The hazard register is often one of the first documents a WHS inspector asks to see. From there, the conversation usually moves to the risk assessments behind it, the policies that set out controls, the training records that show workers were informed, and the incident or complaint records that reveal what has actually been happening.
That sequence matters. An inspector is not only checking whether an organisation has documents. They are testing whether the organisation has a working process for identifying hazards, assessing risks, implementing controls, informing workers, and reviewing whether those controls are effective.
I have spent years building WHS management systems inside large Australian corporates. I have seen well-written documentation support an organisation under scrutiny, and I have seen a seemingly complete system unravel because nobody could establish when a document was approved, which version applied, or what happened after a risk was reported.
Psychosocial-hazard investigations make these issues particularly visible. Hazards such as excessive demands, low role clarity, poor support, bullying, harassment, conflict, and inadequate consultation can develop over time. The evidence is often spread across registers, policies, emails, complaints, meeting records, training systems, and case files. An organisation needs to show not just that it had a policy, but that it recognised the risk and took reasonably practicable steps to address it.
What an inspector is trying to establish
WHS inspectors have significant powers under the Model WHS Act. Depending on the circumstances, an inspector may enter a workplace, require documents to be produced within a specified time, take photographs or samples, and speak with workers and other people relevant to the investigation.
The purpose is not simply to collect paperwork. The inspector is forming a view about whether the PCBU understood its duties and acted on them. A document request is often a way of testing the connection between what an organisation says it does and what workers actually experienced.
For a psychosocial compliance investigation, the usual questions include:
- What psychosocial hazards has the organisation identified?
- When were those hazards identified, and through what process?
- How were the associated risks assessed?
- What controls were selected, and why were they considered reasonably practicable?
- Who approved the relevant policies, procedures, or control measures?
- Were workers consulted and informed?
- Were complaints, incidents, and warning signs recorded?
- What changed after a complaint, incident, review, or new legal guidance?
A hazard register with a long list of risks may look comprehensive, but it does not answer these questions on its own. An inspector will usually look for evidence that the register reflects a real process rather than a template completed once and then left untouched.
The same applies to policies. A policy can be technically accurate and still provide weak evidence if it has no approval record, no review date, no clear owner, or no indication that workers were trained in its requirements.
The documents most likely to be requested
Hazard registers and risk assessments
The hazard register is a starting point because it shows what the organisation says it knows about its risks. For psychosocial hazards, it should identify the relevant work factors, affected groups or work areas, existing controls, further actions, responsibility, review dates, and current risk status.
Inspectors will want to understand how the entries were created. Was there worker consultation? Were complaints, surveys, absenteeism patterns, turnover, incident reports, or return-to-work information considered where relevant? Was the register updated after a material change to work design, staffing, leadership, systems, or working arrangements?
The risk assessment should explain more than a numerical rating. It should show the reasoning behind the assessment, the evidence considered, and why the selected controls were appropriate. If the organisation has assessed a risk as low, it should be possible to understand how that conclusion was reached and when it will be reviewed.
Policies and procedures
Policy documents help an inspector assess whether controls have been put in place. Relevant documents may include policies dealing with bullying, harassment, discrimination, complaints, consultation, incident response, flexible work, working hours, performance management, and psychosocial risk management.
The document should identify its owner, approval authority, effective date, review date, and version. It should also be clear about who must do what. A statement that the organisation does not tolerate inappropriate behaviour is not, by itself, an operating control. The policy should explain reporting pathways, response responsibilities, confidentiality limits, escalation options, and how records will be handled.
References need attention as well. A policy that cites a Code of Practice or internal procedure should be checked when that source is updated. A stale reference can raise a broader question about whether the organisation has a process for tracking changes that affect its WHS duties.
Training and communication records
Training records are commonly requested because they help show whether workers were informed about hazards and controls. A completion date is useful, but incomplete on its own. The record should identify the programme or module, the content covered, the audience, the delivery date, and the people who completed it.
For higher-risk topics, it may also be useful to retain evidence of induction content, refresher training, manager briefings, toolbox discussions, consultation meetings, or communications issued after a policy change. The aim is not to collect every email ever sent. The aim is to show that the people affected by a control had a reasonable opportunity to understand it and act on it.
Incident, complaint, and corrective-action records
Incident and complaint records often reveal whether a system operates in practice. An inspector may look for the original report, triage or assessment notes, actions taken, communication with relevant people, escalation decisions, and closure or review records.
A record that says a complaint was received and closed, without documenting what was investigated or what corrective action followed, leaves an obvious gap. Not every complaint will result in a formal finding, and not every incident requires the same response. The record should nevertheless explain the decision-making process and any actions that were considered necessary.
What makes documentation defensible
Defensible documentation is not documentation that makes an organisation look perfect. It is documentation that allows a reasonable person to reconstruct what happened, who made the relevant decision, what information was considered, and whether the response was followed through.
Five features matter consistently.
- Clear dates. The document should show when it was created, approved, implemented, reviewed, and superseded. Dates help establish the state of the system at the time of an incident or complaint.
- Named accountability. Approval should be attributed to a person with the relevant authority. Ownership should also be clear for actions, controls, reviews, and overdue items.
- Version history. The current version must be identifiable, and previous versions should be retained where they are relevant to the investigation. A version history should explain what changed and when.
- Evidence of a real identification process. Registers and assessments should connect to consultation, operational information, reports, observations, or other evidence. Copying generic hazards into a template does not demonstrate that the organisation assessed its own work.
- Evidence that controls were implemented and reviewed. A planned action is not the same as a completed action. The record should show implementation, the responsible person, completion or status, and the review of whether the control worked.
These features are especially important where documents have been updated several times. If a policy was changed after a complaint, the organisation should be able to identify which version applied before the complaint, which version applied afterwards, and what prompted the change.
There is a boundary here. Good documentation does not mean excessive documentation. The goal is defensibility, not volume. A short, dated decision record that clearly explains a control may be more useful than a large folder of duplicated meeting notes. Records should be proportionate to the risk and sufficiently clear for someone outside the immediate team to understand them.
A practical scenario: the stale hazard register
Consider a synthetic example. An organisation receives a complaint from a team member who says workloads have increased, priorities change daily, and their manager has not provided adequate support. The organisation has a psychosocial hazard register, but the last review date is two years old. It identifies workload as a general risk, rates it as moderate, and lists a policy review as the main control.
During an investigation, the organisation produces the register and a workload policy. The policy is approved, but there is no evidence that the register was updated after a major restructure. There are also several team meeting records referring to unmanageable deadlines, but no entries connecting those concerns to the register or to a revised risk assessment.
That does not automatically establish a contravention. It does, however, create difficult questions. When did the organisation become aware of the changing workload? Did it assess whether the existing control remained suitable? Did it consult workers? Who was responsible for reviewing the risk? Why was the register not updated?
If the organisation cannot answer those questions through its records, the inspector may form the view that the documented system was not being maintained in practice. Depending on the circumstances, an inspector who reasonably believes a person is contravening a WHS provision may issue an improvement notice requiring the contravention to be remedied within a specified time. A prohibition notice may be relevant where there is an immediate risk to health and safety. Enforceable undertakings are another regulatory tool available in appropriate circumstances.
The lesson is not to update a register every time somebody mentions a difficult week. It is to define review triggers and follow them. A material organisational change, repeated complaints, a serious incident, a significant change in work design, or new information about a hazard may all justify a documented reassessment.
How organisations create gaps for themselves
Some organisations under-document. Others over-document in ways that create their own problems.
One common over-documentation problem is having multiple uncontrolled versions of the same policy. Human resources may hold one version, safety may hold another, and a manager may circulate an older copy saved locally. If those versions contain different reporting pathways or different responsibilities, the volume of documentation makes the system less clear, not more defensible.
Another problem is producing documents that were never used. A risk assessment may contain detailed controls, but there may be no owner, no implementation record, and no evidence that managers or workers knew about them. A procedure may describe a careful escalation process that is contradicted by the actual complaint records.
Documentation should reflect operations, not sit apart from them. If a control is a regular manager check-in, the organisation should decide what evidence is appropriate to show that the check-in occurred without recording unnecessary personal information. If a control is a change to staffing or workload allocation, the decision and review should be recorded in a way that can be understood later.
Privacy also needs care. Psychosocial records can contain sensitive health, employment, and complaint information. Access should be limited to people who need it, and an organisation should provide inspectors with relevant material in a lawful and controlled way. A defensible evidence trail is not a reason to retain every personal detail indefinitely.
Making the evidence trail usable
The practical test is simple: if a key person left tomorrow, could someone else identify the current register, the applicable policies, the approval history, the open actions, and the evidence of review?
At ReFresh, we designed our system around that question. Each action, including a policy draft, review, approval, or register update, is timestamped and attributed. The audit log can be exported as a structured report, so an organisation can show the sequence of decisions rather than assembling it manually from separate files.
That does not replace judgement, consultation, or the responsibility of the PCBU. It helps keep the evidence connected to the work. A system can record that a control was approved, but the organisation still needs to implement it, communicate it, and check whether it is working.
Before an investigation occurs, I recommend a focused documentation check:
- Open the current hazard register and confirm that its review dates are current.
- Trace several hazards back to the evidence and consultation that informed them.
- Check that every significant control has an owner, status, and review record.
- Confirm that the current policy version is identifiable and that superseded versions are controlled.
- Sample training records to see what content was delivered, not only who completed it.
- Review incident and complaint records for documented actions, decisions, and follow-up.
- Export or assemble an audit trail that a person outside the process can read without additional explanation.
When an inspector asks for the hazard register, the document itself is only the beginning. Defensible documentation shows the decisions around it, the people responsible, the controls that followed, and the reviews that tested whether those controls remained suitable. That is what turns a folder of records into evidence of a functioning WHS process.
