About Workplace Mental Health
Here is a question I ask organisations more often than they expect. Why would you do a risk assessment and then not act on it?
It sounds rhetorical. It is not. It happens constantly, and the reasoning behind it is usually sincere. The assessment gets done because somebody knows it should be done. The findings go to a committee. The committee notes them. And then the work of actually changing anything runs into the fact that changing how work is designed is harder than writing down that it needs changing.
If the intention was only ever to complete a paper exercise, you are not neutral. You are doubly at risk. You have given people the illusion that you meant to do something, and you have created a written record that you knew.
Two harms, not one
The first harm is to trust, and it is immediate. When you run an assessment you ask people to tell you what is wrong. If nothing follows, you have not simply failed to fix the problem. You have taught your workforce that reporting is pointless. The next assessment gets a lower response rate and a more cautious set of answers, and the one after that tells you almost nothing at all. Reporting is one of your controls. You have just broken it.
The second harm is evidential. In health and safety, the worst position to be in is knowing and not acting. An assessment that identifies a hazard and is then filed is the clearest possible record that the harm was foreseeable to you, by your own hand, on a date you can read off the document. Employers sometimes imagine that documentation is the protection. The action is the protection. The documentation is only evidence of whether you took it.
This is now being enforced, not just recommended
In December 2025 the Health and Safety Executive served a Notice of Contravention on the University of Birmingham following an investigation into its management of work-related stress. It is worth reading what HSE actually found, because it is not what most people assume.
The university had a stress management policy. HSE found it was not being implemented effectively. Where risk assessments had been carried out, they were inadequate at identifying the risks and the controls needed. The controls that did exist were insufficient to manage the risk. There was no effective system for monitoring and review, and consultation with employees was inadequate. The university was required to produce an action plan and share it with staff and union representatives, and the investigation was chargeable under the Fee for Intervention scheme.
Note what happened there. This was not an organisation that had done nothing. It had the policy. The policy is what got quoted back to it. That is the paper exercise problem stated by a regulator, in an enforcement notice, in writing.
HSE has been signalling this direction for some time. Its ten year strategy commits it to reducing work-related ill health with a specific focus on mental health at work, and the numbers behind that are hard to argue with. In 2024/25 there were 964,000 workers with work-related stress, depression or anxiety and 22.1 million working days lost, which is around half of all work-related ill health in Great Britain.
Mandatory, and not exclusively about safety
Let me be crystal clear about the legal position, because it is still misunderstood. A risk assessment is a mandatory requirement. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to the health and safety of employees.
Health and safety. Not exclusively safety. Health is the first word in the phrase and it has been there since 1974. Psychological health is health, work-related stress is a hazard, and the HSE Management Standards, covering demands, control, support, relationships, role and change, tell you what the regulator expects the assessment to look at.
There is no separate mental health at work statute in the UK and there does not need to be one. The duty already exists. It has simply been under-enforced, and that is the thing that is changing.
Choosing safety risk over health risk gives you more safety incidents
The trade-off that organisations think they are making is a false one. When the health side of the assessment is deprioritised to protect the safety side, the safety numbers do not stay where they are. They get worse.
The evidence for that link is strong. A 2011 meta-analysis in the Journal of Applied Psychology by Nahrgang, Morgeson and Hofmann found that high job demands drive burnout and that burnout is associated with more accidents and injuries, while supportive work design and a genuine safety climate are associated with better safety compliance. The mechanism is ordinary rather than exotic. Fatigue narrows attention. Sustained pressure erodes the step that feels optional. Fear of blame suppresses the near-miss report that would have told you about the hazard months before it hurt anybody.
So the psychosocial hazards you defer do not sit quietly in a wellbeing folder. They arrive later in your incident data, wearing a different label.
What suitable and sufficient actually looks like
- It identifies hazards in how work is designed, organised and managed, not just how people are feeling. A survey gives you the temperature. A risk assessment gives you the cause.
- Every finding has a control that changes the work, with a named owner and a date. Not an awareness campaign against a finding about workload.
- Somebody checks whether the control worked, and that check is written down. If it cannot be monitored, it is not a control.
- Employees were consulted, and they can see what changed as a result. That is what keeps the reporting channel alive.
- It is reviewed on a trigger as well as a timetable. A restructure, a redundancy programme, a serious incident or new surveillance and digital management technology all change the risk picture, and all of them should force a review.
If you want a fuller framework for the whole system rather than the single assessment, ISO 45003, the global standard for psychological health and safety at work, is the clearest description available, and a gap analysis against it will tell you quickly which of the five points above your organisation actually has.
A risk assessment is mandatory, so the real choice was never whether to do one. The choice is whether to do one that changes something. Anything else is a document waiting to be read back to you.
Frequently asked questions
Is a staff wellbeing survey a psychosocial risk assessment?
No. A survey measures how people feel, which is useful and is often the trigger for doing the work properly. A risk assessment identifies the features of how work is designed and managed that are causing the harm, records the controls, assigns them and monitors them. HSE found at the University of Birmingham that assessments which did not identify risks and appropriate controls were inadequate, and a survey on its own will not meet that test.
How often should a psychosocial risk assessment be reviewed?
The law does not set an interval. It requires the assessment to be reviewed if it is no longer valid or if there has been a significant change. In practice that means an annual review as a baseline, plus a review triggered by anything that materially changes the work: restructures, redundancy programmes, a serious incident, a merger, or the introduction of new monitoring technology.
About the author
Peter J Kelly is an occupational psychologist and the founder of Being Real. He spent more than twenty years at the Health and Safety Executive shaping national policy on workplace mental health, sat on the panel that drafted ISO 45003, and was expert convenor for BS 30480. Being Real supports organisations with ISO 45003 gap analysis and certification, BS 30480 implementation, psychosocial risk assessment, strategic advisory and training.
If you or a colleague are struggling, Samaritans are free, confidential and open 24/7 on 116 123.