Before staff start logging off, complete the psychosocial hazard register review, close or escalate this year's incidents, and file a risk-assessment summary. These are the year-end WHS tasks most likely to be deferred, then difficult to reconstruct when people return.
Under Australian WHS law, a PCBU must identify, assess, control and review psychosocial risks. That review is ongoing, not a once-a-year exercise. However, the end of the calendar or financial year provides a useful checkpoint for confirming that your records still reflect how work is actually being performed.
This checklist is designed for HR managers, workplace safety teams and operational leaders preparing their year-end compliance files. It is not a substitute for legal advice, a jurisdiction-specific audit or a full investigation of a serious incident. Requirements can differ across the eight Australian state and territory WHS frameworks, so confirm any issue that depends on your regulator, industry or workforce arrangements.
1. Review the psychosocial hazard register
Start with the register, but do not treat it as a document-cleaning exercise. The question is whether each entry still describes a real exposure, with a control that is operating in practice.
- Check that the register covers the relevant psychosocial hazard categories identified in Safe Work Australia guidance. These include factors such as high job demands, low job control, poor support, bullying, harassment, violence and aggression, and traumatic events.
- Identify stale entries. Look for hazards with an old review date, an accountable person who has left, controls that refer to a retired process, or risk descriptions that no longer match the team's work.
- Confirm that each entry records the hazard category, severity, current controls, accountable person and next review date.
- Check whether changes in work arrangements have created new exposure points. Examples include remote work, restructures, new performance targets, increased customer aggression, overtime patterns or a shift to automated work allocation.
- Confirm that controls are specific enough to be checked. "Provide support" is less useful than a documented supervision process, workload review, escalation pathway or manager training requirement.
- Record any unresolved gap and assign an owner. A risk that cannot be resolved before the shutdown should have an interim control, a due date and a clear escalation route.
A 45-person professional services firm in Melbourne, for example, may have a register entry for excessive workload that was assessed when the business had three client teams. After a restructure, two teams may now share one manager and work across different time zones. The old control, a monthly workload discussion, may no longer be enough. The year-end review should record the changed exposure, assess the current controls and set the next review date, rather than simply marking the old entry as complete.
Not every organisation will need every hazard category, and not every risk requires the same control. The test is whether your organisation has considered the hazards that are reasonably foreseeable in its work and whether the controls are reasonably practicable.
2. Check policy review dates and supporting documents
Policies often remain in a document library long after the process behind them has changed. Before the break, check that your policy suite is current, approved and accessible to the people expected to use it.
- List the review date, owner and approval status for relevant psychosocial risk policies and procedures.
- Check policies covering bullying, sexual harassment, discrimination, violence and aggression, complaints, grievance handling, flexible work, fatigue, remote work and incident response where applicable.
- Confirm that policy language matches current reporting channels, contact details and escalation arrangements.
- Check that policies refer to the way work is actually managed, including remote or hybrid teams, contractors, labour hire workers and after-hours contact expectations where relevant.
- Remove superseded versions from the main staff access point, while preserving the approved record according to your document-control process.
- Record the next review date and the person accountable for completing it.
Policy review does not always mean rewriting every document. If a policy remains suitable, record that it was reviewed, who approved it and why no substantive change was required. That short decision record is more useful than changing the file date without documenting the review.
Pay particular attention to policies that depend on a separate procedure. A statement that workers can report concerns is incomplete if the organisation has not confirmed who receives reports, how confidentiality is handled, how urgent safety concerns are escalated and how information is stored.
3. Reconcile incidents, complaints and open actions
Year-end is a practical point for checking that the incident log tells the same story as the risk register, complaints process and corrective-action tracker. It is also a chance to identify matters that appear administratively closed but still require a control review.
- Confirm that psychosocial incidents, complaints and near misses raised during the year have been recorded in the appropriate system.
- Check that each record includes the date, relevant work context, immediate action, investigation or assessment status, outcome and assigned follow-up.
- Separate the facts of an incident from assumptions about an individual's behaviour or health.
- Confirm that any required notification or escalation has been considered under the applicable WHS framework and internal procedure.
- Check that open actions have an owner and due date, and that overdue actions have been escalated.
- Link recurring issues back to the relevant hazard register entry, policy or control.
- Confirm that the record is marked closed only when the agreed action has been completed or a documented decision has been made to change the action.
Closure does not mean that everyone involved agrees with the outcome or that a complaint resulted in disciplinary action. It means the organisation has completed the relevant process, recorded the decision and considered whether a broader workplace control needs to change. Some matters will need to remain restricted to authorised people, but restricted access should not mean the WHS learning is lost.
Keep records of risk assessments, policy documents, training records and incident logs in a way that makes them accessible to authorised personnel and WHS investigators if required. Most Australian jurisdictions do not set a single mandated minimum retention period for all training records and risk register entries under the Model WHS Regulations. Retention requirements can vary by record type and jurisdiction, so use your legal, regulatory and internal records-management requirements rather than applying one blanket period.
4. Confirm staff awareness and training records
A training register can look complete while staff awareness is out of date. Check both the record and the practical coverage of the programme.
- Review completion records for psychosocial hazard awareness, code of conduct, bullying and harassment, incident reporting, manager responsibilities and any role-specific training.
- Identify overdue, incomplete or invalid records, including workers who changed roles during the year.
- Check coverage for new starters, people returning from extended leave, contractors and labour hire workers where your organisation has responsibilities for their work.
- Confirm that managers have received guidance appropriate to their role, including how to respond to a concern, record an issue and escalate an immediate risk.
- Check whether training content reflects current policies, reporting channels and relevant regulatory guidance.
- Record any refresher training scheduled for the first quarter, with an owner and audience.
Not every worker needs the same training. A frontline team exposed to customer aggression may need scenario-based instruction and a clear escalation process, while a senior manager may need training on workload design, consultation and responding to complaints. The year-end check is not a request to train everyone on everything. It is a test that the right people have received the information and capability needed for their work.
Where a training module has a high completion rate but repeated incidents point to the same misunderstanding, record that as a control question. Completion alone does not demonstrate that the control is working.
5. File the year-end risk-assessment summary
Finish with a short summary that allows someone else to understand what was reviewed, what changed and what remains open. This is the file a new HR lead, auditor or WHS investigator should be able to read without reconstructing the process from scattered emails.
- State the review period, business areas covered and people consulted.
- List the key psychosocial hazards reviewed and any new or changed risks.
- Record significant changes to controls, policies, reporting arrangements or training.
- List incidents, complaints or trends that resulted in a control review, without including unnecessary personal information.
- Identify unresolved risks, interim controls, accountable people and next review dates.
- Attach or link the supporting register, approved policies, consultation records, training summary and incident action log.
- Record the approver and the date the summary was filed.
Use a clear file name and location, apply access restrictions to sensitive material and make sure the final version cannot be confused with a draft. If your organisation uses a compliance platform, the evidence trail should show the relevant policy version, review activity, assigned owner and action history. ReFresh, for example, combines AI policy drafting and regulation change alerts with a psychosocial risk register and evidence trail. The register records the hazard category, severity, current controls, accountable person and next review date.
Before the office closes, take one final pass through the unresolved items. A year-end review is successful when it leaves a reliable record, not when every risk has been made to look finished. File the summary, schedule the next reviews and carry open actions into the first operational meeting of the new period.
