You don't need a safety department to assess psychosocial risk. You need the same four steps any safety assessment uses, a few honest sources of information, and a reminder in your calendar. If you're the one HR person, or the owner who got handed this, here's how to run a first pass.
The four steps
Every serious framework for psychosocial risk uses the same cycle: identify the hazards, assess which matter most, control them, then review whether the controls worked. ISO 45003, Safe Work Australia's code of practice and Quebec's CNESST all follow it. The only real difference from physical safety is where the hazards live. They are rooted in how work is organized and how people treat each other, not in machines or chemicals.
STEP 1: Find the hazards
ISO 45003 sorts psychosocial hazards into three groups, which makes a useful checklist:
How work is organized: workload and pace, role clarity, how much say people have over their work, hours, job security, and how change is handled
Social factors: relationships, conflict, leadership, recognition, harassment, and the balance between work and home
The work environment: equipment, tools and resources, noise, temperature, and hazardous tasks
You find them by looking in these four places:
Your own records. Absence, turnover, overtime, exit interviews and complaints show where pressure is building. They lag, but they're free and you already have them.
The people who see the work every day. Managers, your health and safety representative or committee, and anyone who handles complaints usually know which teams are struggling.
Workers themselves. A short questionnaire (you can use PRA-Pulse’s confidential check-in) or a few small group conversations will surface what the records can't. Promise only the confidentiality you can actually keep.
Periods of change. Restructuring, new systems, a new manager or a hiring freeze raise risk quickly. Look again whenever one happens.
ISO 45003 makes an obvious but often overlooked point: understand where the harm comes from before you choose how to fix it. "The support team is stressed" isn't a hazard, it’s data. "Ticket volume rose 40% after the product launch and nobody was hired" is a hazard.
STEP 2: Decide what comes first
You won't fix everything at once, so rank what you found. You don't need a scoring formula. For each hazard, ask four questions:
High, medium and low is precise enough. Pretending to more precision than you have only hides the judgment calls you made.
STEP 3: Fix the work first
The order of controls matters. Change the work itself first: redistribute workload, clarify who decides what, adjust deadlines or staffing, deal with the person who keeps causing conflict. Then add policies, training and better processes. Support for individuals, such as an EAP, comes last. That isn't because support is unimportant. It's because support helps people after harm has happened and it doesn't meet an employer's duty to prevent the risk. A team buried in workload needs the workload fixed before it needs a resilience workshop.
STEP 4: Check again, on a schedule
A control that nobody checks is a guess. Set a date to look again at each hazard, and decide in advance what "better" will look like: fewer overtime hours, fewer complaints, people reporting less strain. Then compare. And no, once a year isn't enough. Strain can build in a team over a few weeks, and an annual survey will find it months after the people affected have left or gone on leave.
Keep a simple record
For each hazard, write down what you found and how, how you ranked it, what you changed and who owns it, and what the follow up check showed. If a regulator, an insurer or a tribunal ever asks what you did, that record is your answer.
Download our Hazard identification worksheet
__________________________________
PRA-Pulse™ gives you a structured version of steps one and two, repeated every two weeks. The free Risk Profile takes HR through a short set of questions and shows how your organization trends across five areas, so you can see where to look first and whether the changes you make are working. When you're ready to hear from employees directly, PRA-Pulse™ adds a short pulse every two weeks.
See strain rise. Before it spikes. Start with Risk Profile, free: Create your free workspace | PRA-Pulse™