Workplace Bullying Through the Psychosocial Lens: How the New WHS Regulations Change Everything

For most of the last twenty years, workplace bullying has been treated as an HR problem. A complaint is made, an investigation is conducted, an outcome is delivered. Under the 2022 psychosocial regulations and the 2024 Model Code of Practice, this reactive model is no longer sufficient. Bullying is now a recognised psychosocial hazard, and the duty to manage it sits with the PCBU under WHS law - not with HR under industrial law. The shift sounds technical. The operational consequences are not.

The old model: bullying as a complaint stream

Under the conventional model, bullying enters the organisation through a complaint. The complaint triggers an investigation, the investigation produces findings, the findings produce outcomes. This is essentially a downstream system - it activates only after harm has occurred and someone has been willing to raise it through formal channels.

The model has well-documented weaknesses. Most workers who experience bullying never complain - the Productivity Commission's mental health inquiry estimated formal reporting rates well below 10% of incidents. Investigation outcomes often dissatisfy both parties. And the model creates no obligation to address the conditions that allowed the bullying to occur in the first place.

The new model: bullying as a psychosocial hazard

Under Section 19 of the WHS Act, the PCBU has a primary duty to ensure, so far as is reasonably practicable, the health and safety of workers. The 2022 amendments to the WHS Regulations explicitly extend this duty to psychosocial risks. The 2024 Model Code of Practice lists bullying among the recognised psychosocial hazards in the "poor workplace relationships" category.

The legal effect is that the duty to manage bullying is now proactive. The PCBU must identify the risk, consult on controls, implement them, and review their effectiveness - whether or not anyone has complained. The complaint-driven HR model continues to exist (and is still necessary), but it now operates alongside a parallel WHS-driven obligation that does not wait for a complaint.

What changes operationally

Five things change in practice, and they change for HSEQ managers, not just for HR.

1. Risk identification becomes mandatory

Organisations must actively look for the conditions associated with bullying - not wait to be told. This means examining team-level data: turnover patterns, absenteeism, engagement scores, exit interview themes, anonymous intake submissions, and incident reports. The question is not "have we received a complaint" but "do our signals suggest this hazard exists in any part of our operation."

2. Consultation becomes a defence

The Code requires consultation with workers about psychosocial risks. For bullying specifically, this means consultation about the conditions, controls, and review mechanisms - not investigation of individuals. The distinction matters legally. Consultation about the system is a WHS obligation. Investigation of an individual is an HR process. Both may be needed; they are not the same thing.

3. Controls must be hierarchical

The bullying-as-HR-complaint model has essentially one control: investigate and respond to complaints. The bullying-as-psychosocial-hazard model requires the full hierarchy of controls, which for relational hazards looks like:

• Higher-order controls: work design (workload, role clarity, decision authority), leader selection and training, team composition decisions
• Administrative controls: codes of conduct, civility commitments, escalation pathways, manager protocols
• Lower-order controls: training, support services, complaint handling

Most organisations' "anti-bullying program" sits almost entirely at the lower-order end of this hierarchy. That is no longer defensible.

4. Reasonable management action gets harder - and easier

Section 32 of the WHS Regulations preserves the long-standing principle that "reasonable management action carried out in a reasonable manner" is not bullying. But the standard for what counts as reasonable has tightened. Performance management conducted without role clarity, without adequate support, in a context of sustained high job demands and low control, is increasingly hard to defend as reasonable. Conversely, performance management conducted with documented support, clear expectations, and proportionate consequences becomes easier to defend - because the supporting infrastructure is now visible.

5. Evidence requirements rise sharply

If a bullying claim escalates - to a workers' compensation matter, a regulator action, or civil proceedings - the question the organisation will face is whether it identified the risk, consulted on it, controlled it, and reviewed the controls. "We have a policy and an EAP" is no longer a sufficient answer. The Kozarov, Court Services Victoria, and Elisha lines of authority make clear that the courts will look for evidence of actual risk management work, not paperwork generated after the fact.

The Kozarov shift

Kozarov v Victoria (2022) is the case most legal commentators point to as the inflection point. The High Court accepted that an employer can be liable for failing to take reasonable steps to protect a worker from foreseeable psychological injury - even where the worker had not specifically complained. The implication for bullying is direct: if the conditions for bullying are foreseeable and the organisation has not taken reasonable steps to manage them, the legal exposure exists regardless of whether a formal complaint was ever lodged.

This is what makes the new regulatory model materially different from the old one. The old model rewarded the absence of complaints. The new model rewards the presence of evidence that you were looking.

What HSEQ managers should do now

Three priorities, in order:

1. Map the existing surface. What signals does your organisation currently capture that would indicate bullying-conducive conditions? Turnover, absenteeism, exit interviews, anonymous channels, complaint trends. Most organisations have these - they just don't aggregate them through a psychosocial lens.
2. Build the consultation layer. A complaint mechanism is not consultation. Consultation looks like structured worker conversations about the conditions that produce poor workplace relationships, with documented outputs that show what was raised and what was done.
3. Audit your "reasonable management action" trail. For each active performance management or restructuring process, can you produce a record of role clarity, support, and proportionate process? If not, the legal protection of section 32 thins out fast.

The point that gets missed

None of this means bullying complaints go away or that HR investigations stop. Both remain necessary. The change is that they are now one part of a broader obligation, not the whole obligation. The work of managing bullying as a psychosocial hazard is the work of running the full risk management framework - with bullying as one of the hazards it produces controls for.

Organisations that wait for the next bullying complaint to define their psychosocial program will find they have already lost the legal protection the new regulations offered them.