WHS legislation in WA comes down to one law: the Work Health and Safety Act 2020, which took effect on 31 March 2022 and replaced an Act that had governed WA workplaces since 1984. It requires every business to protect workers from harm so far as is reasonably practicable, and that now explicitly includes psychological harm, not just physical injury.
That last part is where most businesses are exposed. Of the businesses who have taken our HR audit, 64% told us they don’t assess psychosocial hazards regularly. Not because they don’t care. Because nobody has made it clear what they’re actually supposed to do.
This guide fixes that. I’ll walk you through what changed, who’s responsible, what the law requires in practice, what enforcement looks like, and what’s coming next.
What changed when the WHS Act 2020 came in
The old Occupational Safety and Health Act 1984 governed WA workplaces for 36 years. The new Act didn’t just update it. It rebuilt who is responsible and what “safety” means.
|
Old OSH Act (before 2022) |
WHS Act 2020 (now) |
|
|---|---|---|
|
Who holds the duty |
The “employer” |
A “person conducting a business or undertaking” (PCBU), which is far broader |
|
Who is protected |
“Employees” |
“Workers”, including contractors, apprentices, trainees and volunteers |
|
What “health” means |
Primarily physical safety |
Physical and psychological health, explicitly |
|
Senior leaders |
Implied responsibilities |
A personal duty of due diligence on every officer |
|
Worst offence |
Gross negligence |
Industrial manslaughter, up to 20 years imprisonment |
|
Insurance |
Could insure against some penalties |
Insuring against WHS fines is prohibited |
Three of those changes matter most for a business owner:
- Health now includes psychological health. The Act defines health to cover both physical and psychological wellbeing. Stress, burnout, bullying and harassment are safety issues under the law, managed with the same seriousness as a faulty ladder.
- “Employer” became “PCBU.” The duty holder is now a person conducting a business or undertaking. That’s deliberately broad. It captures sole traders, partnerships, contractors and franchisors, not just traditional employers. If you run a business in WA, you’re a PCBU, and the duties apply to you.
- Officers carry personal duties. Directors and senior decision makers have their own due diligence obligation. You can’t delegate it away, and you can’t insure against it either. The Act specifically prohibits insurance that covers WHS fines. If you’re penalised personally, you pay personally.
Who’s responsible, exactly
The Act spreads duties across three groups, and they overlap on purpose.
The PCBU carries the primary duty of care: ensure, so far as is reasonably practicable, the health and safety of workers and anyone else affected by the work. That includes providing safe systems of work, information, training and supervision, and monitoring workplace conditions. In a 40 person professional services firm, “safe systems of work” is less about machine guards and more about workloads that don’t break people, roles people actually understand, and a way to raise problems without fear.
Officers, meaning directors and anyone whose decisions affect the whole or a substantial part of the business, must exercise due diligence. In practice that means keeping your WHS knowledge current, understanding the specific risks in your operation, resourcing safety properly, and verifying the systems are being used, not just written. An officer who has never asked what the business’s psychosocial hazards are would struggle to show due diligence if something went wrong.
Workers must take reasonable care for their own safety, avoid putting others at risk, and follow reasonable instructions and policies. “Worker” includes your contractors and volunteers, and you owe them the same duty of care as employees.
The psychosocial duties most businesses have never heard of
From 1 December 2022, WA’s WHS General Regulations gained express psychosocial provisions, backed by WA’s own Code of Practice on psychosocial hazards in the workplace. WA is one of only two jurisdictions that wrote its own psychosocial code rather than adopting the national model, so guidance written for the east coast doesn’t always match what WorkSafe WA expects.
A psychosocial hazard is anything in the design or management of work that can cause psychological harm. In our audit work we group them into four areas:
Work demands. Excessive job demands, low control over how work is done, unclear roles, exposure to traumatic events or material.
Work environment. Remote or isolated work, poor physical conditions, ongoing conflict or poor workplace relationships.
Support and recognition. Poor support from managers, lack of recognition or reward, badly managed organisational change, unfair processes.
Personal conduct. Violence and aggression, bullying, and harassment including sexual harassment.
Notice how much of that list is ordinary management, not misconduct. A restructure handled badly is a psychosocial hazard. So is a role nobody has properly defined. This is why so many businesses miss it. They’re looking for bad behaviour when the law is also asking how work itself is designed.
What you actually have to do
The law doesn’t ask you to make work stress free. It asks you to manage psychosocial risk the same way you manage any other safety risk, using a four step process:
1. Identify the hazards. Talk to your people. Look at complaints, absence patterns, turnover and workload data. You can’t manage what you haven’t named.
2. Assess the risks. Work out who could be harmed, how seriously, and how likely it is. Some hazards compound. High demands plus low support is far more dangerous than either alone.
3. Control the risks. Eliminate the hazard where you can. Where you can’t, minimise it so far as is reasonably practicable.
4. Review your controls. Check they’re working and adjust when the business changes. A control that worked at 30 staff may fail at 60.
One requirement sits across all four steps: consultation. You must involve your workers, and any elected health and safety representatives, in this process. It’s a legal duty, not a courtesy. In practice it’s also where the useful information lives. Your people already know where the pressure points are. Smaller businesses don’t need a formal committee. A documented, genuine process of sharing information, hearing views and considering them meets the duty.
The hierarchy of controls, translated for psychosocial risk
Safety professionals rank controls from most to least effective, and the same logic applies to psychological hazards, though almost nobody explains what it looks like in practice:
Eliminate. Remove the source of harm entirely. If one client relationship generates constant abuse toward your staff, ending that engagement is elimination.
Redesign. Change how the work is done. Splitting an impossible role into two sensible ones. Rostering so nobody is chronically on call.
Adjust. Reduce exposure where the hazard can’t be removed. Rotating people out of high trauma content. Physical or procedural barriers between staff and aggressive customers.
Inform. Policies, training and procedures. Useful, but they rely on people knowing and following them, which is why they sit low on the list.
Support. EAPs, resilience training, wellbeing apps. These support people who are already carrying the load. They don’t reduce the load.
Here’s the uncomfortable implication: most businesses run this hierarchy upside down. They buy the wellbeing app and the training day (the two weakest levels) and never touch job design (the strongest). If your entire psychosocial strategy is an EAP, you haven’t controlled a single hazard. You’ve bought an ambulance.
The penalties, in plain numbers
The old Act’s penalties were widely treated as a cost of doing business. The new ones are designed not to be.
Industrial manslaughter. Where a failure to comply with a duty causes a death, an individual faces up to 20 years in prison and a $5 million fine. A company faces up to $10 million.
Category 1 (failure causes death or serious harm): up to 5 years imprisonment and $680,000 for an individual, $3.5 million for a company.
Category 2 (failure exposes someone to risk of death or serious harm): up to $170,000 for an individual, $350,000 for an officer, $1.8 million for a company.
Category 3 (failure to comply with a duty): up to $55,000 for an individual, $120,000 for an officer, $570,000 for a company.
These apply to psychological harm as well as physical. A sustained bullying situation your business knew about and didn’t act on isn’t an HR headache under this Act. It’s a safety breach with your name on it.
What happens when WorkSafe turns up
WorkSafe WA inspectors can enter any workplace at any reasonable time without notice. They can examine the site, question anyone present, and require documents. Obstructing them is an offence in itself.
If an inspector finds a breach, two notices matter:
An improvement notice identifies the breach and sets a deadline to fix it. Ignoring it is a separate offence on top of the original breach.
A prohibition notice stops an activity immediately because it poses a serious risk. Work can’t resume until the inspector is satisfied.
Both now apply to psychosocial matters. Regulators in Australia have already issued prohibition notices over unmanaged psychological risks, including in white collar workplaces. The era of psychosocial enforcement being theoretical is over.
What WorkSafe actually wants to see
Here’s the part I want every business owner to take away, because it’s where the compliance industry gets it wrong.
WorkSafe doesn’t want a binder of policies. Plenty of businesses we audit have a beautiful bullying policy and a workforce that has never seen it. If an inspector visits, or worse, investigates after an incident, the questions are practical. How did you identify your psychosocial hazards? When did you last assess them? What did you change as a result? Who did you consult?
Paperwork that nobody follows can actually hurt you, because it proves you knew the risk existed and didn’t act. What protects you is evidence of a living process:
- hazards identified,
- risks assessed,
- controls implemented,
- reviews done,
- workers consulted,
- dates on all of it.
That’s a manageable amount of work for a small business. It’s a few structured conversations, an honest look at how work is designed, and a documented cycle you repeat. The businesses that struggle are the ones that leave it until WorkSafe or a workers compensation claim forces the issue.
If you’ve read this far and thought “we’ve never documented any of this,” you’re in the 64%. That’s exactly the gap our psychosocial risk assessment closes: an independent look at where your hazards sit and what a reasonable response looks like for a business your size.
What’s changing next
The WHS Act must be reviewed every five years, and the first statutory review is happening now. Public consultation closed in November 2025 and the report is expected to be tabled in Parliament late in 2026. Three proposals are worth watching:
Infringement notices. WA is currently the only jurisdiction without on the spot fines for WHS breaches. The review is considering introducing them for straightforward offences, which would make enforcement faster and more frequent for lower level breaches.
Expanded incident notification. Proposals include making suicide a notifiable incident and lowering the threshold for reportable injuries from 10 or more days off work to a broader definition. Both would pull psychological harm further into the formal reporting regime.
Psychosocial notice handling. The review is considering letting certain psychosocial related notices not be displayed at the workplace, recognising the privacy issues these matters carry.
None of this softens the current duties. If anything, the direction of travel is more enforcement, not less.
Common questions
Does this apply to my business if we’re small?
Yes. The duties apply to every PCBU, whether you have 3 workers or 300. What scales is the response, not the obligation. A 20 person firm doesn’t need an enterprise safety system. It needs a documented look at its real hazards, sensible controls, and a review rhythm. That’s achievable in days, not months.
We’re an office based business. Surely this is for mining and construction?
No, and this assumption is exactly why office businesses are exposed. Physical risk is lower at a desk. Psychosocial risk isn’t. Workload, role conflict, poor change management and bullying are the hazards of knowledge work, and the Act treats them as safety issues.
What does “reasonably practicable” actually mean?
It’s a balancing test. Weigh the likelihood and severity of the harm against what it would take to address it. You’re not required to do everything imaginable. You’re required to do what a reasonable business in your position could do. Cost alone is rarely an acceptable reason to ignore a serious risk.
Is workplace stress really a legal issue now?
Sustained, unmanaged stress arising from how work is designed or managed, yes. A busy week isn’t a breach. A structurally overloaded role that the business knows about and leaves in place is a hazard the law expects you to control.
Are volunteers covered?
Yes. The definition of worker explicitly includes volunteers, and you owe them the same duty of care as paid staff.
Where to start
Two questions tell you where you stand.
- When did we last formally assess our psychosocial hazards?
- And could we show an inspector the evidence?
If either answer is “I don’t know,” a structured HR compliance audit will tell you exactly where the gaps are before the regulator, or a claim, tells you first. We run these for businesses and the pattern is consistent: the fix is nearly always smaller than the exposure.
The law changed. The businesses that treat that as a reason to run a healthier workplace, rather than a paperwork exercise, end up safer on both fronts.