Work health and safety compliance for Australian employers
Australian employers (technically "PCBUs" — persons conducting a business or undertaking) have work health and safety obligations under the harmonised WHS Acts in most states. The primary duty is to ensure, so far as reasonably practicable, the health and safety of workers and others affected by the business. This guide sets out 10 core obligations.
Coverage
Persons conducting a business or undertaking (PCBUs) under the WHS Act in each state. Officers of PCBUs (directors and senior management) also have a personal due diligence duty. Workers have their own obligations.
Legal basis
The harmonised WHS framework is set out in the Work Health and Safety Act 2011 in NSW, QLD, SA, TAS, ACT, NT, and the Commonwealth. Victoria and Western Australia have their own (similar but distinct) frameworks. SafeWork Australia produces model regulations and codes of practice.
The obligations
Primary duty to ensure health and safety
Ensure, so far as reasonably practicable, the health and safety of workers and other persons affected by the work. The duty is non-delegable.
Provide a safe work environment
Provide and maintain a work environment that is safe and without risks to health, including safe systems of work, plant, and structures.
Consult with workers
Consult with workers on health and safety matters that affect them — including risk assessments, control measures, and changes to work practices.
Identify hazards and assess risks
Systematically identify hazards in the workplace and assess the associated risks. Document the assessments and review periodically.
Implement control measures
Eliminate risks where reasonably practicable. Where elimination is not possible, minimise risks using the hierarchy of controls (substitute, isolate, engineer, administer, PPE).
Officer due diligence
Officers of the PCBU (directors and senior managers) must exercise due diligence to ensure the PCBU complies with its WHS duties. This is a personal duty.
Provide information, training, and instruction
Provide workers with the information, training, instruction, and supervision necessary to protect them from health and safety risks.
Notify notifiable incidents
Immediately notify the regulator of notifiable incidents — work-related deaths, serious injuries, and dangerous incidents. Preserve the incident site until directed.
Maintain incident records
Keep records of notifiable incidents for at least 5 years. Records must include date, time, location, and circumstances.
Manage psychosocial hazards
Identify and manage psychosocial hazards (workplace stress, bullying, harassment, fatigue) using the same risk management process as physical hazards.
What happens if you do not comply
Category 1 offences (reckless conduct causing risk of serious harm) carry penalties of up to $3 million for body corporates, $600,000 / 5 years imprisonment for officers, and $300,000 / 5 years for individuals. Category 2 and 3 offences carry lower but still substantial penalties.
Reporting requirements
Notifiable incidents must be reported to the regulator immediately by phone, followed by written notification within 48 hours. The incident site must be preserved until the regulator gives clearance.
What firms should do today
- Conduct a documented WHS risk assessment of the workplace
- Establish a written WHS management system
- Train officers on the due diligence duty
- Build psychosocial hazard management into the WHS system
- Run a notifiable incident drill annually
- Maintain an incident register and review trends quarterly
Compliance with Quillio
Quillio supports WHS compliance by drafting WHS policies, risk assessments, incident reports, and training materials in current AU format. See /practice-areas/employment-lawyers or start a free trial.
This guide is general information about WHS obligations. State frameworks vary slightly — particularly Victoria and WA. Always obtain specialist WHS advice for your specific circumstances.
Build compliance into your stack.
Quillio is built around AU compliance from the ground up — SOC 2 Type II + ISO 27001 + Australian data sovereignty. The free trial requires no credit card.
Start your free trial