WHS requirements · Australia
WHS requirements for small business in Australia, in plain English.
Every Australian business is a PCBU (a person conducting a business or undertaking) and owes a primary duty of care to its workers and anyone its work affects. This guide sets out what that means for a business with 1 to 25 people: the duties, the documents, the registers and the records, and the difference between what the law requires and what a client or prequal portal will ask to see. In Victoria the same duties sit under the Occupational Health and Safety Act 2004 and the word is OHS.
The primary duty of care
Section 19 of the model Work Health and Safety Act (and section 21 of the Victorian OHS Act) requires you to ensure, so far as is reasonably practicable, the health and safety of your workers and of other people affected by your work. Workers includes employees, contractors, subcontractors, labour hire, apprentices and volunteers. Reasonably practicable weighs the likelihood and severity of harm against what you know, what controls are available, and what they cost. It does not let you do nothing because you are small. It does mean a small business is not expected to run a tier-one safety department.
What the duty breaks down into
- Identify hazards and manage risk. Know what in your work can hurt someone and apply the hierarchy of controls: eliminate first, then substitute, isolate, engineer, administer, and protective equipment last. The WHS Regulations name specific hazards with specific rules: hazardous chemicals, plant, falls, confined spaces, noise, manual tasks, asbestos, electrical, construction.
- Consult workers. Section 47 requires consultation with workers who are or are likely to be affected. Toolbox talks, a safety meeting, a WhatsApp group with a record of what was raised and answered. Health and safety representatives if workers ask for them.
- Provide information, training, instruction and supervision. Section 19(3) (f). An induction into your business, training for the specific work and chemicals, and licences for high-risk work. Records of all three.
- Report and respond to incidents. Notifiable incidents go to the regulator immediately. Everything else should be recorded and investigated so it does not repeat.
- Keep the records the Regulations name. Chemicals register and SDS, training for high-risk work, plant records, notifiable incident records, health monitoring.
- Officers must exercise due diligence. Section 27. Directors and owners must know the risks, make sure resources and processes exist, and verify they are used. That is what management review and internal audit are for.
Law versus what clients ask for
The law does not require a management system by name. Clients, head contractors, councils and prequalification portals do. When a facilities manager asks for your WHS management system they want the evidence that you meet the duties above: a signed policy, a risk procedure and hazard register, an incident procedure and register, induction and training records, a hazardous chemicals register with SDS, consultation records, emergency procedures and insurance. The two lists are the same list. Meeting the law properly produces the documents the client wants, and the client's checklist is a reasonable proxy for the law.
A minimum viable WHS system for 1 to 25 people
| Item | Duty it answers | Where it lives |
|---|---|---|
| WHS or OHS policy, signed | Leadership and commitment; what clients ask for first | WHS policy |
| Risk management procedure and hazard register | Identify hazards, manage risk (s19, Regs part 3.1) | Policies and hazard register |
| Incident and near miss register | Notifiable incidents (s38), learning from events | Incident register |
| Hazardous chemicals register and SDS | Regs 346 and 344 | SDS register |
| Induction and training register | Information, training, instruction (s19(3)(f)); high-risk licences | Training register |
| Consultation and evidence records | Consultation (s47 to 49) | Evidence register |
| Corrective actions (CAPA) | Showing that findings are closed, not filed | CAPA register |
| Internal audit and management review | Officer due diligence (s27) | Internal audit and management review |
Industry notes
Commercial cleaning. Chemicals and SDS, manual handling, slips, lone and after-hours work, working on client sites under someone else's rules. Clients almost always run you through a prequal portal.
Trades and construction. Construction induction (white card), high-risk work licences, falls, electrical, plant. SWMS are required for the eighteen high-risk construction work activities, and they sit under, not instead of, your company system.
Services and maintenance. Driving, plant and tools, working alone, client site rules, contractor management if you subcontract. Head contractors ask for the system before the first purchase order.
Where to start this week
- Write and sign the policy for the states you actually work in.
- List your hazards and the controls you already use. Most businesses have more than they think.
- List your chemicals and download the current SDS for each.
- Put every person and every ticket on a training register with expiry dates.
- Open an incident register, even if it starts empty, and tell everyone how to use it.
- Put a review date on all of it and a management review in the calendar.
PolicySystem does steps 1 to 6 from a ten-minute questionnaire, with document control on every document and the registers live. It is not legal advice, not a regulator and not a certification body. If you have a specific compliance question, your state regulator and a WHS lawyer are the right calls. For the system itself, this is the fast path.
Where to next
WHS management system · OHS Victoria · WHS policy template · Incident register · CM3 pack · ISO 45001
Common questions.
Yes. The duties apply to every person conducting a business or undertaking (PCBU), including sole traders who engage contractors and partnerships with no employees. The size of the business changes what is reasonably practicable, not whether the duty exists. A two-person cleaning business and a two-hundred-person builder both owe the primary duty of care.
The Act does not say the words 'written policy'. It requires you to manage risks, consult, train and keep certain records, and regulators and courts expect to see how you do that. In practice a signed policy is the first thing a client, a prequal portal or an inspector asks for, so every functioning small business has one.
Records of notifiable incidents (for at least five years), a hazardous chemicals register with safety data sheets, training records for high-risk work and construction induction, health monitoring where it applies, and plant registration and inspection records for registrable plant. Good practice adds hazard, incident and consultation records because they are what proves you are managing risk.
A death, a serious injury or illness (for example, one needing immediate hospital treatment as an inpatient or amputation), or a dangerous incident that exposed someone to a serious risk even if nobody was hurt. It must be reported to the state regulator immediately by the fastest means, and the site preserved until an inspector says otherwise. Victoria has an equivalent definition under its own Act.
Most states and territories use the model Work Health and Safety Act with minor local differences. Victoria kept the Occupational Health and Safety Act 2004 and says OHS. Western Australia adopted its own WHS Act in 2022. The duties are very similar everywhere; the words, the regulator and some regulations differ. A policy should name the jurisdictions you actually work in.
Category 1 offences (reckless conduct exposing someone to death or serious injury) carry multi-million dollar fines for companies and prison for individuals. Industrial manslaughter laws now exist in most jurisdictions. Far more common are improvement and prohibition notices from inspectors, and losing a client who audited your paperwork and did not like what they saw.