What HSWA 2015 actually requires — and how to run it without drowning in paper

What HSWA actually asks of you

HSWA puts a primary duty of care on every person conducting a business or undertaking — a PCBU — to ensure, so far as is reasonably practicable, the health and safety of its workers and of anyone else put at risk by the work. It does not ask for a manual, a matrix or a folder. It asks you to know your risks, control them, involve the people doing the work, and be able to show that you did.

The PCBU is the business itself, not a person in it, and the duty cannot be contracted out of. Underneath it, the practical obligations fall into a short list — shorter than most consultants make it look.

• Provide and maintain a work environment, plant, structures and systems of work that are without risks to health and safety, so far as is reasonably practicable.
• Identify the risks your work creates, eliminate them where you can, and where you cannot, minimise them so far as is reasonably practicable.
• Provide the information, training, instruction and supervision people need to do the work safely, and monitor conditions and worker health where the risk calls for it.
• Engage with workers on the health and safety matters that affect them, and have practices that let them participate in improving it.
• Where duties overlap with another PCBU — a head contractor, a landlord, a labour-hire firm — consult, cooperate and coordinate with them.
• Notify WorkSafe of notifiable events, preserve the scene, and keep the records the Act requires.

Reasonably practicable, in plain English

Reasonably practicable means what is reasonably able to be done in the circumstances. It is a weighing exercise with five ingredients, and cost is deliberately the last of them — it only gets you off the hook when it is grossly disproportionate to the risk, which is a much higher bar than expensive.

1. 1.How likely is the harm? Not whether it has happened here, but whether it can.
2. 2.How bad would it be? A low-likelihood, high-consequence risk still deserves a serious control.
3. 3.What do you know, or ought to know, about the risk and the ways to control it? Industry guidance you could reasonably have read counts as knowledge you have.
4. 4.Are suitable controls available? If a better control exists and is obtainable, the argument for the weaker one gets harder.
5. 5.Is the cost grossly disproportionate to the risk? Only then does cost weigh against doing it.

This is the test an inspector applies after something goes wrong. The question will not be whether you had a procedure. It will be what you knew, what was available, and why you chose the control you chose — and the only evidence of that reasoning is what you wrote down at the time.

The duty nobody can delegate

Officers — directors, partners, board members, chief executives and anyone else who takes part in decisions that significantly affect the whole business — owe a personal duty of due diligence. It sits on the individual, not the company, and it is not satisfied by appointing a health and safety manager and reading a monthly report. The Act breaks it into six reasonable steps, which read as a governance agenda because that is what they are.

1. 1.Acquire and keep up to date knowledge of work health and safety matters.
2. 2.Understand the operation and the hazards and risks it generally involves.
3. 3.Ensure appropriate resources and processes exist to eliminate or minimise those risks.
4. 4.Ensure information about incidents, hazards and risks reaches the business and is responded to in a timely way.
5. 5.Ensure there are processes for complying with the duties HSWA imposes.
6. 6.Verify that the resources and processes in points 3 to 5 are actually provided and used.

Worker engagement is a duty

Every PCBU must engage with workers on health and safety matters that affect them, and must have practices that give workers reasonable opportunities to participate effectively in improving health and safety on an ongoing basis. Both halves are duties in their own right, and they apply whatever the size of the business.

Representation — health and safety representatives, committees, or a union — is one way of discharging them, not a replacement for them. Any worker can request a representative, and HSWA sets out when a business has to act on that request, with the thresholds turning on worker numbers and whether the work sits in a designated higher-risk sector. Check current WorkSafe guidance for where your business falls rather than relying on a number someone repeated in a course.

Three things make engagement real rather than declared, and all three leave a record as a by-product.

• Workers can raise a hazard or a concern in under a minute, from where the work happens, without asking anyone for a form.
• Everything raised gets an owner and an answer — including the ones you decide not to act on, with the reason.
• The people affected are consulted before a control changes, not told afterwards.

If you want to know whether it is working, look at who raised the last ten items. If they all came from one office, the practices exist on paper only.

What you actually have to write down

Far less than most businesses think, and far more consistently. HSWA and its regulations specify particular records — notifiable event records must be kept for at least five years from notification, health monitoring and exposure records for considerably longer, and there are specific requirements around hazardous substances, plant and certain work. Beyond those, documentation exists to evidence that a duty was met.

Which reframes the question usefully. Do not ask what should we document. Ask what would I need to produce if an inspector arrived on Tuesday — then keep that, in one place, as the work happens.

• Your risks and their controls, with the last review date and a named owner. A register is not required by name; being able to show you identified and controlled the risk is.
• Training, induction and competence — who was trained, in what version, and how competence was judged. Attendance alone is the most common weak point.
• Plant and hazardous substances — maintenance, pre-start and inspection records, and the inventory, Safety Data Sheets and location records the regulations require.
• Engagement — toolbox talks, concerns raised, and what happened to each one.
• Incidents and their actions — including the effectiveness check, not just the closure.
• Contractor records — held by you, not by the contractor, and current at the date of the work.

What changes on 1 April 2027

The Health and Safety at Work Amendment Bill passed on 1 July 2026 and takes effect on 1 April 2027. The headline for most readers of this page is proportionate duties for small businesses: a business with fewer than 20 workers for at least nine months of a financial year will be required to manage critical risks ahead of other risks, rather than treating every risk as equal.

Critical risk is defined by reference to the hazards in Schedule 1A of HSWA, plus any hazard likely to result in death, a notifiable injury or illness, a notifiable incident, or an occupational disease. Officer duties are restated around governance, and landowners lose health and safety duties to recreational users except where the activity is connected to the work, or work is happening at the same time and place.

A system that maintains itself

The reason small businesses drown in paper is not that HSWA demands it. It is that a folder-based system has to be maintained by a person remembering to maintain it, and that person is also doing their actual job. The fix is not more discipline — it is putting the record where the work already happens, so keeping it is a by-product rather than a task. Five steps get you there.

None of this requires software. It requires that the evidence exists where the work happens and can be produced without a search. Spreadsheets do that perfectly well for a small single-site operation, and stop doing it at the point where chasing becomes somebody's job.

Questions we get asked