What Should a Psychosocial Risk Action Plan Include? (And Why the Assessment Isn't the Finish Line)
AI Summary
This article explains what a psychosocial risk action plan should include once a psychosocial risk assessment has been completed in an Australian workplace. It covers what a good risk-management process should already establish (exposure, potential harm, existing controls and current risk), why controls should not wait for a perfect report, why implementation is harder than assessment, how to prioritise using current risk, likelihood and severity, what each plan entry needs (including interim measures, owners with authority, consultation and escalation), and how to check whether exposure has actually changed. It is written by The Business Psychologist, which provides psychosocial risk advisory support for implementation.
If your organisation has completed a psychosocial risk assessment and you're now looking at the findings, the next question is a practical one: what should a psychosocial risk action plan actually include? Here's how we think about turning an assessment into a prioritised implementation roadmap — and why that part is so often where things stall.
There's a moment in most psychosocial risk projects that we've learned to recognise. The report lands. It's thorough. It has heat maps. Someone saves it to a shared drive in a folder called something like "Psych Risk – FINAL – v3", and there's a genuine sense of relief, because the hard bit is done.
Except it isn't. The hard bit is just starting.
Here's the uncomfortable part. Employers have an ongoing duty to identify reasonably foreseeable psychosocial hazards and to eliminate or minimise the resulting risks so far as is reasonably practicable. Receiving a report doesn't create that duty — and waiting for the next leadership meeting doesn't suspend it. What the report does change is that the risks are now written down, and the people who told you about them are still doing exactly the same work.
Closing that gap, between a finished assessment and work that has actually changed, is what our psychosocial risk advisory work is for.
What happens after a psychosocial risk assessment?
Managing psychosocial risk is a cycle — identify hazards, assess risks where necessary, control them, and review — with consultation running through all of it. By the time an assessment report lands, a good process should ideally have given you a clear picture of:
the hazards, identified through consultation with workers and other information
who is exposed, how long, how often, and how severe the potential harm could be — including how hazards interact
the controls already in place, and whether they're actually working
the current level of risk, with those existing controls operating
recommended further controls (in Queensland, the hierarchy of controls must be applied where a risk can't be eliminated)
an early view of how you'll know whether new controls are working
Close important gaps in that picture — but don't let them become a reason to wait. Where a hazard and a reasonably practicable control are already well understood, you don't need another report before acting. And where longer-term changes will take time, put interim measures in place to reduce exposure now.
What an assessment rarely gives you is the next layer: which controls to implement first, who owns them, what has to happen before what, and how much change the organisation can realistically take on at once. That's the action plan — a prioritised implementation roadmap — and it's a different piece of work.
Most organisations have become well practised at assessment, and that's partly because assessment lends itself to structure. A survey or assessment tool can be validated, standardised and run the same way in a hospital, a law firm or a construction company. It has an order. It produces a report.
Implementation doesn't work like that. The control for unplanned after-hours client calls in an intake team looks nothing like the control for aggression at a reception counter, or for role conflict between two managers who both believe they own the same decision. Effective controls have to fit the work: the specific hazard, in the specific setting, with the specific people doing it. Sometimes that means adapting an established control; sometimes it means designing something new. Action-planning resources such as People at Work can help structure the process, but no tool replaces the consultation and judgement that make a control fit. Implementation is harder than assessment. Effective implementation is much harder — which is exactly why so many good reports end up in a very well-named folder.
How do you prioritise psychosocial risk controls?
Start with the risk workers face now — with the controls actually operating today, and whether they're working. A predicted rating for what the risk will look like after a proposed control is useful for planning, but it remains an estimate until that control has been implemented and checked. Don't let a hopeful forecast make a high risk today look like a low one.
If everything is priority one, what you've actually written is a wish list. When we sequence a roadmap, we're asking:
How likely, and how severe, is the potential harm? Use both. Some hazards — violence and aggression, for example — can warrant urgent attention even when incidents are relatively rare, because the potential harm is serious.
Who is exposed, and how? Often it's one role, not the whole team.
Which hazards are combining? High demands plus low control plus thin support is a different risk profile from any one of those alone — and one well-designed control can sometimes shift more than one.
How well are the existing controls working? A control on paper isn't the same as a control in practice.
What depends on what? Some changes rely on others. Redistributing workload, for example, may depend on first resolving unclear responsibilities.
How much change can be carried at once? Poorly managed organisational change is itself a psychosocial hazard, so longer-term changes need careful sequencing. That's a reason to pace the redesign work — never a reason to leave serious risks uncontrolled in the meantime.
That balance — pacing the change without parking the risk — is the one most plans miss.
It's also the stage where an outside eye tends to earn its place. Sequencing well takes judgement about how the work is actually done — the rosters, the reporting lines, the informal workarounds people have built just to cope — and about how much change a team can carry at once. That's the core of our psychosocial risk advisory work: taking the assessment you already have and turning it into a short, defensible roadmap of what to change first, and why.
Controls and supports: what is each measure actually changing?
Even with a solid assessment behind it, an action plan can drift during implementation. Changes to how work is designed are often harder, slower and more political, so they slide down the list, and general wellbeing measures quietly take their place.
The useful test isn't whether something sounds like "support" or "a control". It's what the measure actually changes. Poor support is itself a recognised psychosocial hazard, so improving supervisor availability, practical assistance and resources can directly control it. An EAP can provide genuinely valuable assistance to individuals, but on its own it doesn't fix excessive workloads, unclear responsibilities or repeated exposure to aggression.
Research on the Job Demands–Resources model points the same way. Job resources aren't just cushions: they can help people achieve work goals, reduce demands and their costs, and support motivation — and leadership influences both sides of that equation.
A good plan connects every measure to the hazard it's intended to control. If, six months in, nothing delivered has touched the hazards driving the highest risk, the plan has drifted — and the expected reduction in risk hasn't been demonstrated.
What should a psychosocial risk action plan actually include?
A workable roadmap is usually shorter and more specific than people expect. For each priority hazard, it should name:
The specific hazard and its current risk. Not "workload", but "unplanned after-hours client calls for the intake team".
The control. What will change, and which hazard it's intended to control.
Interim measures. What protects people while longer-term changes are developed.
An owner with authority. A named person, not a committee — with approved budget, time and decision-making authority.
Sequence, dependencies and timeframe. What has to happen first, on a timeline that's realistic given everything else that's changing.
Consultation and feedback. How affected workers and health and safety representatives contribute, and how decisions are communicated back.
How you'll check it. Measures of both exposure and implementation, with a named person and a date to review.
Escalation. What happens if implementation stalls or a control isn't working.
Information, training, instruction and supervision can all play a part in controlling risk — when they're tied to a specific hazard. "Raise awareness", on its own, is not a sufficiently specified control. Awareness of what, for whom, and how will it reduce risk? Otherwise, it's a sentence that has been to a lot of meetings.
And consultation isn't optional. Workers must be consulted not only when hazards are identified but when decisions are made about how to control them — and the people doing the work usually have the most practical ideas about what would actually change it.
Why follow-through matters as much as the findings
There's a cost to identification without follow-through that rarely makes it into the risk register: what it does to confidence in the process.
What happens after a survey matters. Research suggests that how organisations handle findings and follow through can influence whether employees see future surveys as useful and want to take part. When people raise concerns and see neither action nor an explanation, confidence in the process can weaken. It can feel like a broken promise — particularly if the organisation raised expectations that something would change.
That has a practical edge. Surveys and consultation are part of how you find hazards in the first place, so if people stop believing it's worth speaking up, you lose some of your best early warning. Even an explanation helps: if a change will take time, or a suggested control isn't reasonably practicable, saying so — and saying what you're doing instead — is part of following through.
We'll be honest — this is easy to write and much harder to do. It's a pattern we see constantly: genuinely well-intentioned leaders who run out of momentum somewhere between the report and the first real change. Not because they didn't care, but because the next step wasn't clear and the day job didn't stop.
How do we know if our psychosocial controls are working?
Start with the work itself: has exposure to the hazard actually changed? For the after-hours calls example, that might mean tracking call frequency and duration, rostered coverage, missed recovery periods, and whether workers say the new arrangements are working.
Track implementation separately. A completed policy, a delivered training session or a signed-off procedure shows that something was done — not that exposure has reduced.
Absence, turnover, complaints and follow-up surveys are useful supporting signals, but they have multiple causes, so read them with care. An increase in reporting, for instance, may reflect greater confidence in speaking up rather than a worsening problem.
Control measures also need to be reviewed at particular points — for example, when a control isn't effectively managing the risk, before a change at work that's likely to create new or different risks the current controls may not manage, when a new hazard or risk is identified, when consultation indicates a review is needed, or when a health and safety representative requests one under the conditions set out in the regulations. Building those triggers into the roadmap from day one is far easier than retrofitting them after something has gone wrong.
The assessment was never the deliverable
A good psychosocial risk assessment is genuinely valuable. It's also the beginning. The deliverable — the thing your people will actually notice — is work that has changed.
If you're sitting on a finished assessment right now and feeling a little stuck about where to start, that's a completely normal place to be. It doesn't mean you've done it wrong. It means you've reached the part that takes judgement.
That's where our psychosocial risk advisory work comes in. We take what your assessment has already found — the hazards, the current risk, the recommended controls — and work with you to build a prioritised implementation roadmap, design controls that fit your work, and support you through implementation and review. It's evidence-informed, practical, and led by a registered psychologist trained in organisational psychology, with more than 15 years' experience in psychosocial risk.
A note on jurisdiction: this article draws on the model WHS framework and Queensland's code of practice. Requirements differ between states and territories, so check what applies where you operate.
References
Bakker, A. B., & Demerouti, E. (2017). Job demands–resources theory: Taking stock and looking forward. Journal of Occupational Health Psychology, 22(3), 273–285. https://doi.org/10.1037/ocp0000056
Huebner, L.-A., & Zacher, H. (2021). Following up on employee surveys: A conceptual framework and systematic review. Frontiers in Psychology, 12, 801073. https://doi.org/10.3389/fpsyg.2021.801073
People at Work. Psychosocial risk assessment and action-planning resources. https://www.peopleatwork.gov.au
Safe Work Australia (2022). Model Code of Practice: Managing psychosocial hazards at work. https://safeworkaustralia.gov.au/doc/model-code-practice-managing-psychosocial-hazards-work
Workplace Health and Safety Queensland (2022). Managing the risk of psychosocial hazards at work Code of Practice 2022. https://www.worksafe.qld.gov.au/laws-and-compliance/codes-of-practice/managing-the-risk-of-psychosocial-hazards-at-work-code-of-practice-2022
Comments