Small Business Owners: You're Personally Liable for WHS Failures (Even Without an HR Department)

Executive Summary

Being a small business does not reduce the health and safety duties your business owes, or the personal duty carried by the person who runs it. Under Australian work health and safety law, the director of a small company is almost always one of its "officers", with a personal, non-delegable duty to exercise due diligence. Lack of an HR manager, a safety officer or a compliance budget is not a defence.

That duty now clearly extends to psychological health. Harassment and workplace bullying are the most common cause of serious mental stress claims in Australia, accounting for 33.2 per cent of them according to Safe Work Australia. And regulators are prosecuting small businesses, and their directors personally, for failing to manage those risks.

Small businesses make up 97.3 per cent of all Australian businesses (ASBFEO, June 2025), and most have no HR department. The law does not adjust its expectations for that. What it asks is due diligence appropriate to the size and nature of your business, and the recent cases below show what happens when that is missing.

The Legal Reality: Small Business Owners Carry Personal WHS Duties

Under section 27 of the model Work Health and Safety Act, the "officers" of a person conducting a business or undertaking (PCBU) have a personal duty to exercise due diligence to ensure the business complies with its WHS obligations. Victoria's Occupational Health and Safety Act has an equivalent: an officer can be personally liable where a company's offence is attributable to their failure to take reasonable care.

Who is an officer?

• Company directors, including sole directors
• Company secretaries
• People who make, or participate in making, decisions that affect the whole or a substantial part of the business

If you run your business as a sole trader or in a partnership, you are not an "officer", you are the PCBU itself, and the primary duty to ensure health and safety rests on you directly.

Critical point: Whichever structure you use, if you own and run a small business, you carry WHS duties personally. A company director can be prosecuted as an officer even when the company is prosecuted too.

Recent Prosecutions: Small Businesses and Their Directors

The three Victorian cases below all involve small businesses, all involve psychosocial hazards rather than physical ones, and all resulted in convictions.

Case 1: Blisspell Pty Ltd, Toy Wholesaler (Victoria, 2025)

In May 2025, Blisspell Pty Ltd, a children's toy wholesaler based in Reservoir, was convicted in the Heidelberg Magistrates' Court and fined $100,000, plus $6,060 in costs, for failing to provide and maintain a workplace that was safe and without risks to health.

What went wrong:

WorkSafe Victoria found that between October 2022 and January 2023 the business had no formal system to identify, prevent, manage, investigate or respond to inappropriate behaviour at work, during a period in which a worker alleged sexual harassment by one of the company's directors.

Key takeaway: The prosecution centred on the missing system. A small business with no formal way for workers to raise concerns, and no process for responding to them, was exposed to a $100,000 conviction.

Case 2: Printco (Aust) Pty Ltd and Its Director (Victoria, 2024)

In March 2024, Printco (Aust) Pty Ltd and its director each pleaded guilty in the Moorabbin Magistrates' Court and were each convicted and fined $20,000, with combined costs of $9,309, over a sustained pattern of bullying of a sub-contractor by the director.

What went wrong:

WorkSafe Victoria found the company's workplace bullying policy was inadequate: it had no reporting procedure, no definitions or examples, and no worker training. The company was charged with failing to provide a safe system of work; the director was charged personally, as an officer, with failing to take reasonable care.

Key takeaway: The director was fined personally, on top of the company's fine. In a small business, the person whose conduct creates the risk is often also the person responsible for the systems meant to control it.

Case 3: Melbourne Glass Solutions, Sole Director (Victoria, 2023)

In December 2023, the sole director of Melbourne Glass Solutions Pty Ltd pleaded guilty in the Melbourne Magistrates' Court and was convicted and fined $60,000 personally, plus $6,000 in costs. WorkSafe Victoria found the company lacked adequate policies and procedures to manage the risk of workplace bullying, and that its systems of work permitted, or failed to prevent, the bullying of apprentices. That failure was attributed to the director's own failure, as an officer, to take reasonable care.

Key takeaway: In a company with one director, the officer duty sits with one person, and so can the fine.

Common thread: None of these was a large organisation, and none could rely on "we're too small" or "we don't have HR". In each case, the regulator pointed to the absence of basic systems: a formal way to raise concerns, a procedure for responding, and training on expected behaviour.

For a fuller explanation of the psychosocial duty itself, what it covers, and what "reasonably practicable" means for a business without an HR department, see "The Psychosocial Duty Every Australian Small Business Owner Is Already Carrying."

What 'Due Diligence' Means for Small Business Owners

Section 27 of the model WHS Act sets out what due diligence includes. None of it requires an HR department, but all of it applies to psychological health as much as physical safety.

1. Acquire and Keep Up-to-Date Knowledge of WHS Matters

• Understand your WHS duties, including the duty to manage psychosocial hazards
• Know the relevant code of practice, Managing psychosocial hazards at work, and what it expects
• Stay informed about changes, such as Victoria's psychological health regulations, which took effect on 1 December 2025

2. Understand Your Operations and Their Hazards

• Identify what could harm your workers, psychologically as well as physically: workload, unclear roles, conflict, bullying and harassment
• Know which roles are most exposed, for example, apprentices, young workers, or anyone who works alone
• Carry out a basic risk assessment (regulators publish templates)

3. Ensure Appropriate Resources and Processes to Eliminate or Minimise Risks

• Set clear, written standards of behaviour
• Give workers a way to raise a concern that does not depend on going to the person they are concerned about
• Allow time and budget for the controls you decide on

4. Ensure Information About Hazards and Incidents Is Received and Acted On Promptly

• Keep a record of every concern raised
• Respond in a timely way, don't wait for a formal complaint
• Look for patterns in complaints, absences and claims

5. Ensure Processes to Comply With Your Duties

• Have a bullying and harassment policy that includes a reporting procedure, definitions and examples
• Train workers on it, the elements found missing in the Printco case

6. Verify That Those Resources and Processes Are Provided and Used

• Check that your policies are followed in practice, not just written down
• Keep records of what you did and when
• Having a policy on paper is not enough if no one uses it

Why Small Businesses Carry Higher Psychosocial Risk

Small businesses often assume psychosocial hazards are a large-organisation issue. In practice, small workplaces can carry more of them, because of:

• Role overload, people covering several jobs because staff numbers are limited
• Lack of role clarity in small, informal teams
• Long hours to keep the business running
• Low job control where the owner makes every decision
• No HR function, no EAP, and nowhere independent to raise a concern
• Conflict that is hard to escape in a small team
• Bullying or harassment with no formal complaint mechanism

Routine processes carry risk too: In December 2025, the Department of Defence was convicted and fined $188,000, the first Commonwealth employer convicted of failing to manage psychosocial risks, after a worker was placed on four separate performance management Work Plans in six months without being referred for support. Performance reviews, managing underperformance and handling complaints all need the same care in a business of any size.

The Penalties You Face Personally

Penalties are set by each state and territory and indexed each year. Under the model WHS Act, which most jurisdictions have adopted, the maximum fines for an individual who is an officer or a PCBU, as at 1 July 2026, are:

• Category 1 (reckless conduct or gross negligence that exposes someone to a risk of death or serious injury or illness): $2,464,000, and imprisonment
• Category 2 (a failure that exposes someone to that risk): $494,000
• Category 3 (a failure to comply with a health and safety duty): $165,000
• Industrial manslaughter, where a jurisdiction has adopted it: up to 20 years' imprisonment for an individual, and a model maximum fine of $21,274,000 for a body corporate

Victoria's OHS Act sets its own penalty amounts. In a growing number of jurisdictions, including NSW and South Australia, it is also an offence to insure against WHS fines, so a fine is paid by the business or person convicted, not passed to an insurer. And a conviction, as recorded in all three cases above, stays on the record.

How Salus Helps Small Businesses Show Due Diligence

The common gap in the cases above was not a lack of goodwill, it was the absence of a system. Salus provides that system without needing an HR department.

Guided reporting, any concern

A worker raising a concern, bullying, harassment, workload, conflict, is guided through compiling a clear report by an AI-led conversation, never a form, anonymous or identified, informed by the relevant legislation and your business's own policy. It gives workers the independent pathway that all three businesses above were missing.

Obligation mapping for officers

The moment a report is received, the responsible person is shown exactly what they're required to do for that report type, sourced from legislation and policy, directly relevant to the due diligence duty to receive and respond to information promptly.

Evidentiary logging

Every action taken on a report is timestamped and individually signed, building the documented record a regulator or court looks for when assessing whether due diligence was genuinely exercised, not just claimed after the fact.

Policy gap analysis

Existing policies are assessed against current legislation to surface gaps before an incident, not after, such as a bullying policy with no reporting procedure, the gap WorkSafe identified in the Printco case.

Separately, Salus's emoji-based reach-out check-ins give owners an additional, lighter-touch signal of how their people are going, alongside, not instead of, formal reporting.

Conclusion: Small Size Is Not a Defence

The businesses in these cases were not large corporations. They were a toy wholesaler, a printing company and a glass business, each convicted, and in two cases with a director fined personally, because basic systems for managing psychosocial risk were missing.

What protects a small business owner is due diligence appropriate to the business. That does not require a dedicated HR department. It requires:

• Knowledge of your duties, including psychosocial hazards
• A way for workers to raise concerns safely and independently
• A prompt, documented response when they do
• Policies that include a reporting procedure, and training on them
• Records showing those processes are actually used

The legal duty is the same whether you employ five people or five thousand. The difference is whether you can show you acted on it.