It was 2:30 am when Priya’s phone buzzed. As HR Director for a mid-sized professional services firm, she was used to the occasional after-hours crisis, but this text from her CEO made her stomach drop: “Emergency board meeting tomorrow. One of our senior managers died by suicide last night. Our lawyers are asking about our psychosocial risk management framework. What is psychosocial risk management?”

Priya stared at the ceiling, her mind racing. She’d heard about new workplace safety laws covering mental health, but like many executives, she’d assumed Work Health & Safety (WHS) was handling it. Now, as she frantically searched “psychosocial risks Australia personal liability” at 3 am, the reality hit her: her company, and she personally, could face criminal charges. Priya’s name has been changed, but her story represents a crisis many leaders face—one that’s entirely preventable.

Psychosocial risks are work factors that harm mental health. Think bullying, impossible workloads, toxic management. In simple terms: harmful work stress. And unlike traditional HR issues, these now carry criminal liability. After working with several boards and executive teams on psychosocial risk, I’ve identified three consistent mistakes that leave organisations legally exposed and leaders personally liable.

1. Treating it as an HR or WHS compliance exercise

Most C-suites delegate psychosocial risk (harmful risk) entirely to HR/WHS. They tick boxes: policy created, training scheduled, risk register updated. But under WHS law, officers (Board, C-suite and key managers) have personal duties that cannot be delegated. You can outsource the work, not the liability.  In a frightening wake up call, a poll I ran revealed that almost 8 out of 10 managers didn’t know how to reduce their team’s psychosocial risk. Yet Gallup research shows managers contribute 70 per cent towards team engagement and wellbeing. Houston, we have a problem The average mental health claim now costs $288,542 in NSW—nearly double what it was five years ago.

2. Waiting for the crisis before acting

The Cobar Management case illustrates the cost of inaction. Two stressed accountants complained about unsustainable hours. Nothing was done. The eventual cost: $1 million in enforceable spend to address issues, that would have cost no more than $120,000 if management had acted one year earlier. The penalties: corporate fines up to $11.8 million, individual fines up to $2.4 million, potential 10-year imprisonment.

3. Confusing “mental health awareness” with risk management

C-suites fund mental health days, resilience training, and meditation apps. These are valuable, but they’re not risk management. Psychosocial risk management examines the root causes of harm—excessive workloads, toxic management, bullying, poor change management, etc. It’s the difference between teaching someone to swim versus removing the hazards that could drown them. You must identify, assess, and control risks—not just offer support after damage is done.

Why this matters now

The legal landscape has fundamentally changed. As Narelle Beer, Executive Director at WorkSafe Victoria, states: “We’re putting employers on notice that they have a legal obligation to make sure their workplaces are psychologically safe.” This is criminal liability. The Dreamworld prosecution set the precedent, $3.6 million fine, with executives facing potential criminal charges. Personal consequences include director disqualification, heavy fines, criminal records, and imprisonment. Can you confidently tell your board what psychosocial risks exist and how you’re controlling them? If not, you’re exposed.

The contrast with physical safety risks is stark. In a number of presentations I’ve witnessed they will identify the top 5 physical safety risks and have been tracking them for 5+ years. Yet most can’t name their #1 psychosocial risk with certainty.

What C-suites must do differently

Getting this right requires the same rigour you apply to financial risk or physical safety. Psychosocial risk should appear on every board agenda. Review your top three risks, review whether they have reduced, and examine what your claims trends. Ask yourself: “If WorkSafe walked in tomorrow, what would they find?” Assign director-level accountability. This cannot be delegated to HR or WHS alone.

Audit how work is done, not just people’s feelings

Monitor the work itself: Are workloads sustainable? Do people have autonomy? Is change managed well? If you identify “excessive workloads,” the control isn’t mindfulness training. It’s workload analysis, redistributing work, hiring staff, or scoping down deliverables.

Treat psychosocial hazards like asbestos. You wouldn’t tell workers to “be more resilient to asbestos”, you’d remove it.

Ensure managers know their personal legal duties

Most managers don’t know they have personal WHS duties they cannot delegate. If they see harmful stress and do nothing, they’re personally liable. Managers need guidance on recognising warning signs, having conversations, documenting, and escalating. The process should be: Notice – Check in – Document – and Act or Escalate. You’re not asking them to be psychologists—just to care, pay attention, and get help when needed.

The path forward

Priya’s wake-up call led to a complete overhaul. The board created a psychosocial risk committee. Every executive now has specific accountabilities. Managers receive quarterly updates and relevant training. Eighteen months later, voluntary turnover dropped 23 per cent, mental health claims fell 40 per cent, and WorkSafe gave them a commendation.

Priya sleeps better now, not because there’s zero risk, but because her organisation manages psychosocial risks with the same rigour as any other workplace hazard. The question isn’t whether you’ll face psychosocial risks. It’s whether you’ll manage them before the 2:30 am phone call comes.

Graeme Cowan’s book  GREAT LEADERS CARE: Building safe, resilient and successful teams is out now.

Want more? Get our newsletter delivered straight to your inbox! Follow Business Builders on Facebook, Twitter, Instagram, and LinkedIn.