Psychosocial Risk Assessment: ISO 45003 Steps and Scored Example

A psychosocial risk assessment is the part of your workplace risk assessment that deals with hazards in how work is designed, organized and managed: workload, control, support, relationships, role clarity and change. It identifies who could be harmed and how, uses evidence from workers to judge the risk, and ends with organizational controls, owners and review dates.

Most safety professionals are comfortable assessing a guard on a press or a leak in a solvent store. Psychosocial hazards feel different. Nothing is visibly broken, the harm (stress, anxiety, burnout, depression, fatigue-related errors) builds over weeks, and the people affected often say nothing until they are on sick leave or have resigned.

The scale is not small. HSE's key figures for Great Britain 2024/25 count 964,000 workers suffering work-related stress, depression or anxiety. EU-OSHA's OSH Pulse survey (2022) found that 27% of workers say their work causes or makes worse stress, anxiety or depression. This guide shows how to assess these hazards with the same discipline as physical ones: a hazard map, a six-step method, the evidence to collect, and a scored register for three roles.

---

A Call Centre Where Nothing Looks Dangerous

This is a fictional example built for this guide. A customer service centre runs 60 agents on two shifts. The floor is clean, the chairs are adjustable, the fire exits are clear. The physical risk assessment, last reviewed a year ago, scores everything as acceptable.

Meanwhile, sickness absence on the evening shift is twice the site average. Three experienced agents left in one quarter, and exit interviews mention "no time between calls" and "being shouted at with no back-up." The team leader is measured on call-handling time and has no say in the staffing model.

None of this appears in the risk assessment, because nobody wrote it down as a hazard. A psychosocial risk assessment exists to turn these signals into named hazards, scores, controls and owners. We will score this centre in the worked example below.

---

What Is a Psychosocial Risk Assessment?

ISO 45003:2021 defines psychosocial risk as the combination of the likelihood of exposure to work-related hazards of a psychosocial nature and the severity of the injury and ill health those hazards can cause. That is the same likelihood-and-severity logic you already use. The difference is the hazard source.

EU-OSHA describes the source plainly: "Psychosocial risks arise from poor work design, organisation and management, as well as from poor social context of work" (EU-OSHA).

Term	Meaning
Psychosocial hazard	A feature of work design, organization, management or social context that can cause psychological or physical harm (for example, excessive workload, harassment, poorly managed change)
Psychosocial risk	Likelihood of exposure to that hazard combined with the severity of the harm (ISO 45003)
Work-related stress	A common harmful reaction to psychosocial hazards; it is an outcome, not the hazard itself
ISO 45003	Guidelines for managing psychosocial risk within an OH&S management system based on ISO 45001
HSE Management Standards	UK framework of six work areas (demands, control, support, relationships, role, change) used to assess work-related stress

The practical point in that table: you do not assess "stress." You assess the conditions that cause it, just as you assess the unguarded nip point, not the hand injury.

---

Is a Psychosocial Risk Assessment a Legal Requirement?

In the UK, the EU and Türkiye, psychosocial hazards sit inside the employer's general duty to assess risk. None of them requires a separate document, but all of them expect these hazards to be in the assessment.

Jurisdiction	Where the duty comes from
UK	HSE states that "Employers have a legal duty to protect employees from stress at work by doing a risk assessment and acting on it" (HSE Management Standards).
EU	EU-OSHA calls the management of psychosocial risks a legal imperative set out in Framework Directive 89/391/EEC. Article 6(2)(g) requires a prevention policy covering technology, organization of work, working conditions, social relationships and the working environment (EUR-Lex).
Türkiye	The Risk Değerlendirmesi Yönetmeliği (Resmî Gazete 29.12.2012, No. 28512), Article 8(3), requires hazards from "physical, chemical, biological, psychosocial, ergonomic and similar" sources to be identified and recorded, including those from shift patterns, team working, organization, supervision and hierarchy. Law 6331 Article 5(1)(f) mirrors the EU prevention-policy wording.
ISO	ISO 45003 is guidance, not a certifiable standard. It is designed to sit within an ISO 45001 system, where hazard identification (Clause 6.1.2) already covers how work is organized.
US	OSHA publishes a workplace stress resource page with guidance for employers.

If you work under ISO 45001 or Turkish law, the question is not whether to assess psychosocial hazards but whether your current assessment actually does.

---

Psychosocial Hazards: An ISO 45003 and HSE Map

ISO 45003 groups psychosocial hazards into three areas: how work is organized, social factors at work, and the work environment, equipment and hazardous tasks. HSE's Management Standards split the same ground into six areas. The map below lines them up and adds the evidence you can use for each.

ISO 45003 group	HSE Management Standard	Typical hazards (EU-OSHA and HSE examples)	Evidence to look at
Work organization	Demands	Excessive workload, work patterns, pace	Overtime and shift data, backlog, survey scores
Work organization	Control	Little say in decisions or in how the job is done	Survey, focus groups
Work organization	Role	Unclear role, conflicting demands	Job descriptions vs. reality, focus groups
Work organization	Change	Poorly managed change, job insecurity	Change log, consultation records, exit interviews
Social factors	Support	Lack of support from managers or colleagues, poor communication	Survey, one-to-one records, turnover
Social factors	Relationships	Psychological and sexual harassment, conflict, unacceptable behavior	Grievances, HR cases, anonymous reports
Work environment, equipment and tasks	Demands (work environment)	Third-party violence (difficult customers, patients, pupils); the physical work environment, which HSE counts under demands	Incident and near-miss reports, security logs, workplace inspections

Two cautions. HSE notes that the six areas overlap, so look at the job as a whole rather than one factor at a time. And HSE says it does not expect an employer to meet every standard; they are goals you move toward through assessment and continuous improvement.

---

How to Do a Psychosocial Risk Assessment in 6 Steps

The six steps below follow HSE's Management Standards process and the general risk assessment logic. Steps 2 and 3 are where psychosocial assessments differ most from physical ones.

Step 1: Prepare and involve people

Agree who leads (usually HR and the safety function together), get senior management backing, and involve worker representatives from the start. Decide how you will protect confidentiality. People will not report bullying in a survey they think their manager can read.

Step 2: Collect evidence on the hazards

You cannot see workload or role conflict on a walk-round, so you need data. Use at least two sources:

• Survey. HSE's Indicator Tool is a 35-question survey of working conditions known to cause work-related stress, meant for all staff including senior managers. The Copenhagen Psychosocial Questionnaire (COPSOQ), developed in 2000 and available in more than 25 languages, is another validated option. HSE notes a survey is one source, not the only one, and may not be proportionate for smaller organizations.
• Existing data. HSE points to sickness absence, staff turnover above what you would expect, and exit interviews that show common reasons for leaving. Add overtime, shift and roster data, grievances and incident reports of aggression.
• Conversation. Talk to people. In small teams this may be the main source.

Step 3: Talk the findings through with workers

HSE is direct: "If you want to know what is affecting employees, you have to ask them." Data shows where to look; focus groups explain why. HSE says groups of 6 to 10 people work best, and their main output is a preliminary action plan.

Step 4: Score the risk

Use your normal method. We use Fine-Kinney below. For psychosocial hazards the scores are judgments, so write the evidence next to each one. The score is there to rank hazards and show what a control changes, not to look precise.

Step 5: Set controls and record an action plan

Start at the source: workload, staffing, rosters, role design, how change is run. Then add support (manager training, debriefs, access to occupational health) and, last, individual measures. HSE's guidance on recording says each action should be prioritized, adequate, resourced, assigned to a person or function and given a realistic timescale, agreed with senior managers and worker representatives, and shared with staff.

Step 6: Monitor and review

Decide in advance how and when you will check whether the actions worked. Track the indicators you used in Step 2 and re-run the survey or focus groups after a set period. Our guide to leading and lagging indicators shows how to set these up.

---

Worked Example: Three Roles Scored With Fine-Kinney

The three roles, the evidence and the scores below are fictional, written by FindRisk Team to show the logic. The scales are Kinney and Wiruth's (1976): risk R = Probability × Exposure × Consequence. Classes: above 400 very high, 200–400 high, 70–200 substantial, 20–70 possible, below 20 acceptable.

Role 1: Call-centre agent, evening shift

Evidence (fictional): Indicator Tool scores lowest on demands and control; evening-shift absence twice the site average; exit interviews cite back-to-back calls and abusive callers.

Hazard	Before: P × E × C	R	Main controls	After: P × E × C	R
Back-to-back calls with no recovery time (demands)	6 × 10 × 7	420 Very high	Staffing model based on call forecasts, scheduled breaks away from the phone, handling-time targets reviewed with agents	0.5 × 10 × 7	35 Possible
Abusive callers with no back-up (third-party aggression)	6 × 6 × 7	252 High	Written right to end abusive calls, transfer to a supervisor, short debrief after a serious call, logging of incidents	1 × 6 × 7	42 Possible
No say in scripts or how calls are handled (control)	3 × 10 × 3	90 Substantial	Agents help design scripts, discretion within set limits, monthly team review	1 × 10 × 3	30 Possible

Role 2: Hospital ward nurse on rotating nights

Evidence (fictional): roster data shows frequent quick returns from night to day shifts; aggression reports up on the ward; no structured debrief after patient deaths.

Hazard	Before: P × E × C	R	Main controls	After: P × E × C	R
Fatigue from rotating nights and short rest between shifts (demands)	6 × 6 × 15	540 Very high	Roster rules on minimum rest between shifts and maximum consecutive nights, forward-rotating patterns, staff input on rosters	1 × 6 × 15	90 Substantial
Verbal and physical aggression from patients or visitors	3 × 6 × 15	270 High	Risk flags on admission, de-escalation training, alarm and security response, post-incident support	0.5 × 6 × 15	45 Possible
Exposure to traumatic events with no debrief (support)	3 × 3 × 7	63 Possible	Structured debrief after critical events, access to occupational health, manager check-in	1 × 3 × 7	21 Possible

Role 3: Warehouse team leader during a restructure

Evidence (fictional): focus group reports rumors about site closure; two managers set conflicting targets; one bullying complaint unresolved for months.

Hazard	Before: P × E × C	R	Main controls	After: P × E × C	R
Poorly communicated change and job insecurity (change)	6 × 3 × 7	126 Substantial	Timeline shared early, regular briefings, consultation before decisions, a named contact for questions	1 × 3 × 7	21 Possible
Conflicting targets from two managers (role)	3 × 6 × 3	54 Possible	One reporting line, written role and priorities, conflicts escalated to one decision-maker	1 × 6 × 3	18 Acceptable
Bullying with no working procedure (relationships)	3 × 6 × 7	126 Substantial	Clear policy, confidential reporting route, time limits for investigation, manager training	0.5 × 6 × 7	21 Possible

What the numbers show

First, the two highest scores were cut by changing the work, not the worker. A resilience course would not have touched back-to-back calls or rotating nights. This matches the hierarchy of controls: fix the source first.

Second, the nurse's fatigue risk stays substantial at 90 after controls. That is an honest result. Night work in a hospital cannot be removed, so the residual score tells management this risk needs ongoing monitoring of rosters and incidents.

Third, the evidence line above each table matters as much as the scores. When an auditor or a worker asks why a hazard got a 6 for probability, you can point to absence data, survey results or roster records rather than a gut feeling.

---

Controls That Work at the Source

Organizational controls change the conditions that create the hazard. Individual measures help people cope with conditions that remain. Both have a place, but in that order. The WHO Guidelines on mental health at work (2022) group their recommendations into organizational interventions, manager training and worker training, the same order.

Hazard area	Source controls (first)	Support controls (then)
Demands	Staffing to workload, realistic targets, breaks built into schedules, roster rules	Workload check-ins, a route to flag overload
Control	Involvement in planning, discretion over pace and method	Regular team reviews
Support	Manager time for one-to-ones, clear access to occupational health	Peer support, debriefs after critical events
Relationships	Policy on unacceptable behavior, confidential reporting, timely investigation	Mediation, manager training in handling conflict
Role	Written roles and priorities, one reporting line	Induction, clarification when roles change
Change	Early information, consultation before decisions, phased implementation	Named contact, regular updates
Third-party aggression	Workplace design, staffing at peak times, right to refuse or end abusive contact	De-escalation training, post-incident support

---

Common Mistakes in Psychosocial Risk Assessments

1. Writing "stress" as the hazard

Stress is the harm. If the register says "stress, likelihood medium," nobody knows what to change. Name the condition: "back-to-back calls with no recovery time."

2. Running a survey and stopping there

A survey shows that the demands score is low. It does not show why, or what would fix it. HSE treats the survey as one source and expects you to discuss the results with workers.

3. Jumping to individual fixes

Wellbeing apps, yoga sessions and resilience training are easy to buy. They do not lower the probability of a hazard that comes from staffing, rosters or management behavior. Use them as support, not as the main control.

4. Breaking confidentiality

If a survey can identify a team of three, the results will be useless and trust will drop. Report only at group sizes where individuals cannot be recognized, and say so before the survey.

5. Leaving it to HR alone

In Türkiye, the Risk Değerlendirmesi Yönetmeliği Article 6 puts risk assessment in the hands of a team that includes the employer, the occupational safety specialist, the workplace physician and worker representatives. Psychosocial hazards belong in that same assessment, with the same ownership.

6. Never reviewing after change

A restructure, a new shift pattern or a merger can change the psychosocial picture overnight. Treat major organizational change as a trigger to review, not just new machines or processes.

---

How FindRisk Supports Psychosocial Risk Assessments

FindRisk lets you build a psychosocial hazard checklist with AI from a short description of the role or site, such as "call centre, two shifts, 60 agents", and then edit it to match the six hazard areas above. You can run it during focus groups or site visits on your phone.

Each hazard can be scored with the built-in Fine-Kinney risk assessment, so before and after scores sit side by side like the tables in this guide. Where a physical condition feeds the psychosocial risk, such as a reception desk with no barrier or an isolated workstation, you can photograph it, mark the hazard on the photo and use the AI analysis as a second check.

When you are done, FindRisk produces a professional report in seconds to share with management and worker representatives. It runs on iOS and Android.

---

Frequently Asked Questions

What are examples of psychosocial hazards?

Common examples are excessive workload, little control over how work is done, unclear or conflicting roles, poorly managed change and job insecurity, lack of support from managers or colleagues, harassment and bullying, and aggression from customers, patients or pupils. EU-OSHA and HSE both list these. ISO 45003 groups them into work organization, social factors, and the work environment, equipment and hazardous tasks.

Is a psychosocial risk assessment mandatory?

In the UK, HSE says employers have a legal duty to assess the risk of work-related stress and act on it. In the EU, it follows from Framework Directive 89/391/EEC. In Türkiye, the Risk Değerlendirmesi Yönetmeliği Article 8(3) names psychosocial hazard sources explicitly. None of these requires a separate document, but the hazards must be covered in your risk assessment.

What is the difference between ISO 45001 and ISO 45003?

ISO 45001 is the certifiable standard for an occupational health and safety management system. ISO 45003 is a guidance standard that explains how to manage psychosocial risk within an ISO 45001-based system. You are certified to ISO 45001, not to ISO 45003, but auditors may expect your hazard identification to cover psychosocial hazards. See our ISO 45001 guide for the wider system.

Who should carry out a psychosocial risk assessment?

It should be led jointly by the safety function and HR, with senior management backing and worker representatives involved from the start. Line managers and workers provide most of the evidence. In Türkiye, the risk assessment team defined in the Risk Değerlendirmesi Yönetmeliği, including the occupational safety specialist and workplace physician, should own it like any other hazard.

How often should psychosocial risks be reassessed?

Review them on the same cycle as your general risk assessment and whenever something significant changes: a restructure, new shift patterns, staffing cuts, a rise in absence or turnover, or a serious incident such as an assault. In Türkiye, the general renewal periods are at least every 2, 4 or 6 years by hazard class, with earlier renewal when conditions change.

Can you use a risk matrix or Fine-Kinney for psychosocial hazards?

Yes, as long as you treat the scores as structured judgments backed by evidence. Write the survey results, absence data or focus group findings next to each score. The value is in ranking hazards and showing what each control changes, not in the precision of the number.

Is stress a psychosocial hazard?

No. Stress is a harmful reaction to psychosocial hazards, so it belongs in the "harm" column, not the "hazard" column. The hazards are the conditions that cause it, such as workload, lack of control or harassment. Assessing the conditions tells you what to change; assessing "stress" alone does not.

---

Conclusion

A psychosocial risk assessment uses the same logic as any other: identify hazards, decide who could be harmed and how, score the risk, control it and review. What changes is the evidence. You cannot see workload or role conflict on a walk-round, so you combine survey results, absence and turnover data, and above all conversations with the people doing the work.

Name the conditions rather than the symptoms, fix them at the source before adding individual support, and give each action an owner and a date. Then check whether it worked. That is what turns a wellbeing initiative into risk management, and what ISO 45003, HSE and Turkish law all expect.

Download FindRisk to build a psychosocial hazard checklist with AI, score each hazard with Fine-Kinney and share the report with management and worker representatives the same day.