After more than 25 years running risk workshops, I feel qualified to make a simple observation: the 5 x 5 risk matrix can be a useful tool, but it is not always the right tool.

As my father would say, just because you have a hammer, that does not mean everything is a nail.

This matters because in psychosocial risk assessment, a basic qualitative risk matrix is not merely limited but in many cases, it can be actively misleading. It can reinforce single-issue thinking, compress complex exposure patterns into subjective scores, and create a false sense of control when the underlying conditions of work remain unchanged.

A better way starts with a different premise. Psychosocial risk assessment should not begin by asking, “What score do we give this hazard?” It should begin by asking, “How is work creating exposure, who is affected, and what needs to change?”

Start with the nature of psychosocial risk

Many conventional safety risks lend themselves to event-based assessment. A worker may fall from height. A machine may be unguarded. A vehicle may collide with plant or pedestrians. The pathway to harm is often observable, reasonably direct and capable of being assessed through consequence, likelihood and control strength.

Psychosocial risks do not usually behave in this way.

They tend to arise from the way work is designed, organised, led, resourced and changed. Excessive workload, low job control, role ambiguity, poor support, bullying, occupational violence, fatigue, poor organisational justice and poorly managed change rarely operate as isolated hazards. They interact with each other, build over time, and often become harmful through duration, frequency and intensity of exposure.

It’s clear that a heavy workload for one week is not the same as a heavy workload for six months. A difficult customer interaction is not the same as repeated occupational violence in an under-resourced environment. A restructure is not automatically harmful, but a poorly managed restructure, combined with role ambiguity, weak consultation and low trust, can become a serious source of harm.  Put these things together and risk multiplies.

A better assessment recognises that the psychosocial risks exists in the interaction between conditions, not in a single hazard sitting neatly on one line in a register, or even on multiple single lines.

Move beyond single-issue management

Psychosocial risks are often managed as single-factor problems because that is how they are assessed. Workload is placed on one line. Role clarity is placed on another. Supervisor support sits somewhere else. Bullying, fatigue, change and occupational violence may each receive their own rating.

In real workplaces, these factors are connected. Workload becomes more harmful when control is low. Poor role clarity becomes more harmful during change. Customer aggression becomes more harmful when staffing is thin, escalation pathways are weak and recovery time is absent.

A basic 5 x 5 matrix can therefore reinforce fragmented management of risk. It encourages the organisation to treat psychosocial hazards as separate individual hazards, rather than examine the operating system that is producing integrated exposure to all of them.

For psychosocial risk, qualitative scoring can therefore be worse than useless. It can lead an organisation to believe it has assessed the risk, when it has only labelled parts of it.  A better assessment examines how risk factors combine. It asks whether the work system is producing harmful exposure through demand, control, support, clarity, fairness, recovery, capability and change.

Our guide to better psychosocial risk assessment

Our approach starts with the work, not the matrix. A credible assessment must identify where exposure is occurring, how that exposure is being created, who is affected, and whether the organisation’s controls are materially reducing the risk.

Psychosocial risk is never evenly distributed across an organisation. Whole-of-business averages conceal serious localised risk and conversely pockets of great management. One division may be functioning well while another is carrying excessive workload, poor role clarity, repeated aggression, weak supervision or change fatigue.

The first step is to map exposure by workgroup, role, location, roster, task or change impact. This allows the organisation to see where the risk is concentrated, rather than relying on broad organisational assumptions.

The second step is to use more than one source of evidence. Consultation is essential, but consultation without evidence can become a contest of perceptions. A stronger assessment draws on workload data, overtime, absenteeism, turnover, workers compensation trends, complaints, incident reports, customer aggression records, exit interview themes, HSR feedback, survey results and direct consultation with affected workgroups.

Our aim is never perfect data. The aim is a defensible picture of exposure. When several indicators point in the same direction, leaders should treat that as a signal requiring action.

The third step is to examine how risk factors interact. Excessive job demands, low control, poor support, unclear roles, fatigue, conflict and organisational change should not be assessed as though they are unrelated. The assessment should identify combinations of factors that are likely to increase harm.

The fourth step is to test control effectiveness. Controls should be designed, enacted, verified and monitored. They should have clear owners, timeframes and review points. The assessment should distinguish between controls that reduce exposure and controls that merely support individuals after exposure has already occurred.

As businesses mature they are realising that psychosocial risk cannot be managed by documentation alone. Policies, EAPs and awareness training may have a place, but they should not be mistaken for controls that change the work.

The fifth step is to create a clear executive line of sight. Where the source of exposure sits in resourcing, operating models, work design, systems, staffing, leadership behaviour or change sequencing, the risk must be visible to the people who can make those decisions.

We firmly believe that psychosocial risk management is a governance issue. If the decisions required to reduce exposure sit above the local manager, the risk assessment must escalate the issue rather than leave it buried in a register.

The final step is to review whether controls are working in practice. Review should not be a calendar ritual. It should test whether exposure has reduced, whether workers are experiencing the intended change, and whether new risks have been introduced.  The purpose of psychosocial risk assessment is not to produce a better risk register. The purpose is to understand how work is creating exposure, make better decisions, and verify that those decisions are reducing the likelihood of harm.

A better way to do psychosocial risk assessment is not necessarily more complicated. It is more disciplined.  The purpose is better work, stronger leadership discipline, and a clearer line of sight to prevention.