Responsibilities of PCBU: A Practical WHS Guide

A PCBU breach rarely starts with a missing policy. It starts when the business assumes someone else owns the risk. Australian WHS law places the primary duty on the business or undertaking, and that duty reaches beyond employees to contractors, labour-hire workers, visitors and other people affected by the work. Safe Work Australia's PCBU duty guidance makes the scope clear. The regulator expects active risk control, not a folder of documents produced after an incident.

Table of Contents

• What a PCBU Is and Why the Primary Duty Matters
  • The duty follows the work
  • Contract wording doesn't remove the duty
• The Eight Core Duty Areas Under the WHS Act
  • What an auditor will look for
  • Evidence matters more than declarations
• Consultation, Cooperation and Coordination Across Duty Holders
  • Consultation must change decisions
  • Coordination is an active management task
• SWMS and High-Risk Construction Work
  • The document must match the task
• Incident Notification and Site Preservation
  • Use a fixed response sequence
  • Don't let the investigation destroy the evidence
• Psychosocial Hazards and the Mental Health Duty
  • Look for the work design problem
  • Training supports controls, but doesn't replace them
• Practical Compliance Checklist for PCBUs in 2026
  • Audit the four priority areas first
  • Prioritise exposure, not convenience

What a PCBU Is and Why the Primary Duty Matters

A Person Conducting a Business or Undertaking, or PCBU, is the business or organisation conducting the work. In Australia's harmonised WHS framework, the PCBU is the central duty-holder under the WHS Act 2011. Its primary duty is to ensure, so far as is reasonably practicable, the health and safety of workers and other people affected by the work. Safe Work Australia explains the primary PCBU duty.

That description covers more than the legal employer. A company, partnership, unincorporated association or sole trader may be a PCBU, depending on how the business or undertaking operates. The relevant question is not, “Who signed the employment contract?” It's, “Who conducts the work, and who has influence or control over the way it happens?”

The duty follows the work

A PCBU owes duties to its employees, but also to contractors, subcontractors, labour-hire workers, volunteers and visitors where the business affects their health and safety. A manufacturing company that controls a workshop can't avoid responsibility for a contractor working inside that workshop merely because the contractor invoices through another entity.

The duty also covers physical and psychological health. The business must provide and maintain a safe work environment, safe plant and structures, safe systems of work, suitable welfare facilities, information, training, instruction and supervision, health monitoring where required, and safe handling and storage of substances. Safe Work Australia identifies these as part of the broad PCBU responsibility.

Practical rule: If your business directs, influences or controls the work, treat the associated risk as part of your PCBU responsibility.

Contract wording doesn't remove the duty

A purchase order or subcontract can allocate tasks. It can't transfer a WHS duty away from the party that still has control or influence. Officers and workers also carry overlapping duties, so appointing a safety manager doesn't remove the responsibility of directors, operational leaders or supervisors to make sure controls exist and work.

The strongest PCBU systems therefore follow the work, not the organisation chart. They identify who controls the plant, workplace, task, worker and emergency response, then test whether those controls operate at the point of work.

The Eight Core Duty Areas Under the WHS Act

The eight duty areas matter only when they produce controls that workers can see and follow. In 2026, regulators will test those controls against the actual job, including psychosocial risks, contractor interfaces and the speed of incident response. Consider a metal-fabrication workshop where employees operate presses and welders while an external contractor services extraction equipment.

What an auditor will look for

The first question is whether the business can prove that its controls match the work. A safety manual is supporting evidence, not proof that the system operates.

The contractor creates a live interface risk. The workshop must control access, isolation arrangements, the work area and interaction with production. The contractor must control hazards created by its own work. A clause stating that the contractor is “responsible for safety” does not justify uncontrolled access, weak isolation or poor coordination.

The same evidence test applies to psychosocial hazards. A business should be able to show how it identifies workload, unreasonable behaviour, poor role clarity or inadequate support, then records the controls, owners and review points. Paper policies do not prove that supervisors address those risks.

Evidence matters more than declarations

A regulator will compare what the business says with what workers do. Inspectors may examine machine guards, ask workers how isolation works, check chemical storage, review maintenance close-outs and test how supervisors respond to deviations. They will also look at whether serious incidents were escalated and notified promptly, rather than left waiting for an internal investigation to finish.

The contractor example shows why control evidence must be current. A production change can alter traffic routes, noise, workload or emergency access. A new contractor can introduce different equipment and competencies. If the risk assessment, induction and supervision remain unchanged, the documented system no longer matches the workplace.

Use records that demonstrate action: completed inspections, closed defects, competency checks, consultation outcomes, psychosocial risk reviews and time-stamped incident decisions. Review them after changes, complaints, near misses and events affecting multiple duty holders. This is the evidence that separates an operating WHS system from a manual kept for inspection.

Consultation, Cooperation and Coordination Across Duty Holders

Multiple PCBUs don't create a safety vacuum. They create overlapping duties. A head contractor, electrical subcontractor and labour-hire provider may each control different parts of the same work, but each must still take reasonably practicable steps within its control. Safe Work Australia's consultation guidance states that duties aren't transferable and can't be contracted out.

Consultation must change decisions

A toolbox talk delivered after the work package is fixed isn't meaningful consultation. Consultation should give affected workers and health and safety representatives a genuine opportunity to identify hazards, challenge assumptions and influence controls before work starts.

On a construction project, the head contractor may control site access, traffic routes and sequencing. The electrical subcontractor controls its isolation and testing methods. The labour-hire supplier may control recruitment and worker placement, while the host controls daily supervision and the work environment. Each party needs to explain its controls and identify where those controls meet.

Useful evidence includes:

• Site interface plans: Record who controls access, isolation, traffic, plant and emergency response.
• Pre-start coordination: Discuss changes in work fronts, simultaneous operations and excluded areas.
• Shift handovers: Pass on incomplete isolations, plant defects, changed conditions and worker concerns.
• Worker feedback: Record issues raised and show what decision followed.
• Contractor reviews: Check whether subcontractor controls match the actual site, not just their submitted documents.

Coordination is an active management task

Coordination means aligning controls so one business doesn't undermine another. If an electrical crew isolates equipment but production changes the work sequence, the isolation process must account for that change. If labour-hire workers are unfamiliar with the site, the host must ensure their induction, supervision and task allocation are adequate.

The regulator may examine several PCBUs after one incident because the harm can result from a gap between systems. Don't rely on a clause that assigns “overall responsibility” to the head contractor. Define responsibilities, verify them at the workplace and revisit them whenever the work changes.

SWMS and High-Risk Construction Work

A safe work method statement, or SWMS, is mandatory before work starts when the task involves one of the 18 high risk construction work activities defined in the WHS Regulations. Safe Work Australia's SWMS information sheet confirms that the PCBU carrying out the work must prepare a SWMS or ensure one has been prepared.

Examples include work near energised electrical installations, work in confined spaces, demolition work and asbestos removal. If a contractor is demolishing a load-bearing wall, the task falls into high-risk construction work because structural integrity and possible collapse must be controlled before the demolition begins.

The document must match the task

A compliant SWMS should identify the high-risk activity, describe the hazards and risks, specify controls, explain how controls will be implemented, state how they'll be monitored and reviewed, and identify the work steps to which the controls apply. Workers and supervisors must understand the document, and the PCBU must revise it when site conditions, sequencing, plant or controls change.

The absence of a SWMS doesn't mean the business has no duty for other construction work. The PCBU must still eliminate risks or minimise them so far as is reasonably practicable.

Read what a safe work method statement is before approving a contractor's document. Generic boilerplate, missing worker involvement, controls unrelated to the actual work and no change-control process are clear warning signs. A SWMS isn't a substitute for competent supervision or physical risk controls.

Incident Notification and Site Preservation

Incident response becomes a PCBU compliance task as soon as the business becomes aware of a potentially notifiable event. Safe Work Australia requires immediate notification to the WHS regulator by the fastest possible means for a workplace death, serious work-related injury or illness, or dangerous incident. The incident-notification guidance also covers dangerous incidents involving mobile plant and falls, violent incidents including sexual assault, work-related suicide and attempted suicide, and extended worker absences of 15 or more calendar days.

Use a fixed response sequence

1. Make the emergency safe. Provide first aid, call emergency services where required and prevent further exposure.
2. Triage the event. Decide whether the facts indicate death, serious injury or illness, a dangerous incident, or another listed trigger.
3. Notify immediately. Contact the relevant WHS regulator by the fastest possible means once the PCBU becomes aware.
4. Preserve the site. Don't disturb the incident site until an inspector arrives or directs otherwise, except to help an injured person, save life, relieve suffering or make the site safe.
5. Control evidence. Secure relevant plant, photographs, permits, isolation records, CCTV, SWMS and witness details.
6. Record the response. Document who made decisions, when notification occurred, what was changed and why.

Don't let the investigation destroy the evidence

Well-meaning managers often move equipment, clean a spill or restart a process before deciding whether the event is notifiable. That can compromise the regulator's investigation and any later prosecution. The emergency exception is narrow. It permits action needed to save life, relieve suffering or make the site safe. It doesn't authorise a general clean-up.

The person receiving the first report must know who has authority to escalate. Test the process, make contact details accessible and train supervisors to preserve information without conducting an improvised blame exercise. A practical incident reporting procedure should separate emergency care, regulator notification, site preservation, internal investigation and corrective action.

Psychosocial Hazards and the Mental Health Duty

One mental-health training session doesn't discharge a PCBU's psychosocial duty. Safe Work Australia's PCBU psychosocial duties guidance requires PCBUs to identify reasonably foreseeable psychosocial hazards, eliminate risks where reasonably practicable, minimise them where elimination isn't possible, maintain controls and review them when required.

That's a management system, not an awareness event.

Look for the work design problem

A call centre may have high work demands, limited worker control and weak management support. Those conditions can combine into a broader risk involving workload, autonomy, relationships and role clarity. Training workers to recognise stress won't fix unrealistic allocation, inconsistent supervision or unclear escalation channels.

The same principle applies to construction, manufacturing and industrial services. Fatigue may arise from work demands and poor change management. Bullying may involve relationships and inadequate management action. Remote work can create isolation and reduce access to support. Labour-hire workers may face unclear reporting lines or fear that raising a concern will affect future placement.

A defensible control set should include:

• Hazard identification: Assess work design, workload, control, support, relationships, role clarity and organisational change.
• Worker consultation: Record who was consulted, what they reported and how the business responded.
• Specific controls: Change rosters, staffing, supervision, workload allocation, reporting channels or work sequencing where those factors create risk.
• Outcome monitoring: Track complaints, absenteeism, turnover, reports of fatigue, interpersonal concerns and incident patterns.
• Review triggers: Reassess controls after organisational change, a complaint, a serious concern or evidence that a control isn't working.

Training supports controls, but doesn't replace them

Training has a place. Workers need to know how to report bullying, fatigue, unreasonable demands and other concerns. Managers need instruction on responding to disclosures and escalating risks. But the PCBU must also control the work conditions producing the hazard.

Safe Work Australia's guidance is particularly important for managers who treat a completed course as proof of control effectiveness. A control must be maintained and reviewed. If complaints continue, absenteeism rises or workers report that the process is unsafe to use, the PCBU must act on that information.

Use a structured psychosocial risk assessment that connects worker feedback to changes in work design. Keep the assessment, consultation records, decisions and review outcomes together. That evidence shows whether the business managed the risk or merely documented it.

Practical Compliance Checklist for PCBUs in 2026

Start with the controls an inspector can test quickly. A polished policy won't compensate for a missing high-risk control, weak contractor interface or a notification process nobody has rehearsed.

Audit the four priority areas first

• Hazard registers: Confirm that the register covers physical and psychosocial exposures, identifies affected workers and records current controls.
• High-risk construction work: Check that a current SWMS exists before work starts for any of the 18 defined high-risk construction activities.
• Genuine consultation: Look for evidence that workers and HSRs influenced decisions, not just attendance records from toolbox talks.
• Incident notification: Verify that supervisors know the triggers, escalation path, regulator contact method and site-preservation rules.

Then test the supporting systems. Training records should connect to actual roles and tasks, not just list course names. Plant records should show registration where required, inspections, defects and close-out. Contractor onboarding should establish site rules, competence, access, supervision and each party's WHS responsibilities. Return-to-work arrangements should address physical and psychological injuries rather than treating mental health as an HR issue outside the WHS system.

Prioritise exposure, not convenience

A missing SWMS for high-risk construction work deserves immediate attention. So does an uncontrolled interaction between mobile plant and pedestrians, an unresolved isolation defect or an incident process that depends on one manager's memory. An outdated training matrix may still need correction, but it shouldn't distract leadership from a control failure that can expose someone to serious harm.

Assign one accountable owner to each control. Set a review point, define the evidence required and escalate overdue actions. A quarterly leadership review should examine whether controls remain effective, whether consultation changed anything and whether incident, complaint or absence information indicates a new risk.

A practical system can help keep those records connected. Safety Space manages incidents, risk registers, SWMS and training records, with contractor and multi-site oversight that supports the evidence a PCBU needs to maintain.

Safety Space helps Australian PCBUs manage incidents, risk registers, SWMS, training records and contractor controls in one system. Visit Safety Space to arrange a practical demonstration and assess where your current WHS controls are leaving gaps.