Psychosocial Risk Assessment in Ireland: What Section 19 Requires, and What ISO 45003 Is Not

Psychosocial risk assessment is widely marketed in Ireland as a compliance requirement, usually with ISO 45003 attached to it. The accurate position is more useful than that, and it cuts both ways: there is no standalone statutory requirement for a psychosocial risk assessment, and ISO 45003 is not a certifiable standard — but the general duty in section 19 of the Safety, Health and Welfare at Work Act 2005 already reaches psychological health, in writing.

What section 19 actually requires

Section 19 of the 2005 Act requires an employer to identify the hazards in the workplaces under its control and to assess the risks those hazards present to employees, including any individuals or groups who may be exposed to unusual risks.

• It must be in writing. The Act calls the output a “risk assessment”, and a written record is required rather than optional.
• There is no fixed review interval. The obligation is to review after a significant change in the matters to which the assessment relates, or where there is another reason to believe it is no longer valid, and then to amend it.
• Improvements identified must be implemented across all activities and levels of the workplace — so an assessment that names a problem and sits in a drawer is itself a breach.

The Act’s subject is safety, health and welfare. Nothing in section 19 confines the assessment to physical hazards, which is why the HSA treats work-related stress, bullying and violence as workplace health and safety matters rather than purely HR ones. The duty is already there; what is absent is a separate instrument naming psychosocial risk.

Section 20 is where the detail bites

The safety statement under section 20 must be written, based on the section 19 hazard identification and risk assessment, and must specify how employees’ safety, health and welfare will be secured and managed. It must set out:

• The hazards identified and the risks assessed
• The protective and preventive measures and resources provided
• Plans and procedures for emergencies or serious and imminent danger
• Employees’ own safety duties, including cooperation with the employer
• The name and job title of each person responsible for tasks assigned under the statement
• Arrangements for appointing safety representatives and for consultation and participation, including the names of safety representatives and safety committee members

That fifth item is the one most often missing where psychosocial risk is concerned. If workload design, management behaviour or a bullying complaint route is a control measure, section 20 requires a named individual with a job title to own it. “HR” is not a name.

The communication duties are specific too. The statement must be brought to employees’ attention at least annually and again after any amendment, to new employees when they start, and to other people at the workplace exposed to a specific risk it covers — with relevant extracts provided to those facing serious risks from particular tasks.

And on review: section 20(5) requires amendment where there has been a significant change, where there is reason to believe the statement is no longer valid, or where an inspector directs an amendment, which must be made within 30 days. That 30-day clock is the only hard deadline in the sequence.

Our guide to the safety statement and risk assessment under the 2005 Act covers the general mechanics in more detail.

What ISO 45003 is, and is not

ISO 45003:2021 was approved in June 2021 and is a guidance document. Its scope is to give guidelines for managing psychosocial risk. It sets out guidelines rather than certifiable requirements, so an organisation cannot be certified to ISO 45003, and any claim otherwise should be treated with care.

It is designed to operate alongside ISO 45001, within an occupational health and safety management system built on that standard, and it follows ISO 45001’s clause structure across context, leadership, planning, support, operation, performance evaluation and improvement. ISO 45001:2018 itself addresses work organisation and social factors at clause 6.1.2.1, which is the hook ISO 45003 expands on.

ISO 45003 groups psychosocial hazards into three areas:

1. How work is organised
2. Social factors at work
3. The work environment, equipment and hazardous tasks

On the people side, the standard carries support clauses for resources (7.1), competence (7.2), awareness (7.3) and communication (7.4), plus consultation and participation of workers (5.4).

Why psychosocial hazards are harder to assess than physical ones

The legal test is identical for a trip hazard and for an unmanageable workload. The practical difficulty is not the standard but the evidence.

A physical hazard can be observed by a competent person walking the floor. A psychosocial hazard usually cannot. Workload pressure, role ambiguity, poor change communication and management behaviour are experienced rather than seen, which means the assessment depends on what people are willing to tell you — and the conditions that create the hazard are often the same conditions that discourage reporting it. That is why ISO 45003’s clause 5.4 on consultation and participation of workers is the clause that determines whether the rest of the exercise is worth anything.

There is a second difficulty. Section 19 requires attention to individuals or groups who may be exposed to unusual risks. For psychosocial hazards those groups are rarely defined by job title. Lone workers, night staff, people managing complaints or safeguarding disclosures, and newly promoted managers carrying responsibility without authority are all plausibly exposed in ways their colleagues are not — and none of that appears on an organisation chart.

What an inspector can actually ask for

Because the duty sits in sections 19 and 20 rather than in a dedicated instrument, the evidence is the same evidence as for any other hazard. In practice that means five things.

A written assessment that names psychosocial hazards specifically, rather than implying them. Control measures that are described rather than asserted — “an Employee Assistance Programme is available” is a resource, not a control for a workload hazard. A named person with a job title who owns each measure, as section 20 requires. Evidence that improvements identified in the most recent assessment have actually been implemented, which section 19 requires across all activities and levels. And a record that the statement was brought to employees’ attention at least annually and to new employees on starting.

None of that requires ISO 45003. All of it is harder to produce retrospectively than to build as you go, which is the real argument for using a structured process such as Work Positive rather than drafting something when an inspection is announced.

What exists in Ireland to work with

Two Irish instruments are worth knowing. The HSA and WRC Code of Practice for Employers and Employees on the Prevention and Resolution of Bullying at Work (2021) is the authoritative reference on bullying specifically — its complaint process is set out in our guide to the bullying at work Code of Practice, and the organisational consequences in our guide to the consequences of workplace bullying.

Separately, Work Positive is a psychosocial risk management process promoted by the HSA with the State Claims Agency, which gives employers a structured way to assess workplace stressors without building an instrument from scratch.

Adjacent obligations overlap: the right to disconnect has its own Code of Practice, covered in our guide to the right to disconnect in Ireland, and lone working carries a distinct set of duties set out in our guide to lone working and employer duties under HSA guidance.

The honest summary

An organisation does not need a document titled “psychosocial risk assessment” to comply with Irish law. It does need to be able to show that psychosocial hazards were identified, assessed in writing, controlled, owned by a named person in the safety statement, and reviewed when things changed — because that is what sections 19 and 20 require of any hazard.

Where ISO 45003 earns its place is as a structure for doing that well, particularly its insistence on worker consultation and its three-way hazard taxonomy. Where it is oversold is as a certification or a legal requirement. Neither is true, and a provider claiming otherwise is a reason for caution rather than confidence.