
The risk management process
Employers should apply the risk management process to manage risks associated with bullying, so far as is reasonably practicable.
The risk management process involves the following steps:
- identifying psychosocial hazards
- assessing, where necessary, any associated risks to health or safety
- controlling risks to a person’s health or safety associated with psychosocial hazards
- monitoring, reviewing and, where necessary, revising risk controls.
There are certain circumstances where each step of the risk management process must occur.
This page explains how to control the risks of bullying in the working environment. This is Step 3 in the risk management process.
Your duty
Risks must be eliminated, so far as is reasonably practicable. If risks cannot be eliminated, they must be reduced, so far as is reasonably practicable. This must be achieved by:
- altering the –
- management of work, or
- plant, or
- systems of work, or
- work design, or
- workplace environment, or
- using information, instruction or training, or
- using a combination of any of the controls listed above.
You may only use information, instruction or training on its own if it is not reasonably practicable to alter any of the measures listed above at (a).
Where a combination of risk control measures is used, information, instruction or training must not be the predominant control measure.
Diagram 1: Controlling exposure to psychosocial hazards and risks.

When determining which risk control measures to use to control the risks of bullying, you should also consider if there are related or underlying hazards that might increase the risk.
If you identify any related hazards, you must also control the associated risks so far as is reasonably practicable.
You may also have duties under the Occupational Health and Safety Regulations 2017 to control certain physical hazards in accordance with specific hierarchies of control for:
- noise
- plant
- hazardous substances
- hazardous manual handling.
For more information on managing specific risks, see the relevant compliance code or guidance at worksafe.vic.gov.au.
Management of work
Management of work includes things such as:
- governance, leadership, and decision-making and escalation structures
- workforce planning
- resource allocation and rostering.
Reasonable management action or performance processes carried out in a reasonable manner is not bullying.
For more information on reasonable management action and how to manage underperformance lawfully and safely, see the Fair Work Ombudsman’s Managing underperformance best practice guide.
Risk controls relating to management of work could include creating a safe, respectful and inclusive organisational culture.
Organisational culture includes:
- leadership
- values
- behaviours
- language
- attitudes
- interactions.
Creating a safe, respectful and inclusive organisational culture helps employers to:
- set the tone for respectful workplace relationships
- build employee confidence and trust that safety is taken seriously
- proactively address the drivers of bullying.
To do this, employers should consider the following.
- Leadership
Appoint a diverse group of leaders who are openly committed to preventing and managing bullying. For example:
- Creating a culture of respect and inclusion.
- Modelling respectful and appropriate workplace behaviours.
- Developing and communicating the organisation’s plan to prevent bullying. This includes strategies to address workplace:
- gender inequality
- lack of diversity
- power imbalances or discrimination.
- Identifying who will lead the plan to prevent bullying. Giving them the necessary resources to do this.
- Encouraging reporting of bullying. Responding appropriately to all reports of bullying.
- Workplace standards
Develop formal workplace standards that state how all people in the workplace are expected to act. Standards should include behaviours, attitudes and language. They must be developed in consultation with employees and any health and safety representatives (HSRs). They should also be:
- set out in policies and procedures (see ‘Systems of work’ for more information)
- included in induction and workplace training
- modelled by managers and supervisors
- made available and accessible to all employees
- enforced.
When investigating reports of bullying, enable occupational health and safety (OHS), human resources and relevant operational teams to work together. This will:
- prevent affected employees from having to repeat their stories
- help to identify all psychosocial hazards contributing to bullying behaviour
- help to control any associated risks.
- Risk management
Develop and implement:
- a risk management action plan for specific team and/or roles
- a related communications strategy.
This should happen once you have completed:
Senior management should oversee implementation of the risk management plan and its outcomes. This includes the following.
- Necessary risk controls.
- Who is responsible for each risk control, including:
- who has authority and capacity to deliver
- leadership involvement, where relevant.
- Defined timeframe for implementation.
- Benchmarks
Develop and implement benchmarks and diagnostics to measure progress. Benchmarks may include the timeliness of:
- investigations
- the identification and management of any ongoing physical and psychosocial risks in the working environment following a report of bullying
- implementation of investigation outcomes.
- Support
Support any employees who experience bullying or have allegations made against them. This includes supporting employees before, during and after an ongoing investigation into a report of bullying. This may involve:
- management/supervisor support
- regular check-ins
- Employee Assistance Program
- leave entitlements
- HSRs
- union representatives
- external support services.
The employer should consider whether interim risk controls are needed to eliminate or reduce the risk of further harm to employees who have reported bullying. Risk controls may include arranging:
- temporary alternative duties and/or reporting lines to separate the parties while the investigation is ongoing
- increased supervision.
Implementing interim risk controls does not determine whether an allegation of bullying has been substantiated or unsubstantiated. If risk controls are not implemented before the outcome of a bullying investigation is known, the risk of harm to the employees involved may continue or increase.
Plant
Under the OHS Act, plant includes:
- any machinery, equipment, appliance, implement and tool; and
- any component of any of those things; and
- anything fitted, connected or related to any of those things.
Risk controls related to plant may include the following.
- Providing duress alarms and communication devices in high-risk environments.
- Replacing plant with new plant that presents less risk. For example, using a mobile duress system, rather than a fixed duress system.
- Making changes to existing plant. For example, modifying CCTV range to improve coverage of grey areas.
- Regularly servicing and maintaining all plant. For example, regularly testing duress devices.
Systems of work
A system of work encompasses the way that work is planned, organised and done. This may include the interacting set of:
- policies
- procedures
- practices
- equipment
- materials
- environment.
Policies and procedures on their own are not systems of work.
Employers should consider how altering systems of work can reduce the risk of exposure to bullying.
- Tailored systems to reduce risks from customers, clients and patients
Employers should develop a tailored system to reduce the risks of employees being exposed to bullying from customers, clients or patients. This could include the following.
- Designing the working environment to reduce unnecessary interactions between customers and employees. Restricting access when necessary.
- Controlling access to the workplace by installing effective barriers. Ensuring they are used at high-risk times and for high-risk tasks.
- Keeping the workplace secure, maintained and adequately lit and fit for purpose, including car parks.
- Installing CCTV cameras or other surveillance features. If using surveillance devices, develop policies and procedures before installation that make clear:
- the purpose of the surveillance, including how and when it is being used
- how employees and any HSRs will be consulted
- what data will be captured
- how long data will be stored
- who will have access to data.
- Installing, and regularly maintaining and testing, communication and duress alarm systems.
- Implementing a procedure for opening and closing the business.
- Rostering employees so no one works alone where possible, particularly for higher-risk times, shifts or tasks.
- Ensuring employees can see or hear who is coming into the premises.
- Clearly communicating behaviour expectations to clients, customers and the public.
- Responding to any bullying or disrespectful behaviours in a timely manner and following through on any stated actions. For example, immediate refusal of service to a client or customer.
- Using a flagging system to identify and flag high-risk customers with a history of bullying. Developing associated management plans. For example, implementing procedures to:
- ban customers from the workplace
- escalate the response if a banned customer enters the workplace.
- Implementing response procedures, which may include:
- ways to end high-risk contact or to escalate a situation to management
- using duress alarms and onsite security.
- Documenting and sharing information. For example, have clear handover processes at shift changeover for patients with a history of bullying behaviours.
- Enforcing responsible service of alcohol requirements in workplaces where alcohol is served.
- Introducing an incident reporting and investigation system.
- Providing appropriate training and supervision for employees.
- Providing appropriate support to employees who experience bullying.
- Tailored systems to reduce risks from working in isolation or unpredictable environments
Employers should develop a tailored system to reduce the risks of employees being exposed to bullying associated with:
- remote and isolated work
- working in unpredictable environments.
For example, a contractor working in isolation from other employees. This could include the following.
- Completing a risk assessment before any work is done remotely.
- Developing a management or support plan for clients, patients or residents who engage in bullying and disrespectful behaviours. This should be done in consultation with relevant professionals. Make employees aware of these plans and train them to respond appropriately. Regularly review these plans and communicate any changes.
- Determining the minimum number of employees that should be rostered to shifts in high-risk environments or during high-risk periods.
- Reviewing supervision levels to ensure they are appropriate.
- Implementing a buddy system.
- Enabling access to private and secure work-provided accommodation and facilities:
- for fly-in fly-out or drive-in drive-out employees
- if extended travel and stopovers are required.
- Developing a communications plan.
- Ensuring suitable communications equipment is available.
- Regularly checking in and monitoring to make sure employees:
- feel supported
- are coping with working from their remote or isolated location.
- Developing and implementing check-in procedures before and after travelling or meeting customers or clients off-site.
Employers should also develop a system for:
- identifying and responding early to risks of bullying to prevent incidents
- reporting, managing and investigating incidents of bullying
- reviewing and revising risk controls to prevent future incidents.
- Policies and procedures to prevent and manage bullying
A workplace behaviour policy and procedure can form part of a broader system of work to prevent and manage bullying. Policies and procedures are not a system of work on their own.
Depending on the size and resources of the organisation, there may be:
- one broad policy and procedure that incorporates various harmful behaviours, such as aggression or violence, sexual harassment and bullying
- specific policies and procedures: for example, a policy specifically about how to prevent and manage bullying.
A workplace bullying policy and procedure must be developed in consultation with employees and any HSRs. The policy and procedure should do the following.
- State the employer’s responsibility to protect employees from the risk of bullying and how this will be done.
- State an employee’s responsibility to take reasonable care for:
- their own health and safety
- the health and safety of people who may be affected by their acts or omissions in the workplace.
- Define what bullying is and isn’t. It should also provide examples of bullying behaviours including verbal, physical, written and online bullying.
- List examples of appropriate and inclusive language.
- Tell employees what to do if they experience bullying. This should include the following.
- Multiple and accessible reporting avenues, both internal and external. This includes circumstances where the report involves a direct manager or member of the senior management team.
- How to access support services.
- Encourage bystanders to report bullying. This should include the following.
- What is a bystander and an active bystander.
- What to do if bullying is witnessed, including reporting.
- How they can provide support to the person who experienced bullying.
- Outline what the employer will do if an employee reports bullying. This should include the following information.
- Who will be notified of the report.
- How an investigation will be completed in an objective, fair, transparent, and timely way. This includes expected reasonable timeframes and how to decide whether to use a suitably qualified internal person or an external investigator. Investigations are best done using a trauma-informed approach. This focuses on wellbeing and safety to help prevent any further harm. See Managing reports of bullying for more information.
- How sensitive information will be handled, including issues of privacy and confidentiality. Employers may need to disclose confidential information to investigate whether risks are being controlled so far as is reasonably practicable or where there is an immediate risk to health and safety. They may also be required by law to disclose information. For example, if the employee is under the age of 18, consider whether Child Protection or Victoria Police need to be contacted.
- If an employer may stand down an employee with or without pay during an investigation, and what this may entail. This includes:
- how the relevant employee will be contacted throughout
- relevant support and wellbeing monitoring
- managing expectations about the investigation process.
- Options for psychological support for all relevant parties. This may be internal or external support services. For example, an Employee Assistance Program (EAP) or relevant external agencies.
- Options for supporting employees in the workplace while investigations are ongoing. For example, identifying alternative duties or reporting lines for involved parties during this period.
- How all relevant parties will be kept informed as appropriate.
- How outcomes will:
- be transparently communicated to appropriate parties
- be promptly implemented
- consider any related ongoing risks to health and safety and be incorporated into risk management processes.
- Additional external reporting options available to all parties. This includes options to escalate if a party is dissatisfied with the internal investigation process.
- Outline possible outcomes where a breach of policy and procedure is identified.
Work design
Work design means the equipment, content and organisation of an employee’s work tasks, activities, relationships and responsibilities within a job or role.
Employers should consider how altering work design can reduce the risk of exposure to bullying. Examples include the following.
- Ensuring tasks and levels of responsibility are allocated in a way that is appropriate for employees’ skills, experience and the requirements of their role.
- Using an automated ordering system to reduce the number of interactions with customers.
- Providing bar service instead of table service in isolated areas away from co-workers.
- Meeting clients in the office rather than their homes or isolated environments where possible.
- Refining complaints processes so complex or difficult complaints can be escalated to more senior employees empowered to resolve them.
- Moving tasks to more visible areas of the workplace.
- Rostering employees so no one works alone where possible, particularly for higher risk times, shifts or tasks.
- Where possible, preventing or restricting public access to premises where people work alone or at night.
- In workplaces where employees work remotely, using regular meetings to create an inclusive team culture and build social cohesion across groups of employees.
- Using a buddy system to match appropriate experienced employees with young and new employees.
- Ensuring that the demands of a role are appropriate and achievable, so that employees do not experience unreasonable demands that may lead to bullying behaviour. For example, a manager with a high workload may begin to place unreasonable demands on other members of their team, leading to bullying behaviour.
Workplace environment
The workplace environment includes environmental conditions that contribute to psychosocial or physical risks. For example:
- lighting
- temperature
- noise
- vibration
- workplace layout or design.
Making alterations to the workplace environment to control the risk of bullying may include the following.
- Separating employees from the public where possible. For example, by providing:
- protective barriers or screens
- secure employee areas and facilities, such as swipe card access and dual entry/exit points.
- Providing extra visibility by:
- installing ample internal and external lighting, including in carparks
- using mirrors to improve visibility and reduce blind spots
- using transparent panelling for doors and windows
- installing CCTV.
- Installing communication, surveillance cameras, and duress and alarm systems. Ensure systems are regularly maintained and tested.
- Designing office layout so managers are more visible and accessible. For example, an open office environment where managers sit with their teams.
- Providing access to private spaces in the workplace to ensure the confidentiality of sensitive conversations.
- Providing a sectioned-off part of the workplace away from customers for employees to have a break; for example, a staff room.
Provide information, instruction, training and supervision
Employers must provide necessary information, instruction, training or supervision. Where a combination of risk control measures is used, information, instruction or training must not be the predominant control measure.
You may only exclusively use information, instruction or training if it is not reasonably practicable to alter any of the following:
- management of work
- plant
- systems of work
- work design
- workplace environment.
Information, instruction, training and supervision helps to educate employees about controlling the risk of bullying.
Employers should deliver targeted training to employees at all levels. This includes during induction and at regular intervals.
Examples of information, instruction or training that can support risk controls may include the following.
- Providing information, instruction, and training to all employees on the organisation’s bullying policy and procedure. This includes:
- defining what bullying is and isn’t
- explaining reporting options and how the organisation will respond to the report
- outlining what supports are available to all parties.
- Providing information, instruction and training to all employees on:
- appropriate, potentially harmful and harmful workplace behaviours
- being an active bystander and what to do if you witness bullying (including cyberbullying).
- Educating employees about the organisation’s risk management plan and behavioural expectations before work events or travel. For example, reasonable consumption of alcohol.
- Providing training on how to identify and respond to other psychosocial hazards and risks that may increase the risk of bullying.
- Providing targeted training for supervisors and managers on how to:
- carry out processes for managing performance in a reasonable, safe and lawful manner
- implement interim controls while bullying complaints are investigated
- resolve interpersonal issues between employees to reduce the need for formal investigation processes
- respond to reports of bullying.