
The risk management process
Employers should apply the risk management process to manage risks associated with aggression or violence, so far as is reasonably practicable.
The risk management process involves the following steps:
- identifying psychosocial hazards
- assessing, where necessary, any associated risks to health or safety
- controlling risks to a person’s health or safety associated with psychosocial hazards
- monitoring, reviewing and, where necessary, revising risk controls.
There are certain circumstances where each step of the risk management process must occur.
This page explains how to control the risks of aggression or violence in the working environment. This is Step 3 in the risk management process.
Your duty
Risks must be eliminated, so far as is reasonably practicable. If risks cannot be eliminated, they must be reduced, so far as is reasonably practicable. This must be achieved by:
- altering the –
- management of work, or
- plant, or
- systems of work, or
- work design, or
- workplace environment, or
- using information, instruction or training, or
- using a combination of any of the controls listed above.
You may only use information, instruction or training on its own if it is not reasonably practicable to alter any of the measures listed above at (a).
Where a combination of risk control measures is used, information, instruction or training must not be the predominant control measure.
Diagram 1: Controlling exposure to psychosocial hazards and risks

When determining which risk control measures to use to control the risks of aggression or violence, you should also consider if there are related or underlying hazards that might increase the risk.
If you identify any related hazards, you must also control the associated risks so far as is reasonably practicable.
You may also have duties under the Occupational Health and Safety Regulations 2017 to control certain physical hazards in accordance with specific hierarchies of control for:
- noise
- plant
- hazardous substances
- hazardous manual handling.
For more information on managing specific risks, see the relevant compliance code or guidance at worksafe.vic.gov.au.
Management of work
Management of work includes things such as:
- governance, leadership, and decision-making and escalation structures
- workforce planning
- resource allocation and rostering.
To control the risk of aggression or violence, risk controls relating to management of work could include:
- Eliminating tasks with known aggression and violence risks by using technology; for example, online complaint lodgement.
- Arranging work rosters and designing work so that employees don’t work alone where possible, particularly for higher risk shifts or times.
- Assigning experienced employees to supervise junior employees.
- Allocating additional resources during higher risk shifts or times.
- Providing clear management reporting structures.
- Ensuring visibility of supervisors and employees in leadership roles.
- Upskilling leaders in:
- identifying aggression or violence and engaging employees in the risk management process
- how to manage and respond to aggression or violence and support employees.
- Demonstrating leadership commitment to managing aggression or violence; for example:
- responding appropriately to all reports of aggression or violence
- modelling appropriate workplace behaviour
- creating a workplace culture that encourages reporting of aggression or violence, and does not accept this behaviour as part of the job
- building employee confidence and trust that safety is taken seriously.
- Developing formal workplace standards that state how everyone in the workplace is expected to act. Standards should include behaviours, attitudes and language. They should also be:
- set out in policies and procedures (see ‘Systems of work’ for more information)
- included in induction and workplace training
- modelled and enforced by managers and supervisors
- made available and accessible to all employees.
-
Developing and implementing a:
- risk management action plan for specific teams or roles
- related communications strategy.
Senior management should oversee implementation of the plan and outcomes. The plan should:
- outline how to control identified risks of aggression or violence
- state who is responsible for each risk control measure
- state who has authority and capacity to deliver, including senior management where relevant
- include defined timeframes.
-
Developing benchmarks and diagnostics to measure progress. These could include:
- annual surveys
- employee focus groups
- incident trend analysis.
Benchmarks may include the timeliness and quality of incident reviews or investigations.
- Improving transparency across the organisation and empowering employees to speak up. For example, employees can openly share information about hazards or reports if they wish.
- Recognising and rewarding employees for prioritising safety.
- Supporting any employees who experience aggression or violence. This includes through:
- management/supervisor support
- Employee Assistance Program
- leave entitlements
- regular check-ins
- health and safety representatives (HSRs)
- union representatives
- external support services
- flexible work
- providing information about workers compensation.
Plant
Under the OHS Act, plant includes:
- any machinery, equipment, appliance, implement and tool; and
- any component of any of those things; and
- anything fitted, connected or related to any of those things.
Well-designed and properly maintained plant can help prevent exposure to aggression or violence by:
- reducing noise, vibration or dust
- controlling temperature.
Risk control measures related to plant may include:
- replacing plant with new plant that presents less risk; for example, using a mobile duress system rather than a fixed duress system
- making changes to existing plant; for example, modifying CCTV range to improve coverage of grey areas
- regularly servicing and maintaining all plant; for example, regularly testing duress devices.
Systems of work
A system of work encompasses the way that work is planned, organised and done. This may include the interacting set of:
- policies
- procedures
- practices
- equipment
- materials
- environment.
Policies and procedures on their own are not systems of work.
Employers should consider how altering systems of work can reduce the risk of exposure to aggression or violence.
- Tailored systems to reduce risks from customers, clients or patients
Employers should develop a tailored system to reduce the risks of employees being exposed to aggression or violence from customers, clients or patients. This could include:
- Designing the work environment to reduce unnecessary interactions between customers and employees.
- Rostering employees so that no one works alone.
- Providing adequate resources to deliver services.
- Using identification processes so it is easy to identify who is an employee and who is a visitor.
- Introducing an incident reporting and investigation system. See Managing reports of aggression or violence for more information.
- Providing appropriate training and supervision for employees.
- Implementing response procedures such as:
- duress alarms
- onsite security
- processes for limiting or ending high-risk contact
- escalation pathways to management.
- Clearly communicating to clients and customers that any form of aggression or violence will not be accepted.
- Refusing entry to clients and customers with a higher risk of aggression or violence. Developing procedures for this process.
- Assessing client compatibility and suitability.
-
Completing risk assessments and developing management or support plans for clients or customers with:
- a known history of aggression or violence
- complex or challenging behaviours.
This should be done in consultation with relevant professionals. Make employees aware of these plans and train them to respond appropriately. Regularly review these plans and communicate any changes.
- Documenting and sharing information. For example, have clear handover processes at shift changeover for patients with a history of aggressive or violent behaviours.
- Providing appropriate post-incident support.
- Using safe cash-handling procedures. For example:
- only offer electronic funds transfer or carry small amounts of cash
- use locked drop safes
- vary banking times
- display ‘limited/no cash held’ signs.
- Tailored systems to reduce risks from working in isolation or unpredictable environments
Employers should develop a tailored system to reduce the risks of employees being exposed to aggression or violence from working in isolation or in unpredictable environments, such as a client’s home. This could include:
- Developing a communications plan.
- Ensuring suitable communications equipment is available.
- Reviewing supervision levels to ensure they are appropriate.
- Determining the minimum number of employees that should be rostered to shifts in high-risk environments or during high-risk periods.
- Implementing processes for opening and closing the business.
- Ensuring safe and secure accommodation for employees who stay away from home; for example, fly-in fly-out work.
Policies and procedures to prevent and manage aggression or violence
A workplace behaviour policy and procedure can form part of a broader system of work to prevent and manage aggression or violence. Policies and procedures are not a system of work on their own.
Depending on the size and resources of the organisation, there may be:
- one broad policy and procedure that incorporates various harmful behaviours, such as aggression or violence, sexual harassment and bullying
- specific policies and procedures; for example, a policy specifically about how to prevent and manage aggression or violence.
Policies and procedures must be developed in consultation with employees and any HSRs. Content should include the following parts.
- Purpose statement
Outline the purpose of the policy and procedure. For example:
This workplace policy and procedure aims to provide a safe and healthy workplace, where risks associated with aggression or violence will be controlled, so far as is reasonably practicable. The employer is committed to supporting employees who are exposed to aggression or violence (directly or indirectly).
- Objectives
Outline the objectives of the policy and procedure. For example:
Aggression or violence is not acceptable and will not be tolerated at this workplace. Appropriate action will be taken if aggression or violence occurs. Reporting incidents is very important and is encouraged. Incidents will be investigated to:
- identify all contributing factors
- work out how to prevent it from happening again.
- Responsibilities
Outline the roles and responsibilities of relevant people. For example:
- senior managers
- employees
- emergency response coordinators
- security.
- Risk management
Provide details about the risk management process and plan. This includes current risk control measures.
- References and related documents
Reference all relevant documents and sources used to develop the aggression or violence prevention policy and procedure.
- Endorsement
Provide details about who has endorsed the policy and procedure. For example:
The policy and procedure is endorsed by the board, chief executive officer and OHS committee.
- Approval and review date
- Date the policy or procedure was approved.
- Date it will be reviewed, in line with the review and revision of risk controls process.
More information on managing reports
Work design
Work design means the equipment, content and organisation of an employee’s work tasks, activities, relationships and responsibilities within a job or role.
Employers should consider how altering work design can reduce the risk of exposure to aggression or violence. For example:
- Using an automated ordering system to reduce the number of interactions with customers.
- Providing bar service instead of table service in isolated areas away from co-workers.
- Refining complaints processes so complex or difficult complaints can be escalated to more senior employees empowered to resolve them.
- Varying when high-risk tasks like banking are done, so they are less predictable.
- Requiring or encouraging electronic payments, rather than cash.
- Designing work so that employees don’t work alone where possible, particularly for higher risk shifts, tasks or times. These include when supporting, responding or attending to clients with a previous history of aggression or violence.
- Arranging for client meetings to happen in the office rather than in their home or isolated environments.
- Altering service arrangement with clients, customers or patients based on risk of aggression or violence identified at the intake assessment. For example, communicate by email or phone rather than in person, where there is possible and appropriate to the individual’s needs.
Workplace environment
The workplace environment includes environmental conditions that contribute to psychosocial or physical risks. For example:
- lighting
- temperature
- noise
- vibration
- workplace layout or design.
Making alterations to the workplace environment to control the risk of aggression or violence may include:
- Separating employees from the public where possible. For example:
- provide protective barriers or screens
- provide secure employee areas and facilities, such as swipe card access and dual entry/exit points.
- Installing safety glass. For example, laminated, toughened glass or perspex, including in picture frames and mirrors.
- Not displaying dangerous implements or objects that could be thrown or cause injury. Bolt down furniture where possible.
- Arranging furniture and partitions so there is clear access, and employees can see all service areas.
- Providing a safe place for employees to retreat to or to escort others.
- Considering safe work practices when designing room layout. For example, are rooms large enough for multiple employees to help clients at the same time, where appropriate?
- Using environmental conditions to lower arousal and reduce stress. For example, consider music, temperature, lighting and smell.
- Installing appropriate signs to direct clients and visitors.
- Controlling access to the workplace by installing effective barriers to be used particularly at identified high-risk times, shifts or tasks.
- Enabling employees to see or hear who is coming into the premises, and to restrict or allow access as necessary.
- Providing extra visibility by:
- installing ample internal and external lighting, including in carparks
- using mirrors to improve visibility and reduce blind spots
- using transparent panelling for doors and windows
- installing CCTV.
- Installing communication, duress and alarm systems. Ensure systems are regularly maintained and tested.
- Where possible, preventing or restricting public access to premises when people work alone or at night.
- Keeping the building secure, maintained and fit for purpose.
Provide information, instruction, training and supervision
Employers must provide necessary information, instruction, training or supervision. Where a combination of risk control measures is used, information, instruction or training must not be the predominant control measure.
You may only exclusively use information, instruction or training if it is not reasonably practicable to alter any of the following:
- management of work
- plant
- systems of work
- work design
- workplace environment.
Information, instruction, training and supervision helps to educate employees about controlling the risk of aggression or violence.
Employers should deliver targeted training to employees at all levels. This includes during induction and at regular intervals. It can cover:
- Aggression or violence prevention measures and how the organisation is putting these in place.
- Workplace policy and procedures, including:
- emergency response, such as use of communication, duress or alarm systems and safe retreat processes
- acceptable standards of behaviour
- how to respond to and report aggression or violence.
- De-escalating aggression or violence, for example:
- identifying signs of aggression or violence
- verbal and non-verbal communication strategies.
- Bystander training.
- Situational risk assessment. For example, when visiting homes or working offsite.
- How to model and encourage positive behaviours or manage concerning behaviours.
- Dealing with customers or clients who are aggressive or violent. This may include actions like refusal of service.
- Communication skills such as reflective listening to demonstrate empathy.
- How the presence of other psychosocial hazards may increase the risk of aggression or violence.