WHS Duties of a Person Conducting a Business or Undertaking

You’ve probably inherited a patchwork of SWMS, plant registers, contractor folders, and incident actions spread across email, shared drives, and site offices. That’s where whs duties of a person conducting a business or undertaking stop being a legal definition and become an operations problem: if you can’t see the risk, assign the action, and prove follow-through, you’re exposed.

For a PCBU in construction, manufacturing, or industrial services, the law is blunt. You hold the primary duty of care. The practical question isn’t whether you care about safety. It’s whether your controls are real, current, and verifiable across the places where work happens.

Table of Contents

• Your Primary Duty as a PCBU
• Deconstructing the Primary Duty of Care
  • What reasonably practicable looks like on site
  • The duty is broad because operations are broad
  • What defensible compliance looks like
• Applying WHS Duties in High-Risk Industries
  • Construction means controlling interfaces
  • Manufacturing exposes weak plant control quickly
  • Hazardous substances need engineering control, not hope
• The Distinct Duties of Officers
  • What due diligence looks like in a real business
  • Why subcontractor verification is the weak spot
• Implementing and Proving Your Compliance
  • Build an auditable trail, not a document pile
  • What good evidence looks like
  • Consultation must produce decisions
  • Use tools that make verification easier
  • What doesn’t work
• Managing Upstream and Downstream WHS Duties
  • Shared duties need active coordination
  • WHS service providers also carry duties

Your Primary Duty as a PCBU

At 6:15 a.m., a contractor starts work on one site, a forklift is already moving on another, and a maintenance crew is isolating plant at a third. If your business directs, influences, or benefits from that work, the primary duty is already in play whether your HSE manager is on site or not.

A PCBU must ensure, so far as is reasonably practicable, the health and safety of workers and other people who may be affected by the work. For an Operations Manager, the practical point is simple. This duty sits inside day-to-day operational control, not in a policy folder. It reaches into rostering, production pressure, maintenance windows, procurement choices, traffic plans, contractor onboarding, and how supervisors respond when the job starts drifting from the plan.

Delegation does not change that position. A site supervisor can run the pre-start. A contractor can prepare the SWMS. A consultant can draft procedures. The PCBU still has to make sure those measures work in the field, across shifts, across sites, and under the actual conditions people face.

That is where high-risk businesses often get exposed.

In construction, manufacturing, transport, warehousing, and processing, the issue is rarely the absence of paperwork. The issue is the gap between the documented system and the job as done in practice. A PCBU with multiple sites has to control that gap. That means checking whether plant is maintained, isolations are verified, competent supervision is available, pedestrian and mobile plant interactions are separated, and labour hire workers understand the local risks instead of being handed a generic induction and left to catch up.

The legal framework behind those operational duties is reflected in this overview of the WHS Regulation 2011 and related compliance requirements. The regulator will not assess your intent. It will assess what hazards were present, what the business knew or should have known, what authority it had to act, and what controls were implemented.

Practical rule: If the business has influence over how work is planned, resourced, supervised, or changed, treat the duty as active and make the controls visible.

Regulators continue to enforce these duties through inspections, notices, prosecutions, and court action, particularly where businesses cannot show consistent control of known risks across their operations. In practice, that means you need more than a safety management system. You need evidence that the system is being applied, tested, corrected, and backed by operational decisions.

The better operators treat WHS as part of production discipline. That same approach also supports work design, fatigue control, retention, and investing in employee well-being. On site, the warning signs usually appear early: rushed starts, overdue maintenance, unclear contractor interfaces, poor supervision, and unresolved hazards that everyone has learned to work around.

Deconstructing the Primary Duty of Care

A production manager signs off a change to keep the shift moving. A delivery route is altered, a guard is left open for access, and a contractor starts earlier than planned. Nothing looks dramatic in isolation. The legal test starts there. It asks whether the PCBU identified the risk, chose a control that was reasonably available, and can now show why that decision was acceptable.

The phrase that decides many WHS arguments is “so far as is reasonably practicable”. In day-to-day operations, that means weighing what the business knew, or should have known, about the hazard against the likelihood and severity of harm, the control options available, and the cost of those controls relative to the risk. Cost matters, but it is not a shield for leaving a known serious risk in place.

What reasonably practicable looks like on site

In high-risk businesses, the test is rarely abstract. It is applied to decisions about guarding, isolation, traffic management, shutdown planning, manual handling aids, dust controls, supervision ratios, and contractor interfaces. The question is not whether a document exists. The question is whether the control was suitable for the way the work was being done across shifts, crews, and sites.

These four checks usually expose whether the duty is being met:

That last question is where many PCBUs get caught. I often see businesses with decent controls on paper but weak evidence that the controls were selected deliberately, briefed properly, checked in the field, and reviewed after conditions changed.

The duty is broad because operations are broad

The primary duty covers more than visible hazards and more than direct employees. For a PCBU, it extends across the parts of the operation that shape exposure to risk:

• The workplace. Access and egress, housekeeping, traffic routes, exclusion zones, lighting, ventilation, and site layout.
• Plant and structures. Guarding, isolation, maintenance, commissioning, inspection, testing, and response to defects.
• Systems of work. Sequencing, permits, handovers, staffing, supervision, contractor management, fatigue controls, and management of change.
• Information, training, instruction, and supervision. Task-specific direction, verification of competence, and oversight that matches the level of risk.
• People affected by the work. Workers, contractors, labour hire, visitors, and others who may be put at risk by the business’s activities.

For an Operations Manager, the practical point is simple. If the business can influence the way work is planned, resourced, sequenced, authorised, or supervised, the duty is engaged.

A written procedure helps. It does not prove control on its own.

If a control relies mainly on workers remembering to be careful under time pressure, it is a weak control and it will drift.

What defensible compliance looks like

The better operators treat section 19 as a decision standard, not a slogan. They break the job into the actual work steps, identify where harm can occur, choose controls in the right order, then test those controls against production pressure, access constraints, maintenance realities, and contractor turnover.

That approach usually includes:

1. Defining the task as performed. Include non-routine work, startup, shutdown, cleaning, breakdown response, and interactions with other crews.
2. Identifying credible failure points. Line of fire, stored energy, plant-pedestrian interaction, falls, airborne contaminants, manual handling, and fatigue.
3. Selecting controls by effectiveness. Start with elimination, substitution, isolation, and engineering controls before relying on procedures, training, and PPE.
4. Testing whether the control will hold. If it blocks access, slows the job without adjustment to the schedule, or depends on one supervisor catching every deviation, expect non-compliance.
5. Recording the reasoning. Document why the control was chosen, who was consulted, what assumptions were made, and what verification was completed.
6. Reviewing after change. New layouts, changed plant, revised delivery schedules, new subcontractors, weather impacts, and maintenance issues all change risk.

At this point, multi-site businesses face a harder problem. A control can be adequate at one facility and fail at another because supervision, layout, plant condition, or contractor mix is different. Verifiable compliance means checking whether the standard is being applied consistently, then proving where local variation was allowed and why.

For a broader planning perspective, some managers use ideas from GM GROUP Services security guidance when building a practical risk management plan. The overlap is real. Safety and security controls both fail when assumptions are left untested, responsibilities are blurred, and no one verifies what is happening in the field.

Applying WHS Duties in High-Risk Industries

A PCBU’s duty becomes real when the job gets messy. Multiple trades on a slab. A machine down in the middle of shift. Silica dust generated faster than the extraction was designed for. A forklift route that keeps changing because stock overflow has eaten the pedestrian path.

That’s why high-risk sectors need controls that survive production pressure, subcontractor turnover, and changing site conditions.

Construction means controlling interfaces

On a construction site, the strongest paperwork in the world won’t save you if interfaces aren’t managed. High-risk construction work needs SWMS that reflect the actual sequence of work, plant movements, and adjacent trades. Generic documents copied from another project usually fail at the first change in conditions.

What works is tighter operational control:

• SWMS matched to the task. The crew should recognise the job described.
• Traffic management that fits the site. Delivery routes, reversing areas, spotters, and pedestrian separation need to reflect the daily layout.
• Fall risk controls that don’t rely on luck. Edge protection, work platform selection, access planning, rescue arrangements.
• Subcontractor coordination. Overlapping tasks create line-of-fire risks that no single trade sees in isolation.

The issue isn’t only whether a control exists. It’s whether the principal contractor, subcontractor, and supervisors are working from the same assumptions.

Manufacturing exposes weak plant control quickly

In manufacturing, poor plant control usually shows up before anything else. A guard gets bypassed because cleaning access is awkward. Lockout steps vary by shift. A recurring fault becomes normalised. Temporary fixes become permanent.

The legal duty requires more than a maintenance log and operator sign-off. You need safe plant, safe systems of work, and supervision strong enough to stop drift. In workshops and processing environments, that often means the difference between a manageable risk profile and a serious incident.

A quick sense check for plant-heavy environments:

Good systems make the safe way the easy way. Bad systems make the unsafe shortcut the only practical option.

Hazardous substances need engineering control, not hope

Dust and airborne contaminants are where many businesses overestimate the value of PPE and underestimate the need for engineering control. Under the WA WHS Act, PCBUs must minimise risks using the hierarchy of controls. That includes installing local exhaust ventilation to reduce respirable crystalline silica exposure below 0.05 mg/m³ (8-hour TWA), and RCS is linked to over 500 new lung cancer cases annually in Australian construction workers, according to WorkSafe WA’s PCBU guidance.

That single example captures the larger lesson. If the hazard is generated by the task, control it at the source where you can. Don’t build a system that depends on perfect mask fit, perfect behaviour, and perfect supervision every day.

The Distinct Duties of Officers

A company can be a PCBU. An officer carries a separate personal duty. That distinction matters because many leadership teams still talk about WHS as if approval of a budget or attendance at a quarterly review is enough.

It usually isn’t.

An officer must exercise due diligence to ensure the PCBU complies with its duties. That means the person in the leadership role has to know enough about the work and the risk profile to ask hard questions, resource the controls, and verify that the system is being used.

What due diligence looks like in a real business

The officers who are on solid ground usually do six things consistently:

• They maintain current WHS knowledge. Not just legal updates, but how the business’s main hazards are changing.
• They understand the operational hazards. Plant, contractor interfaces, shutdowns, fatigue, manual tasks, traffic, airborne contaminants.
• They provide resources. People, plant upgrades, time for inspections, competent supervision, and corrective actions.
• They ensure there are processes. Risk management, consultation, incident response, verification, review.
• They require reporting that shows control health. Not vanity metrics. Evidence of inspections, overdue actions, recurring failures, and field verification.
• They test whether the system works. Site visits, audit sampling, direct questioning, and review of closed-out actions.

This situation often catches leaders. They receive reports on lag indicators but don’t verify whether critical controls are present at the point of work.

Why subcontractor verification is the weak spot

Multi-employer sites expose poor officer oversight quickly because responsibility is shared but no one wants the gap. In WA, 40% of serious construction incidents in 2025 involved multi-employer worksites where officer verification of subcontractor processes was found to be inadequate, as discussed in Fair Workplace Solutions on PCBU duties and responsibilities.

That doesn’t mean officers must personally inspect every trench, lift, or isolation point. It means they must be able to show that the organisation has suitable resources and processes, and that those processes are being used. A dashboard, audit trail, and action register can help, but only if leadership reviews them critically. The leadership and safety responsibilities page is a useful reference point for that governance layer.

Senior leaders don’t need to run the pre-start. They do need to know whether pre-starts are specific, attended, and followed by field checks.

Ignorance of site conditions is a poor position for an officer. If your subcontractor model is complex, your due diligence burden goes up, not down.

Implementing and Proving Your Compliance

The hard part isn’t writing down your system. The hard part is proving the system works when conditions change, people rotate, and priorities clash.

Most PCBUs already have some combination of risk assessments, toolbox talks, maintenance records, training registers, and incident forms. The question is whether those records connect. If they don’t, you can end up with a business that looks compliant on paper but can’t show a clear line from hazard identification to control implementation to verification.

Build an auditable trail, not a document pile

A defensible WHS system usually has five linked records:

1. Risk identification
2. Control selection
3. Worker consultation
4. Action assignment
5. Verification and review

If one of those links is missing, the chain breaks. For example, a hazard report without an owner and due date isn’t control. A revised SWMS without worker sign-off and field verification isn’t implementation. A closed action with no evidence attached isn’t proof.

A practical test is whether an external person could pick one critical risk and trace it through your system in under ten minutes.

What good evidence looks like

In this regard, simple structure beats volume. Good evidence is specific, dated, attributable, and tied to a risk.

Use this standard when reviewing your records:

• Specific. The document identifies the plant, area, contractor, or task.
• Current. It reflects the actual conditions, not last quarter’s version.
• Attributable. A named person completed, reviewed, or approved it.
• Actionable. It includes a decision, control, or required follow-up.
• Verifiable. There’s field evidence that the control was implemented.

Here’s the difference in practice:

Paperwork should answer a regulator’s next question before they ask it.

Consultation must produce decisions

Consultation gets reduced to toolbox talks far too often. The duty is broader. Workers must be consulted on hazards, control options, changes, and issues that affect health and safety. In practical terms, the workforce often knows first where the procedure and the actual job no longer match.

Useful consultation records capture more than attendance. They record what workers raised, what decision was made, who owns the action, and when the change was checked. That’s also where broader policy references can help. For a plain-language view of what a workable safety policy should cover, Facility Management Insights on safety is a decent companion read.

Use tools that make verification easier

Digital systems are valuable when they reduce uncertainty, not when they add another layer of administration. If you’re evaluating software, look for a few basics:

• Version control so teams aren’t using old forms
• Mobile access so supervisors can complete checks where the work occurs
• Action tracking with owners and due dates
• Photo and attachment support for evidence
• Site and subcontractor visibility across multiple locations

One option in that category is audit and compliance software, including platforms such as Safety Space, which are used to track inspections, assign corrective actions, and keep an auditable record across sites and subcontractors. The value isn’t the software by itself. The value is that it helps the business show what was identified, who acted, and whether the control held.

What doesn’t work

Several patterns keep turning up in poor-performing systems:

• Overreliance on templates. A polished form doesn’t mean the risk was understood.
• Delayed close-out. Critical actions drift because no one owns them.
• Disconnected records. Incident findings never feed back into procedures or training.
• Audit theatre. Sites prepare for inspection day, then revert to normal workarounds.
• No field verification. Leaders assume controls exist because the document says they do.

If you want a cleaner system, focus less on how many documents you have and more on whether each critical risk has clear evidence of control, review, and accountability.

Managing Upstream and Downstream WHS Duties

High-risk work almost never sits inside one neat organisational boundary. Designers shape plant and structure risks before anyone arrives on site. Manufacturers and importers influence what hazards are built into equipment and substances. Installers, principal contractors, labour hire firms, and specialist subcontractors all affect how the work is done.

That means a PCBU’s duty includes managing the spaces where responsibilities overlap.

Shared duties need active coordination

Where more than one PCBU has a duty in relation to the same matter, consultation, cooperation, and coordination aren’t optional habits. They are part of how you discharge your own duty. If you bring contractors onto site, you need to know whether they are competent, whether their systems fit your site rules, and how their work affects others.

In practice, the weakest point is often the handoff between businesses. One party assumes the other has reviewed the lift study, isolation point, dust extraction, or traffic route. No one checks the interface in the field.

A useful contractor check usually covers:

• Scope clarity. What exactly are they doing, and what aren’t they doing.
• Competency. Licences, training, supervision, and relevant experience.
• Risk integration. Their SWMS, permits, and task controls must align with site controls.
• Verification. Spot checks, inspections, and evidence that the agreed controls are being used.

WHS service providers also carry duties

This point gets missed regularly. The WHS Act includes specific duties for PCBUs who provide WHS services, such as consultants or software platforms. They must ensure, so far as reasonably practicable, that their service helps the recipient PCBU meet its duties without creating new risks, as set out in WA guidance on health and safety duty holders and service providers.

That matters if you rely on external advisers, templated systems, or digital workflows. A consultant’s risk method, a software form logic, or a preconfigured checklist can help your compliance effort, but it can also introduce error if it doesn’t suit the task. You still need to test whether the service is accurate, relevant, and usable in your environment.

The strongest PCBUs treat upstream and downstream WHS duties as part of operational assurance. Not procurement. Not admin. Assurance.

If you need a cleaner way to track risks, actions, audits, and subcontractor oversight across sites, Safety Space is worth a look. It gives WHS teams and operations managers one place to record evidence, verify close-out, and maintain a usable audit trail without relying on scattered spreadsheets and paper files.