The Obligation, Not the Benefit

Much of what is presented as a wellbeing benefit is, in several jurisdictions, closer to a legal requirement attached to the working conditions.

General orientation only. Requirements differ substantially by jurisdiction and change. Take advice for yours.

The general shape

Employers commonly have a duty to provide a safe working environment, and in a growing number of jurisdictions that duty explicitly includes psychological as well as physical safety.

Risk assessment obligations may extend to psychosocial hazards — workload, hours, role conflict, bullying, exposure to trauma — assessed and controlled in the same way as physical hazards.

Working time rules in many places limit hours and mandate rest.

Discrimination and equality law commonly requires reasonable adjustments for health conditions, including mental health conditions.

Data protection law restricts what health information an employer may collect and how it may be handled, which is directly relevant to wellbeing programmes that gather personal data.

Why the framing matters

A benefit is discretionary; an obligation is not.

Benefits compete for budget against other benefits. Obligations compete against nothing.

Risk assessment produces documentation, which creates accountability that a wellbeing initiative does not.

It moves the conversation from whether people feel supported to whether the conditions are safe, which is a different and more answerable question.

For a programme struggling to get attention, this is frequently the more effective route than a return-on-investment argument.

What a psychosocial risk assessment looks like

Where the obligation applies, the structure resembles any other risk assessment.

Identify the hazards: workload, hours, control, role clarity, relationships, change, exposure.

Identify who is affected and how.

Evaluate existing controls.

Identify further controls needed, with owners and dates.

Record it.

Review it, particularly after any significant change.

This maps closely onto the six mismatch areas, which makes the diagnostic and the compliance exercise largely the same work.

The data protection point

Worth stating separately because wellbeing programmes routinely get it wrong.

Health data is generally treated as a special category requiring stronger justification and handling.

Collecting it through apps, screenings, challenges or surveys carries real exposure.

Consent given by an employee to their employer is frequently not considered freely given, because of the power imbalance — which undermines the usual justification.

The safe position: do not collect individual health data. Aggregate, anonymised measures of working conditions are both more useful and less exposed.

What this note is not

Not legal advice, and not a substitute for it.

Not a claim that any specific requirement applies to you. Jurisdictions vary enormously and enforcement varies more.

The reason to raise it is that many organisations treat this entire area as discretionary, and in a growing number of places it is not — which is worth checking before the question arrives from a regulator or a tribunal.

What a risk assessment record contains

Where psychosocial risk assessment applies, the documentation resembles any other and is straightforward.

The hazards identified, by area: workload, hours, control, role clarity, relationships, change, exposure.

Who is affected, including groups at particular risk.

Existing controls and an honest assessment of their adequacy.

Further controls required, with named owners and dates.

Review date, and triggers for earlier review such as a restructure or an incident.

Evidence considered: survey data, absence and turnover figures, incident reports, consultation with staff.

Consultation with employees is usually a requirement rather than good practice, and it is the element most often omitted.

Consultation as a requirement

The element most often omitted from psychosocial risk assessment.

Employees are frequently required to be consulted, not merely surveyed.

Consultation means their views inform the assessment and the controls chosen.

Record what was raised and what was done about it, including where nothing was.

Involve representatives where they exist.

An assessment written by management without employee input is likely to be both inadequate as a document and wrong about the hazards, since the people doing the work know where the pressure is.