A safety committee can spot a hazard, write it down, and still be non-compliant, because WHS risk management regulation does not stop at identifying a risk.
Australian law treats WHS risk management as an ongoing legal duty, not a one-off task, and it applies to almost every business with a worker on site.
Safe Work Australia recorded 146,700 serious workers' compensation claims in 2023 to 2024, more than 400 a day, and 188 workplace deaths in 2024 alone. Numbers like that are why WHS risk management is a legal requirement, not just good practice.
WHS risk management regulation requires an ongoing cycle of identifying, managing, and reviewing risk, not a one-off task, and skipping the review step is one of the most common compliance gaps regulators find.
By the end of this article, you will know what WHS risk management regulation covers in practice, how Australia's approach differs from the general picture, and what happens if you get it wrong.
Key Takeaways
- WHS risk management regulation requires you to identify hazards, manage the risk they create, and review your chosen controls on an ongoing basis, not as a one-off task.
- Australia ties WHS risk management to specific roles: a business, its officers, and its workers, rather than a general duty of care.
- The "reasonably practicable" test weighs the cost of a control against the risk it removes, rather than demanding every possible precaution regardless of cost.
- A written risk assessment is not strictly mandatory under the WHS Regulation, but an unwritten process is very hard to defend once a regulator asks about it.
- PCBUs, officers, and workers each carry a different standard of responsibility under WHS risk management regulation.
- Every Australian state now regulates psychosocial hazards the same way it regulates physical ones, since Victoria's own rules began in December 2025.
- Regulators mainly check documentation, a risk register, review dates, and evidence that workers were consulted when assessing compliance with WHS risk management.
What Does the WHS Regulation Require You to Do to Manage Risk?
The WHS Regulation requires you to identify hazards in your workplace, manage the risk each one creates, choose a control using the hierarchy of controls, and then maintain and review that control for as long as the risk exists.
This duty appears in Part 3.1 of the Work Health and Safety Regulations 2011, sections 34 to 38, and applies in every state and territory except Victoria, which follows its own Occupational Health and Safety Act 2004.
WHS risk management regulation comes from three layers of law, though only one usually needs your attention day to day.
- The WHS Act establishes the broad requirement to manage risk.
- The WHS Regulations turn that requirement into the specific duty described above.
- Codes of Practice explain how to meet that duty in practice; courts treat compliance with a relevant Code as evidence a business met its obligations.
Choosing a control means working through a fixed hierarchy of controls, in a set order:
- Elimination removes the hazard completely.
- Substitution replaces it with something less dangerous.
- Isolation physically separates people from it, with a barrier or a fenced off zone.
- Engineering controls change the equipment or the workspace itself.
- Administrative controls change how the work is done, through training or a procedure.
- Personal protective equipment is the last resort, once every option above has been used.
Australia keeps isolation as its own step, where a lot of international guidance considers it a part of engineering controls instead.
How Do You Manage Risk According to WHS in Australia?
Managing risk according to WHS in Australia follows four steps, the same basic process used in most countries:
- Identify the hazard, walking the workplace and asking what could realistically cause harm.
- Assess the risk, weighing how likely the harm is against how serious it would be.
- Apply a control, chosen based on that assessment.
- Review the control over time, since a workplace rarely stays exactly the same for long.
That first step is the starting point for hazard identification in any safety system, not just an Australian one.
This then helps figure out how likely the harm is, against how serious it would be, a combination that determines how strong a control the situation needs. This is known as the risk score which would help you decide the controls required to eliminate them or decrease their likelihood of reducing harm.
Once a control is chosen and applied, reviewing it later confirms the control is still doing its job, since a workplace rarely stays the same for long. To score that likelihood against severity and choose the right template, and learn how to conduct a risk assessment.
That process is the same everywhere. Australia's version of it differs only in the name of the regulation and the legal framing behind it: WHS here, OHS in most of the rest of the world and in Victoria specifically, for the same underlying idea.
The process itself does not change between countries; only the name and the surrounding legal framing do. Australian law also ties WHS risk management to specific roles rather than a general duty of care: a business known as a PCBU, its officers, and its workers each carry a defined level of responsibility.
Even the six-step hierarchy of controls named above is a small Australian detail on its own, since a lot of international guidance uses five steps instead, folding isolation into engineering controls.
What Does "Reasonably Practicable" Mean Under WHS Law?
Reasonably practicable means doing what you could realistically do, at the time, to reduce a risk, weighed against the cost of doing it and how serious the risk actually is. It is not a demand to remove every possible risk regardless of cost, nor a free pass to do nothing.
Section 18 of the WHS Act 2011 is the exact legal source for this test, and the test applies to the entire WHS risk management duty covered above, not just one part of it. Its full legal name is so far as is reasonably practicable, a standard with enough nuance in practice to deserve its own explainer.
Do You Need a Written Risk Assessment Under the WHS Regulation?
No, the Regulation itself does not require a specific written document for every risk, though it does require you to be able to show how you identified a hazard and chose a control. In practice, showing that is very hard to do without something written down.
A process that only ever happens verbally, for instance, does not survive to the next audit, the next new worker, or the next incident investigation. Most regulators treat a complete absence of records as a sign the WHS risk management duty was not met, whether or not that is technically fair.
A risk assessment written down once can also be checked against later, which an unwritten one cannot.
Who Does WHS Risk Management Regulation Apply To?
WHS risk management regulation applies to a PCBU, meaning a person conducting a business or undertaking, along with that PCBU's officers and its workers. Each carries a different level of responsibility.
A PCBU, an officer, and a worker each carry a different level of responsibility:
- A PCBU must manage risk so far as reasonably practicable.
- An officer, meaning a director or anyone who makes decisions affecting the whole business, must exercise due diligence, taking active steps to check the PCBU is meeting its duties.
- A worker must take reasonable care for their own safety and for anyone else who could be affected by what they do.
A PCBU's other obligations go well beyond risk management, so WHS risk management is only one slice of a larger set of obligations. The PCBU label itself is broader than "employer," since it also covers sole traders and some volunteer organisations.
How Does WHS Risk Management Regulation Differ by State?
Most Australian states and territories follow the same model WHS laws, the shared Act and Regulations text most of them adopted instead of writing their own. Victoria is the exception, following its own Occupational Health and Safety Act 2004 and its own regulator, WorkSafe Victoria.
Even among the states that share the model law, individual rules can still move independently of each other. In 2026, South Australia tightened its rule for high risk construction work, lowering the fall height threshold that triggers extra paperwork from three metres to two.
The Northern Territory moved the opposite way in the same year, raising its own residential threshold from two metres to three. Two states adjusting the same rule in opposite directions within months of each other shows that the model law is a shared starting point for WHS risk management, not a fixed national standard.
How Do Industry-Specific Rules Layer on Top of WHS Risk Management Regulation?
WHS risk management regulation is the floor every business has to meet, and some industries carry extra rules on top of that floor. Two hazard types, psychosocial hazards and hazardous chemicals, apply to almost every industry, while other rules are industry-specific.
Construction is the clearest example of an industry-specific layer, since high risk construction work triggers its own written safety plan requirement before work can start.
Hazardous chemicals
Hazardous chemicals carry their own extra rules on top of the general WHS risk management duty, covering labelling, safety data sheets, and exposure limits. The core requirement is straightforward: identify what is present, then control the exposure.
Psychosocial hazards
Psychosocial hazards, things like bullying, excessive workload, or exposure to distressing events, are now treated the same as physical hazards under WHS risk management regulation. Every Australian state now has some form of psychosocial hazard regulation in force, since Victoria's own rules began in December 2025 and closed the last gap.
The same four-step duty– identify, manage, control, review– applies to psychosocial hazards too, just with a different kind of control: a change to workload or reporting lines instead of a physical barrier.
What Are the Penalties for Not Complying with WHS Risk Management Regulation?
Penalties for breaching WHS risk management regulation scale with how serious the failure was. At the lower end, a straightforward breach can mean a fine.
At the top end, if negligent or reckless conduct leads to a death, a business or an individual can face industrial manslaughter charges, a criminal offence now in force in every Australian state and territory.
New South Wales carries one of the highest penalties for this offence, up to 25 years' imprisonment and a 20 million dollar fine, currently the largest maximum fine of any state. The exact figures differ by jurisdiction and change over time, so confirm the current number for wherever you operate.
Common Mistakes Businesses Make with WHS Risk Management
A handful of mistakes account for most of the compliance gaps regulators find:
- Treating a risk register as something filled out once and filed away, rather than a living document.
- Reaching straight for a safety poster or PPE instead of working down the hierarchy of controls.
- Assuming a written policy is the same thing as a risk that is being managed, when a regulator wants to see the two line up.
- Assuming, specifically in Victoria, that its Occupational Health and Safety Act mirrors the rest of the country, when Victoria now has its own separate psychosocial rules and its own separate penalty structure.
A WHS inspector checks for much the same things, just from the other direction:
- A current risk register or equivalent record.
- Dates showing when controls were last reviewed.
- Evidence that workers were consulted, not just told.
SafeWork NSW's most recent enforcement priorities are a live example of what one regulator is currently focused on.
Make WHS Risk Reviews Part of a Routine
Most of the compliance gaps WHS risk management regulation actually catches happen after the control is chosen, not before it. A business picks the right control under section 36, applies it, and treats the job as finished, when sections 37 and 38 still require that control to be maintained and reviewed for as long as the risk exists.
That ongoing maintenance and review duty is where records tend to fall apart. A control chosen in January and never revisited is functionally the same as no control at all if a regulator asks about it in December.
EHS Solution by SDS Manager keeps review dates, controls, and records attached to the hazard they belong to, so a control keeps getting maintained and reviewed long after the day it was first put in place.
Frequently Asked Questions
Does WHS Risk Management Apply to Volunteers and Unpaid Workers?
Yes, WHS risk management applies to volunteers and unpaid workers the same way it applies to paid workers, since the WHS Act defines a worker as anyone who carries out work for the business, paid or not. The main exception applies to casual volunteers for community and charity groups, which some states treat differently.
Do Sole Traders Need to Follow WHS Risk Management Regulations?
Yes, sole traders need to follow WHS risk management regulations, since a sole trader is a PCBU in their own right and the same duties apply even when they are the only person doing the work. The duty scales down in practice, since there are fewer workers to consult and fewer risks to manage than on a larger site.
Can an External Consultant Carry Out a WHS Risk Assessment for You?
Yes, an external consultant can carry out the technical work of a WHS risk assessment for you, but the legal duty to manage the risk still belongs to the PCBU, not the consultant. A business that outsources the assessment still has to act on what it finds.
Does ISO 31000 Have Any Legal Standing Under Australian WHS Law?
No, ISO 31000 has no legal standing under Australian WHS law on its own, since it is a voluntary risk management standard rather than a legislated one. Some businesses use it to structure their internal processes, but it does not replace the specific duties covered above.
Is Workers' Compensation Linked to WHS Risk Management Compliance?
No, workers' compensation is not directly linked to WHS risk management compliance, since it covers an injured worker regardless of whether the business met its WHS duties. A poor risk management record can still raise a business's premium and draw closer regulatory attention after a claim.
Arysha Alif Khan
Arysha Alif Khan is an EHS and chemical safety specialist with a background in biochemistry, biotechnology, and public health. She works closely with the product and regulatory teams to turn complex chemical regulations, SDS requirements, and workplace safety standards into clear, practical guidance for people.