A psychosocial risk assessment is the "suitable and sufficient" assessment of health risks required by regulation 3 of the Management of Health and Safety at Work Regulations 1999, applied to the way work is designed and managed, and HSE's six Management Standards are the regulator's own published method for carrying it out.
That is the legal position in one sentence. The rest of this piece is about what it means in practice, because the gap between what the duty requires and what most organisations hold is wider than most health and safety leads assume.
The statutory footing has been there for decades. Section 2 of the Health and Safety at Work etc. Act 1974 places a general duty to ensure, so far as is reasonably practicable, employees' health, safety and welfare. Regulation 3 of the 1999 Regulations requires the risk assessment; regulation 3(6) requires employers with five or more employees to record the significant findings, and any group of employees identified as especially at risk, in writing. None of this is new law. Neither instrument uses the word "stress" anywhere: the duty reaches psychosocial risk because it is framed around health without qualification, and because HSE and the courts have applied it that way. What the term covers, where it sits against that duty and what is actually known about the scale of it is set out in psychosocial risk at work.
What has changed is attention. HSE estimates 964,000 workers in Great Britain with work-related stress, depression or anxiety in 2024/25, and 22.1 million working days lost to it (HSE, Work-related stress, depression or anxiety statistics in Great Britain, 2025, published 20 November 2025). Those figures are self-reported: they count conditions workers themselves attribute to their work, not diagnoses.
HSE's enforcement record here is thinner than the noise around it suggests. No improvement notice, prohibition notice or conviction naming work-related stress as the hazard is retrievable from HSE's public registers for the period they cover, approximately July 2021 to May 2026, on a documented 34-term search of all 30,354 notices and all 326 risk-assessment notices. Two caveats travel with that. The registers carry no hazard-type field, so a stress notice is identifiable only by reading free text. And they retain records for five years, so they can neither confirm nor refute anything earlier. Where HSE does act in this space within that window, the category is violence and aggression.
The pressure on employers today is therefore not the inspector at the door. It is the civil route, and it is clearer and older. Since Hatton v Sutherland [2002] EWCA Civ 76, largely upheld in Barber v Somerset CC [2004] UKHL 13, employer liability for psychiatric injury turns on whether harm was reasonably foreseeable, judged on what the employer knew or ought reasonably to have known. An organisation that never assessed the risk will have difficulty arguing that it could not have known about it.
What is coming is worth watching without overstating. Work-related stress is a named priority in HSE's Business Plan 2026 to 2027, published 28 May 2026, with the objective "Reduce work-related ill health, with a specific focus on mental health and stress". The same plan describes this year's work as building the evidence base: HSE says it is "developing our regulatory approach to reduce work-related stress by prioritising preventive measures", with a Q4 deliverable to "deliver the evidence required to develop regulatory interventions". No new regulation, code of practice or consultation has been announced.
HSE's Management Standards define six areas of work design which, if poorly managed, are associated with poor health and higher absence. In HSE's own descriptions:
| Standard | HSE's own description |
|---|---|
| Demands | "issues such as workload, work patterns, and the work environment" |
| Control | "how much say the person has in the way they do their work" |
| Support | "the encouragement, sponsorship and resources provided by the organisation, line management and colleagues" |
| Relationships | "promoting positive working to avoid conflict and dealing with unacceptable behaviour" |
| Role | "whether people understand their role within the organisation and whether the organisation ensures that the person does not have conflicting roles" |
| Change | "how organisational change (large or small) is managed and communicated in the organisation" |
Each Standard has a second limb, identical across all six: "systems are in place locally to respond to any individual concerns". That limb is easy to miss and it is the one auditors ask about, because it is the difference between knowing something and having somewhere for it to go. Both limbs of all six, with where they came from and how much HSE expects against them, are in the six HSE Management Standards.
The Standards are guidance; the underlying duty is statutory. HSE states that they "are not new laws" while employers "already have duties" to assess the risk under the 1999 Regulations and control it under the 1974 Act. Following them is one route among several HSE will accept, and HSE frames it conditionally: "If you follow the Management Standards approach correctly, you will be adopting an approach that is considered suitable and sufficient." For organisations doing something else, HSE publishes an equivalence checklist headed "Is my risk assessment approach suitable and sufficient?"
HSE's Management Standards Indicator Tool is a 35-item questionnaire. Items 1 to 23 sit on a five-point frequency scale and items 24 to 35 on a five-point agreement scale, with a six-month reference period.
Two things about it are worth knowing before you build a programme on it.
The first is a scoring detail that trips people up. The tool does not report six scores. Factor analysis split Support into two separate factors by source, so the instrument maps to seven subscales: demands, control, managerial support, peer support, relationships, role and change. Six Standards, seven scales. Anyone whose dashboard shows six scores derived from the 35 items has collapsed something.
The second is the evidence base, which is decent and worth describing accurately. The tool was developed from a 100-item pool piloted in a single English local-authority children's services division, with 3,147 returns at a stated response rate of 19.5%; that development paper was written by HSE and HSL staff evaluating HSE's own instrument (Cousins et al., Work & Stress, 2004). A later confirmatory factor analysis across 39 UK organisations and 26,382 responses supported the seven-factor structure, with fit indices sitting at the boundary of conventional acceptability rather than comfortably above it, and five items loading weakly; one of its authors was an HSE statistician (Edwards, Webster, Van Laar and Easton, Work & Stress, 2008). The one fully independent validation retrieved concerns the 25-item short form, which "offered similar but not always equal validity to that of the full version" (Houdmont et al., 2013).
HSE says the tool gives "a broad indication to organisations of how well their workforce rate their performance". It measures perceptions of working conditions across a workforce. It does not measure, detect or indicate any individual's health, and it was named an indicator tool "in recognition of the known limitations of structured questionnaires".
There is no score to hit. HSE "does not expect an employer to meet all the standards", calling them a target to work towards. The 85% and 65% figures that circulate as benchmarks were provisional thresholds from the 2004 pilot, whose own HSE authors wrote that they "were essentially based on research that was indicative, rather than grounded", and no target percentage appears on any current HSE Management Standards page. The free HSE Analysis Tool produces no benchmark or percentile at all.
And no survey is required in the first place. HSE: "A survey is not an essential step and for smaller organisations it would not be proportionate to run such a survey, particularly where the same data can be gathered in other ways."
An inspector, or a claimant's solicitor, asks four things in some order. Show me your assessment of psychosocial risk. Show me the significant findings. Show me what you did in response, and when. Show me when you last reviewed it.
What most organisations can produce is an annual engagement survey. This is said with respect, because engagement surveys are usually run in good faith and often run well. But they sit awkwardly against all four questions. They measure engagement constructs, and the mapping onto the six Standards areas is loose. They run annually, so the currency of the assessment is doubtful for most of the year. They are rarely framed, owned or filed as a risk assessment, so the regulation 3(6) written record may not exist in a form an inspector would recognise. And the action trail, the dated link from finding to response, tends to live in slide decks if it lives anywhere.
The result is an organisation that has done real work and still cannot evidence the statutory duty.
Across regulation 3, the Hatton foreseeability test and the Management Standards cycle, the same elements recur: a dated assessment covering psychosocial risk; something systematic underneath it, not anecdote; documented actions taken in response; a review cycle; and named oversight with the authority to act. Each of those, with the line between what is statutory and what is good practice marked on every item, is in the duty of care checklist.
The word doing the work there is dated. Foreseeability cases turn on sequence: what the employer knew, when it knew it, and whether action followed knowledge. A single assessment, however good, gives you one timestamp. Repeated measurement gives you a trail, and it also answers regulation 3(3), which requires review when there is reason to suspect the assessment is no longer valid or when circumstances change significantly. Psychosocial conditions move with restructures, workload cycles and leadership turnover, so in practice a live assessment is a repeating one.
HSE's own steer on where to point the effort is worth repeating: "It is more effective to remove a stressor or significantly reduce its impact than it is to manage lots of individual cases." The instrument targets work design, not people.
One qualification on support routes, because it is routinely got wrong in both directions. Hatton proposition (11) says an employer offering a confidential advice service "is unlikely to be found in breach of duty". It is not a defence. In Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 at [45] the Court of Appeal held that "the reference to counselling services in Hatton does not make such services a panacea by which employers can discharge their duty of care in all cases", and dismissed the employer's appeal despite the service it had provided. Signposting support belongs inside the evidence trail. It does not substitute for it.
ISO 45003:2021 is the international guidance standard for managing psychosocial risk, designed to be used alongside ISO 45001, which is the document that carries the requirements. It groups psychosocial hazards into three categories: aspects of work organisation, social factors at work, and the work environment, equipment and hazardous tasks.
For an organisation in Great Britain the practical relationship is straightforward. The statutory duty is the risk assessment, and regulation 3(1) names no standard, methodology or framework. ISO 45003 becomes relevant when you want an internationally recognised framing of what you are already doing, usually because you hold ISO 45001 or because a tender asked. It has no legal force here. We cover it in detail in our separate piece on ISO 45003.
Yes. Regulation 3(1) requires a suitable and sufficient assessment of the risks to employees' health, and HSE states that this duty covers stress. Regulation 3(6) requires the significant findings, and any group of employees identified as especially at risk, to be recorded in writing where five or more people are employed. The duty to assess has no headcount threshold; only the recording duty does.
No. HSE's own page on the question answers conditionally, and it publishes an equivalence checklist for organisations using a different approach, which asks you to "provide documentation to show what you have done at each stage of the process". The Standards are the regulator's own published method, which makes them the most defensible route, not the only one.
Usually not on its own. It measures different constructs on a different cadence and is rarely documented as a risk assessment, so it tends to fail the suitable-and-sufficient and written-record tests even where the underlying data is good.
Regulation 3(3) requires review whenever there is reason to suspect the assessment is no longer valid, or after a significant change. There is no fixed interval in the Regulations. Given how quickly working conditions move, most practitioners treat that as a case for periodic re-measurement rather than an annual date in the calendar.
Not under RIDDOR. Regulation 8 lists six reportable occupational diseases and none is psychological. HSE also publishes a filter on when it will consider investigating stress at all: where there is evidence of a wider organisational failing, or that a number of staff are currently affected, and where the concern has already been raised with the employer.
The free strategy audit takes twenty minutes and gives you your gaps in writing. No card, no call booked at the end of it unless you ask for one.
Start the free audit →