Directors in the Crosshairs: Personal Liability for Psychosocial Safety Failures

Executive Summary

In December 2025, the Commonwealth Department of Defence became Australia's first federal employer convicted of failing to manage psychosocial risks, fined $188,000 after a worker's suicide linked to performance management. This landmark case establishes that directors can be personally prosecuted for psychosocial safety failures, with penalties that cannot be insured.

Directors now face personal liability across multiple prosecutions: a director of civil construction company Rahme Civil was personally fined $50,000 following a physical safety incident, and Court Services Victoria was fined $379,157 for toxic workplace culture. These aren't regulatory slaps on the wrist, they're criminal prosecutions with uninsurable penalties paid from personal assets.

The message is unambiguous: having psychosocial hazard policies means nothing if they're not applied in practice. Directors must demonstrate genuine, verifiable management of psychological risks, or face personal criminal liability, fines exceeding $300,000, and potential imprisonment.

The Defence Conviction: Performance Management as Criminal WHS Failure

In December 2025, the Commonwealth Department of Defence pleaded guilty to breaching Section 19(1) of the Work Health and Safety Act 2011 (Cth) by failing to manage psychosocial risks. A 34-year-old Royal Australian Air Force technician took his own life while on duty in July 2020 after being placed on four separate Work Plans over six months.

What the prosecution established:

• Defence failed to train supervisors that Work Plans (performance management tools) could constitute psychosocial hazards
• Supervisors did not identify psychosocial risks associated with multiple consecutive performance reviews
• At no point did supervisors refer the worker for support, provide leave, or take steps to relieve psychological stress
• The psychosocial risks were “obvious and known to Defence through existing policies and guidelines”
• Having policies is meaningless if they're not applied when they matter

The penalty:

• Department of Defence: $188,000 fine

Critical lesson for directors: Routine HR processes, performance management, disciplinary procedures, restructures, complaint investigations, are now recognized as psychosocial hazards requiring active risk management. Directors who fail to ensure supervisors are trained and psychological safeguards are applied face personal liability.

Directors Prosecuted Personally: Recent Cases

Rahme Civil Pty Ltd Director (NSW)

A director of civil construction company Rahme Civil was personally fined $50,000 following a physical safety incident, a reminder that officer liability under s.27 applies to physical hazards with exactly the same force as psychosocial ones, and a business that manages one well cannot assume it's covered on the other.

• Director: $50,000 personal fine
• Company: $400,000 fine
• Total organisational impact: $450,000 (director's fine uninsurable)

Court Services Victoria (VIC, 2023)

Court Services Victoria was prosecuted for systemic workplace bullying and toxic culture that caused psychological injuries to multiple employees.

• Fine: $379,157
• First major prosecution specifically for psychosocial hazards creating toxic workplace culture

Common thread: Organizations had policies addressing psychosocial risks. What they lacked was evidence these policies were genuinely implemented, monitored, and enforced. Paper compliance failed.

Why Psychosocial Prosecutions Are Escalating

1. Workers Compensation Claims Demonstrate Scale of Harm

• Mental health claims increased 161% over past decade
• Median cost per psychological injury claim: $67,400 (vs $14,400 for physical injuries)
• Average time off work: 35.7 weeks for psychological injuries (vs 7.2 weeks for physical)
• Mental health claims: 12% of total claims but 38% of total costs
• Total annual cost crossed $1 billion in 2024-25 (five years ahead of projections)

2. Clear Regulatory Guidance Eliminates “We Didn't Know” Defense

• 14 recognized psychosocial hazard categories defined
• Specific guidance on managing each hazard type
• Clear expectations for risk assessment, controls, and monitoring
• Explicit requirement to manage HR processes as potential psychosocial hazards

3. Penalties Cannot Be Insured

• Directors & Officers (D&O) insurance covers defense costs only
• Fines and penalties must be paid from personal assets
• No indemnification from company permitted
• This makes psychosocial prosecutions financially devastating for directors personally

What Directors Must Do: Due Diligence for Psychosocial Risks

1. Acquire and Maintain Knowledge

• Understand the 14 psychosocial hazard categories
• Know which hazards are present in your organization
• Stay informed about regulatory developments and case law
• Attend director-level training on psychosocial risk management

2. Understand Your Operations

• Commission psychosocial risk assessments
• Review workers compensation psychological injury claims for patterns
• Analyze exit interviews, employee surveys, and grievance data
• Identify high-risk processes: performance management, restructures, complaint handling

3. Ensure Resources and Systems

• Allocate budget for Employee Assistance Programs (EAP)
• Provide mental health first aid training for managers
• Implement confidential reporting mechanisms for psychosocial concerns
• Ensure HR processes include psychological safety safeguards

4. Verify Implementation in Practice

This is where most organizations fail. The Defence case proves having policies is insufficient.

• Conduct regular audits of psychosocial risk management
• Monitor whether managers actually apply safeguards during performance reviews
• Ensure information about psychosocial concerns flows to Board level
• Document Board discussions and decisions on psychosocial matters
• Track metrics: reporting rates, response times, resolution outcomes

The Platform Problem: Scattered Data Hides Systemic Risks

Most organizations manage psychosocial risks across disconnected systems: incident reports in one platform, employee surveys in another, workers compensation claims in a third, performance management in HRIS, exit interviews in spreadsheets, HR grievances in email folders.

This data fragmentation makes it impossible to identify patterns. When the same manager appears in multiple low-level complaints across different systems, no one connects the dots. When restructure announcements correlate with spikes in stress-related absences, the pattern remains invisible.

Directors relying on scattered data cannot demonstrate due diligence. They don't know what they don't know, and prosecutors can prove they should have known.

How Salus Enables Genuine Psychosocial Risk Management

Guided reporting, any hazard

An employee raising a psychosocial concern is guided through compiling a clear report by an AI-led conversation, never a form, anonymous or identified, informed by the relevant legislation and the organisation's own policy.

Obligation mapping for officers

The moment a report is received, the responsible person is shown exactly what they're required to do for that report type, sourced from legislation and policy, directly addressing the s.27 duty to have a process for receiving and responding to safety information.

Evidentiary logging

Every action taken on a report is timestamped and individually signed, building the documented record a court or regulator looks for when assessing whether due diligence was genuinely exercised, not just claimed after the fact. This is precisely the evidence gap the Defence case exposed.

Policy gap analysis

Existing policies are assessed against current legislation to surface gaps before an incident, not after.

Conclusion: Paper Compliance Won't Protect Directors

The Defence conviction establishes the new standard: having psychosocial hazard policies is table stakes. What protects directors is evidence those policies are genuinely applied.

Directors face personal criminal liability, fines exceeding $300,000, and potential imprisonment for psychosocial failures. These penalties cannot be insured. Personal assets are at risk. Claiming ignorance is no defense when clear regulatory guidance exists and workers compensation claims demonstrate ongoing harm.

The directors fined personally in the cases above weren't running organisations without policies. They failed to demonstrate their policies were implemented in practice. The Defence case proves the same: policies existed, but supervisors weren't trained and safeguards weren't applied.

Directors who wait for the next prosecution will find themselves explaining to courts why they didn't act when the evidence of harm was already visible in scattered workers compensation claims, employee surveys, and unreported incidents.