prevent the hazard. Always required — never sufficient alone.
Prioritise root-cause hazards first
Not all COPSOQ III domains require equal urgency. The 26 scales fall into two categories:
Root-cause hazards — act first
Work Organisation & Leadership scales
Outcome signals — monitor, don't treat in isolation
Health & Wellbeing scales
Elevated Burnout and Stress scores are downstream effects of elevated root-cause hazards. Addressing Role Clarity and Quality of Leadership drives Burnout and Stress scores down — the causation runs that direction, not the reverse. Act on the root cause.
Industry-specific control examples
Generic controls applied without industry context are often inadequate. The following examples match specific hazard profiles common to each sector — based on Rahimi et al. (2025) Australian COPSOQ III data across 13 industry sectors.
Mining & resources
Common elevated hazards
Specific controls
Healthcare
Common elevated hazards
Specific controls
Construction
Common elevated hazards
Specific controls
Transport & logistics
Common elevated hazards
Specific controls
Documenting controls — what regulators check
A psychosocial hazard control program is only as good as its documentation. In a WHS regulator audit or a coronial proceeding, the question is not "did you have controls?" but "can you prove you had controls, and that they worked?"
A compliant control documentation record contains:
Point 6 — workforce consultation — is the most commonly missed
ISO 45003 requires that workers are involved in identifying hazards and designing controls. This must be documented. A survey result alone is not evidence of consultation. Record the consultation mechanism (safety representative meeting, team briefing, survey feedback session), the date, who was present, what was discussed, and what changed as a result.
How OccuSpan automates this
From COPSOQ III results to documented program in one workflow
OccuSpan's MIA intervention engine maps elevated COPSOQ III domains directly to 15 evidence-based control options, ranked by risk priority. Select the controls for your context, assign owners and timelines, and the platform generates an ISO 45003-aligned program plan — formatted for board reporting or WHS regulator submission.
Common questions
What counts as adequate control of psychosocial hazards?
Documented controls matched to the specific hazards identified — not generic measures. EAPs are tertiary controls only. Adequate control requires primary controls (eliminating or reducing the hazard) and/or secondary administrative controls. Controls must be documented, communicated to workers, and reviewed for effectiveness.
Is an EAP sufficient to manage psychosocial hazards?
No. An EAP is a tertiary control that supports recovery — it does not prevent the hazard. WHS regulators assess adequacy based on primary and secondary controls. An organisation with only an EAP has not met its WHS obligations.
What is the hierarchy of controls for psychosocial hazards?
Elimination → Substitution → Isolation → Engineering controls → Administrative controls → Individual supports (EAP). Controls higher in the hierarchy address the hazard at source and are more effective. Most organisations default to administrative and individual controls — the least effective tier.
How do you document psychosocial hazard controls for a regulator?
A compliant documentation record includes: the hazard identification method and date, specific elevated domains with benchmark comparison, the control for each domain with reasoning, who is responsible, timeline, workforce consultation evidence, management sign-off date, and planned re-measurement date.
See OccuSpan build the control program from your COPSOQ III results
From elevated domain to documented control plan in one workflow. ISO 45003-aligned. Ready for board reporting or regulator submission.