Psychosocial Risk Assessment: Putting ISO 45003 to Work in a US Organization

Picture a 220-person claims-processing center outside Nashville. First-year turnover is stubbornly high. Sick days bunch up around quarter-end. Every engagement survey flags "workload," and every year the action plan says something vague about prioritization. The site's safety committee keeps a careful register of physical risks: forklift routes in the mailroom, ergonomic reviews for every workstation, a fire drill schedule. It has nothing for the things that seem to be wearing people down: daily production targets, a call queue that never empties, abusive escalations from policyholders, and a reorganization that has been nearly finished for eighteen months.

The claims center is invented, but the gap is common. Most US employers have mature systems for managing physical hazards and nothing comparable for psychological ones. ISO 45003 is the most practical tool available for closing that gap, and using it does not require anyone to become a standards specialist.

What ISO 45003 is, and what it isn't

ISO 45003, published in 2021, gives guidance on managing psychosocial risks as part of an occupational health and safety management system. It was written as a companion to ISO 45001, the international standard for OH&S management systems, and follows the same plan-do-check-act structure.

Three points are worth settling up front:

• It is guidance, not a requirement. The text is written in "should" language. You cannot be certified to ISO 45003 on its own, and nothing in US federal law obliges you to follow it.
• It treats psychological harm as a safety matter. That framing is its main value. Instead of asking how to make employees more resilient, it asks which features of the work are likely to cause harm and what can be changed.
• It is not a survey. There is no ISO 45003 questionnaire. The standard describes a process and leaves the choice of instruments to you.

There is no federal OSHA standard that specifically addresses psychosocial hazards. OSHA has relied on the General Duty Clause in some workplace violence cases, and a few states, California among them, now require written workplace violence prevention plans. For most other psychosocial risks, adopting ISO 45003 is a voluntary decision. That is less of a weakness than it sounds, because it lets you fit the method to your organization rather than to an inspector's checklist.

The three hazard families

ISO 45003 sorts psychosocial hazards into three broad families. Using them as a checklist stops an assessment from fixating on whatever topic happens to be loudest that year.

How work is organized. Roles and expectations, job control, job demands, workload and pace, working hours and schedules, management of organizational change, remote and isolated work, and job security.

Social factors at work. Interpersonal relationships, leadership, organizational culture, recognition and reward, career development, support and supervision, civility and respect, work-life balance, and violence, harassment and bullying.

Work environment, equipment and hazardous tasks. Inadequate or faulty equipment, poor physical conditions such as noise, heat or cramped space, and tasks carried out in dangerous or distressing circumstances.

If you have already run an organizational check such as our workplace mental health self-check, you will see overlap with its culture and leadership questions. ISO 45003 goes further into the mechanics of the job itself: schedules, staffing, pace and task design.

Running the assessment in five moves

1. Put it inside the safety system you already have

The quickest way to stall is to build a separate "wellbeing" process that competes with the safety program for attention. Give psychosocial risk to the same committee, the same risk register and the same review cycle as physical hazards, and bring HR and operations onto that committee if they are not there already. A psychosocial hazard rated high should get the same response as a machine-guarding defect rated high.

2. Identify hazards with workers, not about them

Consultation and participation of workers is a core requirement of ISO 45001, and it matters even more here because many psychosocial hazards are invisible from a manager's office. Combine several sources:

• a short survey on working conditions (the UK Health and Safety Executive's Management Standards Indicator Tool is a reasonable starting point)
• small facilitated discussions by team or shift
• existing data: absence patterns, overtime, turnover, exit interview themes, incident and grievance logs
• direct observation of how work actually flows on an ordinary day and on a bad one

Run discussions in groups, keep notes free of names, and make sure facilitators know how to respond if someone discloses distress. Have the EAP number at hand, along with the 988 Suicide & Crisis Lifeline (call or text 988), in case a conversation surfaces something urgent.

3. Estimate the risk

ISO 45003 frames psychosocial risk as a combination of how likely exposure to a hazard is and how severe the resulting harm could be. Most organizations use a simple three-by-three matrix. Consider who is exposed, how often, for how long, and whether hazards stack. High demands alone are one thing; high demands with little control and little support are a well-known recipe for strain.

Do not over-engineer the scoring. A precise-looking number built on rough judgments is still a rough judgment. What you need is a ranking the committee can defend and revisit.

4. Choose controls in the right order

The hierarchy of controls from physical safety applies here too. Start with changes to the work itself: staffing, scheduling, task design, decision rights, the way change is managed. Organizational measures come next, such as clearer policies, manager training and better communication. Individual support, such as stress management courses or counseling through the EAP, belongs at the end of the list. It helps, but it leaves the hazard in place.

This ordering is where many programs go wrong. A resilience workshop is easy to buy and easy to report on. Adding staff to a short-handed shift is harder, and far more likely to work.

5. Document, monitor and review

Record each hazard, its rating, the controls chosen, who owns them and when they will be reviewed. Pick one or two signals per hazard that would show whether the control is working. Review on a fixed cycle, and also whenever something significant changes, such as a restructuring, a new system rollout or an acquisition.

Hazard-to-control table

The rows below illustrate the pattern. They are not a complete list.

Hazard	What it can look like	Control at the source	Supporting measure	Signal to watch
Workload and pace	Queues that never clear, routine overtime	Staffing tied to volume; cap on mandatory overtime	Prioritization rules agreed with managers	Overtime hours, backlog age
Low job control	Scripted work, no say over task order	Team discretion over sequencing and breaks	Regular team input on process changes	Survey items on control
Role ambiguity	Conflicting instructions from two supervisors	Single line of direction; written role scope	Manager training on setting expectations	Survey items on role clarity
Poorly managed change	Reorganization announced with no timeline	Published decision dates; consultation before finalizing	Q&A sessions, updated FAQs	Turnover during change periods
Hours and schedules	Short-notice shift changes, long on-call runs	Minimum notice periods; on-call rotation limits	Fatigue awareness for supervisors	Frequency of schedule changes
Customer aggression	Abusive callers or visitors	Explicit right to end abusive interactions; escalation routes	Debriefs after serious incidents	Incident reports, repeat exposure
Harassment and bullying	Persistent belittling by a colleague or manager	Enforced conduct policy with several reporting channels	Bystander and manager training	Complaint trends, respect items
Isolated work	Lone field staff with little contact	Scheduled check-ins; buddy systems	Clear routes to support	Survey items on support

Back to the claims center

Run the hypothetical Tennessee site through the process and something sharper than "workload" emerges.

The survey and group discussions point to three hazards rated high. First, the production target system counts closed claims without weighting complex ones, so the hardest files get pushed to the end of every day. Second, staff face repeated abusive calls with no explicit permission to end them. Third, the long-running reorganization has left many people unsure who their manager will be.

Controls at the source might include weighting targets by claim complexity, a written policy allowing staff to end abusive calls after one warning, and a published date for final reporting lines. Supporting measures could include supervisor training, short debriefs after the worst calls and an EAP briefing in team meetings. Signals to watch: the age of the oldest open claims, the number of calls ended under the new policy, voluntary turnover over the next two quarters and the role-clarity items on the next survey.

None of that needs a consultant or a new budget line. It needs findings treated as hazards with owners.

US wrinkles worth planning for

Keep it about conditions, not individuals. A psychosocial risk assessment should not collect diagnoses or symptom scores, and results should only be reported for groups large enough that nobody can be identified. Individual accommodation requests run through a separate process; the Job Accommodation Network is a good free reference for that side of things.

Involve unions early. In unionized workplaces, changes to schedules, staffing or performance targets may need to be bargained. Bringing union representatives into hazard identification tends to make that conversation easier later.

Pair it with US frameworks. NIOSH's Total Worker Health approach and the Surgeon General's workplace well-being framework both point the same way as ISO 45003: change the conditions of work, not just workers' coping skills. Citing them helps when leadership asks what US authorities say.

Where first attempts usually stall

• Managers draw up the hazard list alone and miss what staff actually experience.
• Every hazard gets the same control: training.
• Risk ratings are debated for months while nothing changes.
• The assessment becomes annual paperwork instead of something revisited when the work changes.
• Results never go back to the people who took part.

To turn findings into actions, the recommendations under culture and climate in our four key areas line up well with ISO 45003's social factors, and the resources page collects free assessment tools, several of which can serve as the survey component. For the wider assessment cycle, from scoping to re-measurement, see how to run a workplace mental health assessment.