How to Put Psychosocial Hazards on Your Risk Register

Most HSE managers hit the same wall about a fortnight after they start taking ISO 45003 seriously. They accept the argument. They have leadership support. Then they open the risk register, look at forty rows of dropped objects, confined space entry and hydrocarbon release, and have no idea what to type.

The register is the point where psychosocial risk becomes real or stays a slide. Until a hazard sits on the same document as pressure testing and lifting operations, with an owner and a review date, nothing has been managed. It has been discussed.

Here is the mechanic.

First, do not build a second register

The instinct is to create a separate wellbeing risk register so the new material has somewhere to live. Resist it. A parallel register gets reviewed by a different committee at a different cadence and dies within two cycles.

Psychosocial hazards go on the register you already have, in the same format, reviewed in the same forum, with the same governance. If your existing register cannot hold them, the problem is the register design, and fixing that is a smaller job than running two systems.

Name the hazard, not the harm

This is where most attempts fail on the first line. Someone writes "stress" or "mental health" or "employee wellbeing" in the hazard column and the entry is useless from that moment.

Stress is harm. Fatigue is harm. Burnout, anxiety and psychological injury are all harm. The hazard is the condition of work that produces them, and it is always something the organisation designed, funded and scheduled.

So the entry is not "fatigue". It is "back-to-back 12-hour night shifts across a 28-day rotation with no scheduled recovery period". Not "stress". Rather "sustained work demand on the maintenance planning team exceeding available headcount during shutdown windows". Not "bullying". Instead "no functioning route to raise a grievance about a supervisor without reporting to that supervisor".

The test is simple. If you cannot point at a decision, a roster, a budget line, a structure or a process that created the condition, you have written a symptom rather than a hazard, and nobody will be able to control it.

ISO 45003 gives you the source material for this. Tables 1 and 2 set out the hazard categories: how work is organised, the social factors at work, and the work environment and equipment. Work them through function by function rather than as a single organisation-wide list, because the hazards on a rig, in a control room and in a shore-based finance team have almost nothing in common.

Assess exposure, not just severity

Standard risk matrices were built for energy release. One event, one moment, one consequence. Psychosocial harm rarely works that way. It accumulates, and the same matrix that handles a dropped load handles it badly.

You can still use your existing matrix. Adjust what you feed into it. For likelihood, ask about exposure: how many people are subject to this condition, how often, and for how long. A condition affecting six people for two weeks a year is a different risk from the same condition affecting two hundred people continuously, even though the harm is identical.

For consequence, resist the pull toward the most extreme outcome. Everything on a psychosocial register can theoretically end in a psychological injury claim or worse, so scoring on that basis makes every line identical and the register loses its ability to prioritise. Score the realistic range of harm at the current level of exposure, and record the credible worst case separately if your matrix allows.

Attach the evidence

An auditor will ask what the score is based on. "Professional judgement" is a weak answer for a psychosocial hazard in a way it would never be for a working-at-height risk, because the assessor cannot see the hazard from a walk-around.

Diagnostic data is the primary source. Where a driver such as work design or leadership scores At Risk in one location and Strong in another, you have a specific, evidenced, location-bound entry rather than a general concern. Around that, use what you already collect. Hours-of-rest records and actual versus rostered hours. Turnover and early-contract resignations by department. Unplanned absence patterns. Grievances and speak-up volumes, and equally the absence of them, since silence in a large workforce is data. Exit interview themes. Overtime approvals.

None of these are perfect measures. Together they are a defensible basis for a score, which is what the register needs.

Put the control at the right level

Apply the hierarchy of control properly and psychosocial risk stops being mysterious. The trouble is that most organisations enter at the bottom.

Elimination and substitution mean changing the work itself. Roster redesign. Additional crewing. Removing a task, re-sequencing a shutdown, changing a contract term that created the pressure. These are the controls that work, and they are expensive, which is why they are skipped.

Engineering and systemic controls mean designing the pressure out through process. Workload caps with a trigger for review. Escalation routes that do not run through the person the concern is about. Handover protocols. Planning cycles that do not routinely produce impossible schedules.

Administrative controls are training, policy, awareness and communication. Useful. Not sufficient on their own.

Individual support, employee assistance, counselling and resilience training sit at the bottom of the hierarchy, in the same position as personal protective equipment. They help the person cope with an exposure that still exists. If your control column reads "EAP available" against a hazard about crewing levels, you have written PPE against a hazard that needed elimination, and any competent auditor will say so.

Give it an owner who can actually change something

The control owner must be the person with authority over the condition. If the hazard is roster design, the owner is the operations manager who sets the roster. If it is a contract term that drives schedule pressure, the owner sits in commercial. If it is supervisor capability, the owner is the line manager two levels above.

Defaulting every psychosocial line to HR is the single most common failure on these registers. HR does not set crewing levels, cannot change a client's turnaround window and has no authority over a shutdown schedule. Assigning the risk there guarantees it stays open forever, and it teaches the organisation that psychosocial risk is a personnel matter rather than an operational one.

Set a review trigger, not just a review date

Annual review is the default and it is too slow for this class of hazard. Psychosocial risk moves with organisational change, so tie review to events as well as dates. Restructure. A change in crewing model. A new contract with different schedule demands. A major project mobilisation. A serious incident. Any of these should reopen the relevant lines immediately.

The leading indicator to watch between reviews is whether the control is actually operating, not whether harm has appeared. If a workload cap exists and is breached nine weeks out of twelve, the control has failed even though nobody has been hurt yet.

A worked line

Hazard: night-shift crewing on the supply vessel fleet routinely one person below the planned complement, absorbed through extended hours by the existing watch.

Harm: fatigue, degraded decision-making in safety-critical watch-keeping, cumulative psychological strain.

Exposure: approximately 40 crew, continuous across the rotation, present for at least nine months.

Evidence: hours-of-rest records showing recorded rest clustering immediately above the regulatory minimum, Work Design driver scoring At Risk in the diagnostic, two resignations citing workload at exit.

Existing controls: hours-of-rest reporting, employee assistance line.

Control gap: no control addresses the crewing shortfall itself.

Further control: recruit to complement by Q2, interim rotation adjustment, workload cap with escalation to the fleet manager on breach.

Owner: Fleet Operations Manager. Not HR.

Review: quarterly, and on any change to the crewing model.

That line is auditable, specific and uncomfortable, which is roughly the definition of a good register entry. It also tells you exactly what the organisation must spend to close it, which is the reason these hazards so often stay unwritten.

Frequently asked questions

Do psychosocial hazards legally have to go on the risk register?

It depends where you operate. Australia, and a growing number of other jurisdictions, now place explicit duties on employers to identify and control psychosocial hazards under work health and safety regulation, with codes of practice setting the expectation. Elsewhere the duty sits inside the general obligation to provide a safe workplace, which covers psychological health whether or not a specific regulation names it. ISO 45003 itself is guidance rather than law, but regulators and auditors increasingly treat it as the benchmark for what reasonable practice looks like.

What is the difference between a psychosocial hazard and a psychosocial risk?

The hazard is the condition of work with the potential to cause psychological or physical harm, such as a roster design, a workload level or an unresolved conflict route. The risk is the likelihood and severity of harm arising from exposure to that hazard. Registers fail when the two are confused and someone records the harm, such as stress or burnout, in the hazard column.

Can I use my existing risk matrix for psychosocial hazards?

Yes, and you generally should. What changes is the input rather than the tool. Assess likelihood through exposure, meaning how many people are subject to the condition, how often and for how long, since psychosocial harm accumulates rather than arriving in a single event. Score consequence at the realistic range of harm at current exposure, not at the theoretical worst case, or every line will score identically and the register will lose its ability to prioritise.

Do I need a separate psychosocial risk register?

No, and a separate register usually works against you. Psychosocial hazards belong on the existing risk register, in the same format, reviewed in the same governance forum. A parallel document tends to be reviewed by a different group at a different cadence, and it typically stops being maintained within two cycles.

Who should own a psychosocial risk on the register?

The person with authority over the condition that creates the hazard. If the hazard is roster design, the owner is the operations manager who sets the roster. If it is a contract term driving schedule pressure, the owner sits in commercial. Assigning every psychosocial line to HR is the most common failure on these registers, because HR cannot change crewing levels, contract terms or shutdown schedules.

Is an employee assistance programme a valid control?

It is a valid control, at the bottom of the hierarchy. Employee assistance, counselling and resilience training occupy the same position as personal protective equipment, since they help a person cope with an exposure that still exists rather than removing it. Listing an assistance programme as the only control against a hazard about workload or crewing will not stand up to audit.

What evidence do I need to justify a psychosocial risk score?

Enough that an auditor can see the score came from something other than opinion. Diagnostic data scoring specific drivers by location or function is the strongest source. Around it, use hours-of-rest records and actual versus rostered hours, turnover and early resignations by department, unplanned absence patterns, grievance and speak-up volumes, and exit interview themes. No single source is sufficient. Together they form a defensible basis.

How often should psychosocial risks be reviewed?

Annual review is too slow on its own, because this class of hazard moves with organisational change. Set event triggers alongside the review date: restructures, changes to the crewing model, new contracts with different schedule demands, major mobilisations and serious incidents should all reopen the relevant lines. Between reviews, monitor whether the control is operating rather than waiting for harm to appear.

Can an organisation be certified to ISO 45003?

No. ISO 45003 is a guidance standard and is not certifiable. Organisations certify to ISO 45001 for occupational health and safety management, and use ISO 45003 to shape how psychosocial risk is handled inside that system. Work is properly described as aligned to ISO 45003, never certified to it, and any provider claiming otherwise is misrepresenting the standard.