A policy is not proof that a control works.
By Ikky Khan
A Board may receive every policy, dashboard, and assurance paper it asks for, yet still know little about whether its people are safe.
A policy is not proof that a control works.
Policies matter. They establish expectations and provide a basis for accountability. Their value depends on what happens when those expectations meet the pressures of daily work: an understaffed shift, an unreasonable deadline, or a senior executive whose conduct nobody feels able to question.
That is where a Board needs evidence.
Safe Work Australia’s guidance on psychosocial hazards identifies excessive job demands, poor support, unclear roles, and harmful workplace behaviours among the sources of risk. These are matters shaped by decisions about how an organisation operates.
I use the Boardroom Test to examine the distance between the system described to directors and the experience of the people working within it. It rests on three questions: are people heard, do leaders act, and is the result verified?
HEARD: Can people raise concerns with confidence?
Before someone raises a concern, they may make a private calculation. Will anything change? Will their manager find out? Will speaking up affect their shifts, their relationships, or their prospects?
An organisation can have several reporting channels and still leave those questions unanswered.
A low number of complaints, taken alone, tells a Board very little. It may reflect a healthy workplace. It may also reflect resignation among people who have watched earlier concerns go nowhere. Equally, an increase in reporting may signal growing confidence in the process. Directors need enough context to interpret the movement.
Useful evidence includes whether people know how to report, whether they trust the available pathways, and what happened to those who used them. Confidential conversations, consultation with worker representatives and appropriately designed surveys can help expose gaps that a complaints register cannot explain.
Boards should also ask whose experience is missing. Casual staff, contractors, remote teams, and people working outside normal office hours may encounter a very different organisation from the one visible to senior management.
Waiting for a formal complaint is insufficient. Concerns about workload, staffing, or conflicting expectations should be explored while there is still an opportunity to prevent harm.
People who raise concerns should receive an appropriate explanation of the response. Even when personal details cannot be shared, the organisation can explain the process, the action being taken, and when it will provide an update.
ACTED: What changes when a risk becomes visible?
Once a concern is raised, the organisation reveals how seriously it takes its commitments.
Someone needs to assess the risk promptly, take responsibility for the response and consider immediate protection. Where allegations involve individuals, the process should protect against retaliation and give everyone involved a fair opportunity to be heard. Taking a concern seriously does not require prejudging its outcome.
The response also needs to examine the conditions surrounding it.
Consider a team repeatedly reporting unsustainable workloads. Referring employees to counselling may provide valuable support. The workload itself still needs attention. Safe Work Australia’s guidance on job demands includes practical measures such as allowing adequate time for difficult tasks, providing enough skilled workers, and ensuring sufficient breaks.
The resulting decisions may involve staffing, service commitments, work allocation, or the targets leaders have approved. Those decisions can be difficult because they involve money and performance expectations. A credible response has to reach them.
For the Board, a report that a complaint has been closed should invite a further question: what changed for the people still doing the work?
An action plan should identify the hazard being addressed, who owns the change, what resources are available, and when its effect will be reviewed. Repeated delays or similar concerns across several locations deserve escalation. They may point to a problem extending beyond the original case.
VERIFIED: How does the Board know the response worked?
Verification connects management’s account with evidence of what happened.
Safe Work Australia’s risk management guidance includes reviewing whether controls work as intended and changing or replacing those that do not. Implementing a measure is therefore a point from which to test effectiveness.
Return to the workload example. If additional staff were approved, were they recruited and deployed where the pressure existed? Are people now taking their breaks? Have excessive hours reduced? Do workers report a manageable workload? Has the pressure simply moved to another team?
These questions help establish whether the intended improvement has reached daily operations.
Absence, turnover, incident reports, and repeat concerns can add context. None proves safety or failure on its own. A stronger assessment brings these indicators together with worker feedback and direct checks of the relevant controls, while acknowledging gaps or contradictory findings.
Where a serious risk persists, concerns recur, or management has a conflict of interest, independent review may be appropriate. Directors should understand who performed the review, what was examined, and what remains uncertain.
Board reporting can provide this evidence through de-identified themes and proportionate assurance. Personal details should be limited to what is necessary for proper oversight.
The Board must examine its own decisions
The Boardroom Test also turns the questions back towards directors.
Are the organisation’s targets achievable with the resources approved? What happens when a commercially successful leader repeatedly falls short of expected conduct? Does the Board welcome an uncomfortable finding, or create pressure for management to present a reassuring account?
Directors influence the conditions in which risks arise through strategy, budgets, executive appointments, and the behaviours they reward. Their response to bad news helps determine whether the next warning reaches them.
Management owns implementation. The Board’s role is to challenge the adequacy of the response, ensure it is properly resourced, and require evidence of its effectiveness.
At the next Board meeting, a useful starting point would be to select one material psychosocial risk and follow it through: what workers reported, what management changed, what evidence was gathered, and what still needs attention.
That exercise can reveal how much confidence the Board’s assurance deserves.
If your Board were required today to demonstrate that its psychosocial risk controls work, what could it place on the table?
The people doing the work should be able to recognise their experience in the answer.