Why Psychosocial Risk is Now a Board-Level KPI (And What HR Must Do About It)

There was a time, not that long ago, when psychosocial risk sat firmly in the nice-to-have column. Culture initiatives. EAP brochures. A lunchtime webinar on resilience. The board had other things on their mind.

That time is over.

In 2026, psychological health and safety has moved from HR aspirations onto boardroom agendas driven by tightening regulation, a wave of high-profile workplace claims, and a workforce that is less willing than ever to quietly absorb poor management behaviour.

If your organisation hasn't yet made psychosocial risk a boardroom conversation, you're not behind on culture. You're behind on compliance.

The Numbers That Should Be on Every Board's Desk

Before we get into what needs to change, here's where Australia currently stands. These figures are not projections — they are the recorded reality.

Read those numbers again. Psychological injury claims account for only 12% of total serious workers' compensation claims yet they consume 38% of the total cost. The median time off work is five times longer than for physical injuries. The average cost per claim has nearly doubled in five years. This is not a soft HR issue. It is a financial risk event sitting on your balance sheet waiting to be triggered.

The Regulatory Shift That Changed Everything

The turning point was the harmonisation of psychosocial hazard regulations across Australian states and territories. As of 2024, nearly every Australian State and Territory has adopted the changes to Safe Work Australia's model WHS Regulations 2023 - requiring employers to proactively manage psychosocial risks. The exception is Victoria, which has introduced but not yet passed equivalent amendments to its Occupational Health and Safety Act though Victorian regulators have made clear they are enforcing obligations under existing law regardless.

Safe Work Australia's Model Code of Practice on Managing Psychosocial Hazards at Work updated in 2022 and further reinforced by a Commonwealth Code of Practice registered in November 2024 gave organisations a clear framework and, critically, gave regulators a clear enforcement mechanism. The Commonwealth Code now explicitly names job insecurity, fatigue, and intrusive surveillance as common psychosocial hazards requiring structured identification, assessment, and control.

Psychosocial hazards are now treated with the same legal weight as physical hazards. Employers are obligated to identify, assess, and control risks that include:

• High job demands paired with low autonomy or control
• Poor workplace relationships — including bullying, harassment, and conflict
• Inadequate support from managers or peers
• Poorly defined roles or lack of role clarity
• Exposure to traumatic events or distressing content
• Isolation, remote work risks, and lack of connectedness
• Job insecurity, fatigue, and intrusive surveillance (newly codified under the 2024 Commonwealth Code)

This is not new law so much as new enforcement. Organisations that treated psychological safety as optional are finding out often through Fair Work hearings and WorkCover claims what the cost of that assumption actually is.

Why This Has Landed on the Board's Desk

Three forces have pushed psychosocial risk management up to board level and none of them are going away.

1. Financial Exposure Is Now Visible

Psychological injury claims are among the most expensive in the Australian workers' compensation system. The average cost per claim has escalated from $146,000 in 2019–20 to $288,542 in 2024–25 driven by longer recovery times, higher legal fees, and compounding productivity losses. In NSW, the Treasurer has publicly warned that rising psychological injury claims threaten the stability of the entire workers' compensation system.

When a CFO or general counsel sees those numbers alongside the median 35.7 weeks off work per psychological claim more than five times the physical injury average the question stops being should we invest in this? and starts being why haven't we already?

2. Directors Have Personal Liability

Under WHS legislation, officers of a PCBU — which includes directors and senior executives have a positive duty to exercise due diligence to ensure the organisation meets its health and safety obligations. That duty now explicitly extends to psychosocial hazards.

A director who cannot demonstrate they took reasonable steps to understand and address psychological risks is not protected by the corporate structure. The $380,000 fine issued to a Victorian employer in 2023 for failing to address psychosocial risk in a toxic culture was a clear message: ignorance is not a defence.

3. The Workforce Is Different Now

Post-pandemic, employees have fundamentally different expectations around psychological safety. The tolerance for high-pressure cultures, poor management, and just push through expectations has dropped significantly. Organisations that don't adapt are experiencing higher turnover, lower engagement, and increasingly formal complaints and claims.

The 161% increase in mental health claims over the past decade is not purely a regulatory story; it reflects a genuine shift in how workers understand and assert their rights. This trajectory is not reversing.

What HR Needs to Do — Practically

Understanding the importance of psychological health and safety is one thing. Building systems that actually protect your organisation and your people is another. Here is where HR needs to focus.

Build a Psychosocial Risk Register

Start by treating psychosocial hazards the way you treat physical hazards because the law now requires exactly that. That means a formal identification process through surveys, focus groups, incident data, and manager input, followed by a risk assessment that considers likelihood and severity.

The risks need to be documented, assessed, controlled, and reviewed. If your current risk management framework doesn't include psychosocial hazards, it's incomplete regardless of how thorough it is in every other area. Most modern GRC systems, including purpose-built Australian platforms, allow you to manage physical and psychosocial risk in a single integrated register.

Train Managers, Not Just Employees

The single biggest variable in psychological safety is management behaviour. A skilled, self-aware manager can maintain team wellbeing under significant organisational pressure. A poor manager can destroy psychological safety in a well-resourced, supportive environment.

Manager-level training needs to cover: how to identify early warning signs of psychological distress, how to have difficult conversations constructively, and how to create the conditions for people to speak up without fear. General staff training matters but if you skip the manager layer, you're addressing symptoms rather than causes.

A note on training quality: Not all psychosocial training is equal. General wellbeing content is not the same as training grounded in Australian workplace law and defensible under WHS regulation. The distinction matters when a claim is made.

Document Everything That Matters

In any compliance context, what you can demonstrate is what counts. A workplace that claims 'we have a great culture' and can't back it up with training records, policy acknowledgements, and a documented risk management process is not in a defensible position.

Every piece of psychosocial risk management activity should leave a record timestamped, attributed, and accessible when it's needed. This is especially critical if a claim is ever made.

Get Your Policies Right

Your policies on bullying, harassment, discrimination, and workplace conduct are foundational but they need to be more than documents sitting in a shared drive. They need to be:

• Current and aligned to Australian workplace law
• Accessible and clearly communicated to all staff
• Acknowledged with documented confirmation from each employee
• Reviewed regularly to reflect regulatory updates the regulatory landscape has shifted significantly in the past two years

Policies that haven't been reviewed since 2022 are a compliance risk in their own right. The new Commonwealth Code of Practice (November 2024) and the harmonised state regulations have raised the standard. Your documentation needs to reflect where the law now sits, not where it was three years ago.

Embed Psychological Safety Into Onboarding

First impressions matter. The way an employee is brought into an organisation sets the tone for how safe they'll feel to speak up, raise concerns, and flag problems. Onboarding systems that includes clear expectations around respectful behaviour, the organisation's values, and how to raise concerns sets the psychological safety culture from day one not retroactively, when a claim has already been filed.

Connecting Psychosocial Risk to Your GRC Framework

For organisations running a formal governance, risk, and compliance (GRC) framework, psychosocial risk needs to be woven into not bolted onto existing processes.

That means:

• Psychosocial hazards represented in the organisational risk register with appropriate risk ratings
• Compliance obligations mapped to specific WHS and psychosocial regulation
• Training completion tracked for all staff with evidence of currency
• Inspections and audits scheduled for team culture and management practice not just physical safety
• Incident data reviewed for patterns that may indicate systemic psychosocial issues

The organisations getting this right aren't doing more work. They're using smarter systems that make compliance visible across the whole framework not just in isolated corners of it.

What 'Good' Looks Like in 2026

Here's a practical benchmark for organisations that want to be on the right side of this issue both legally and culturally.

At the Board and Executive Level

• Psychosocial risk appears on the organisation's risk register
• Board receives regular reporting on psychological safety indicators not just financial and operational metrics
• Officers can demonstrate active due diligence on WHS obligations including psychosocial hazards

At the HR and Compliance Level

• A formal psychosocial hazard identification and assessment process is in place
• All staff have completed legally grounded training on psychological health and safety with documented completion records
• Managers have received specific training on their role in maintaining psychological safety
• Policies are current (post-2023 regulation), acknowledged, and accessible
• Incident data is reviewed for psychosocial patterns not just physical events

At the System Level

• Risk management, training, and compliance documentation are managed in a single system
• Reporting is available in real time showing gaps, completions, and risk exposure across the organisation
• The system is capable of producing evidence of compliance if a claim or audit arises

The Bottom Line

Psychosocial risk management has arrived at board level not because the boardroom has suddenly discovered empathy. It's arrived because the financial, legal, and regulatory stakes have become too significant to ignore.

With 17,600 mental health claims filed in 2023–24, a 161% increase over the past decade, and average claim costs now sitting at over $288,000 the cost of inaction is no longer abstract. It is specific, it is measurable, and it is growing.

The importance of psychological health and safety is no longer a values question. It's a governance question. And like all governance questions, it requires documentation, process, and accountability.

HR has a critical role to play here not as the sole owner of this challenge, but as the team that builds the systems, trains the managers, and gives the board what it needs to demonstrate due diligence.

The organisations that get this right won't just be avoiding claims. They'll be building workplaces where people actually want to stay and where, if the worst does happen, they can demonstrate they took it seriously.