Quick Answer:
Occupational violence and aggression covers any incident where a worker is abused, threatened or assaulted in circumstances arising from their work, including from clients, patients, customers and members of the public. It is a psychosocial hazard, which means it carries the same duty as a physical one and the hierarchy of control applies. The eight risk factors in the checklist below identify where the exposure sits. The mistake most employers make is jumping to training and personal safety devices, which are the weakest controls available, without first asking what could be designed out of the work.
In this guide
Occupational violence is one of the few workplace hazards where the source often is not an employee.
It arrives with a frustrated customer, an unwell patient, a person affected by alcohol, or someone who has just been told no.
That changes how it has to be managed. You cannot train a member of the public, and you cannot performance-manage them.
Everything available to you sits in the design of the work: who is exposed, when, alone or not, with what between them and the risk.
This guide covers Australian obligations under the model work health and safety laws. Duties vary between states and territories, and Victoria has additional psychological health regulations.
What Occupational Violence And Aggression Is
Occupational violence and aggression covers any incident where a person is abused, threatened or assaulted in circumstances arising out of their work.
Safe Work Australia treats workplace violence and aggression as a hazard employers must manage in the same way as any other.
It is broader than physical assault, and the non-physical forms are far more common.
| Form | What it looks like | Commonly under-reported because |
|---|---|---|
| Verbal abuse | Shouting, swearing, insults, humiliation, often from clients or the public | Staff treat it as part of the job in customer-facing roles |
| Threats | Statements or gestures suggesting harm to the worker, their family or property | Nothing physically happened, so it feels not worth reporting |
| Intimidation | Standing over, following, blocking an exit, aggressive proximity | Hard to describe on a form designed for injuries |
| Harassment and stalking | Repeated unwanted contact, including online and outside work hours | It falls between safety, human resources and personal life |
| Physical assault | Hitting, pushing, spitting, throwing objects, use of a weapon | This one is usually reported, which is why the data looks like assault is the main risk |
| Property damage or theft with confrontation | Damage or theft occurring in front of a worker | Recorded as a security incident rather than a safety one |
Why the under-reporting matters more than the incidents
Verbal abuse and threats are the early signal. An organisation seeing only assaults is not safer than one seeing hundreds of verbal incidents. It is blind for longer, and it will discover the pattern at the point of a serious injury rather than months beforehand.
The Legal Duty, And Why It Is A Work Health And Safety Matter
Occupational violence is a psychosocial hazard. Safe Work Australia lists violence and aggression among the psychosocial hazards employers must manage, which places it squarely inside the primary duty in regulation 34 to manage risks to health and safety.
As a person conducting a business or undertaking (PCBU), you must manage the risks associated with work-related violence and aggression, and those risks vary considerably from business to business depending on what the work involves and who the workers deal with.
That duty is not discharged by responding well after an incident. It requires the risk to be identified and controlled beforehand, applying the hierarchy of control in regulation 36.
| Obligation | Source | What it means in practice |
|---|---|---|
| Manage the risk | Regulation 34 | Identify where violence and aggression could occur, assess it, control it, and review |
| Apply the hierarchy of control | Regulation 36 | Eliminate so far as reasonably practicable first. Training and personal protective equipment are last |
| Review control measures on events | Regulation 38 | Review after an incident, when a new hazard appears, when a control is ineffective, before a change, or if a health and safety representative asks |
| Notify certain incidents | Incident notification duties | A serious injury or illness arising from violence may be notifiable to the regulator |
| Consult workers | Model WHS laws | The people exposed usually know where the risk sits, and consultation is itself a duty |
Victoria has gone further. The Occupational Health and Safety (Psychological Health) Regulations 2025 commenced on 1 December 2025, expressly covering aggression and violence alongside bullying and sexual harassment.
See WorkSafe Victoria, whose WorkWell toolkit on violence and aggression is the most practical free resource available on this topic.
Who Is Most Exposed To Occupational Violence
Exposure is not evenly spread. It concentrates wherever a worker meets the public in circumstances involving distress, delay, refusal, money or authority.
| Setting | Why exposure is high | The factor that usually drives it |
|---|---|---|
| Health, aged care and disability services | Patients and clients may be unwell, confused, in pain or affected by medication | Behaviour is often not intentional, which makes staff reluctant to report it |
| Retail, hospitality and service counters | Refusals, waiting, price disputes, alcohol | Lone closing shifts and cash handling |
| Transport, delivery and field services | Working alone, in vehicles, at unfamiliar addresses | No colleague present and slow help if something happens |
| Education and childcare | Distressed parents and carers, and student behaviour | Front-desk staff absorb the first contact with no barrier |
| Enforcement, inspection and compliance roles | The work involves telling people no, or issuing penalties | The role itself is the trigger, so it cannot be removed |
| Community and outreach work | Home visits, unpredictable environments, no control of the setting | Lone work combined with an unassessed location |
| Security and front-of-house | Deliberate confrontation is part of the role | Escalation is expected, so incidents are normalised |
Two things cut across all of them: working alone and working after hours.
Where those two combine with any of the settings above, exposure rises sharply and should be rated accordingly on your risk matrix, which is why both appear in the checklist below.
The Occupational Violence And Aggression Risk Assessment Checklist
Work through each factor for each role or location. Mark it yes or no, and where the answer is yes, record the control rather than the intention.
This is the checklist this page has always carried, with the questions to ask and the controls that actually reduce each one.
| # | Risk factor | What to ask | Controls that reduce it |
|---|---|---|---|
| 1 | Working alone, or in an isolated or remote area | Is it safe for this work to be done alone? How would anyone know if something went wrong? | Two-person rostering for higher-risk tasks, scheduled check-ins, duress alarms with a tested response, and location awareness for field staff. Lone work is covered further in identifying and controlling risks when working alone |
| 2 | Working in unfamiliar or unpredictable environments | Is the environment assessed before the worker arrives? Who else will be present? | Pre-visit risk screening, client history flags, refusal rights where a location is unsafe, agreed abort criteria |
| 3 | Working at night or outside normal hours | Does the time of day change who is around, how visible the site is, and how quickly help arrives? | Adjusted staffing at night, lighting and visibility, secure entry, changed opening arrangements |
| 4 | Delivering a service to people who may behave unpredictably or aggressively | Are staff told beforehand where a history exists? Can they withdraw safely? | Behaviour flags in the client record, barriers or counter design, de-escalation training as a supporting control, an explicit right to disengage |
| 5 | Delivering a service that may cause frustration or resentment | Does the process itself create the trigger? Long waits, repeated requests, refusals | Fix the process. Reduce waiting, explain decisions in writing, remove the need for the worker to deliver bad news unsupported |
| 6 | Handling cash, drugs or valuables | Are staff aware of the added risk, and is the quantity visible or predictable? | Minimise cash held, time-delay safes, remove visibility, vary banking times, secure storage for medicines |
| 7 | Enforcement activities such as issuing fines or exercising authority | Is the confrontation inherent to the role, and is the worker supported in it? | Two-person attendance, body-worn cameras where lawful, scripted escalation paths, supervisor backup |
| 8 | Knowledge sharing and reporting | Are incidents of violence and aggression recorded, and does the information reach the next person exposed? | A reporting route that takes under a minute, incident data linked to the risk register, and flags visible to whoever attends next |
| 9 | Anything else specific to your situation | What do the people doing this work say is the risk? They usually know | Consultation as a standing item, not a one-off survey. A risk-aware culture is what makes people raise it |
The factor most often marked no when it should be yes
Number 5. Organisations assess aggressive clients and overlook the processes that create frustration. A queue that regularly runs 40 minutes, or a policy that forces a frontline worker to deliver a refusal they did not make, is a control failure sitting upstream of every incident it produces.
Record the completed checklist. Under regulation 38 you will need to review these controls when an incident occurs, when a new hazard appears, or before a change to the work, and that review is far easier from a documented baseline.
Controls That Work, In Order
The hierarchy of control is not advice. It is the order regulation 36 requires, and it is where most occupational violence programmes go wrong, because they start at the bottom.
| Level | What it means for occupational violence | Example |
|---|---|---|
| 1. Elimination | Remove the exposure entirely | Stop holding cash on site. Move a service online. End lone night shifts at a high-risk location |
| 2. Substitution | Replace the activity with a lower-risk one | Cashless payment. Appointments instead of walk-ins. Phone or video contact instead of a home visit |
| 3. Isolation | Separate the worker from the hazard | Screens and barriers, secure reception, controlled entry, service through a hatch |
| 4. Engineering | Change the physical environment | Lighting, sightlines, counter height and depth, a second exit, duress alarms wired to a monitored response |
| 5. Administrative | Change how people work | Two-person rostering, check-in procedures, de-escalation training, behaviour flags, scripts |
| 6. Personal protective equipment | Protect the individual | Personal duress devices, body-worn cameras where lawful |
Most organisations begin at level 5 with training, then add level 6 with a duress device, and call it a control programme.
Both are legitimate and both are the weakest available. A work health and safety regulator will ask what was considered at levels 1 to 4.
The test for whether you applied the hierarchy
For each yes on the checklist, can you name something you changed about the work itself rather than something you asked the worker to do differently? If every control is a behaviour, you have applied one level of six.
Training still matters, and its role is to support the higher controls rather than replace them.
The same logic applies across every psychosocial hazard, which is covered in psychosocial hazards at work.
What To Do After An Incident
The response after an incident is both a duty and the main source of information you will ever get about the risk.
| Step | What it involves | Why it matters |
|---|---|---|
| Immediate safety and care | Remove the threat, provide first aid, arrange support. Do not send the worker straight back | The most visible signal you send about whether this is taken seriously |
| Record it, including near misses | Verbal abuse and threats recorded with the same weight as physical incidents | Non-physical incidents are the early warning. Recording only assaults hides the pattern |
| Check notification obligations | A serious injury or illness arising from violence may be notifiable to your regulator. See incident notification | The window is short and the assessment is easier from a written process |
| Review the controls | Regulation 38 requires review after an incident, not at the next scheduled cycle | This is a legal trigger, and it is the one most often missed |
| Look for the pattern | Same location, same shift, same task, same client cohort | One incident is an event. Three at one site is a design problem, which is what continuous risk monitoring is for |
| Support and follow up | Check in after days and weeks, not only on the day | Psychological injury from violence often surfaces later than physical injury |
The step that changes outcomes most
Recording verbal abuse and threats. Organisations that only record assaults have no leading indicator and will always be responding to the serious incident rather than the pattern that produced it. See integrated risk management for how incident data should reach the register.
What Evidence Looks Like
If a regulator, an insurer or a court examines how you managed occupational violence, these are the records that answer the question.
| What you will be asked | The record that answers it | How long it should take |
|---|---|---|
| Did you identify the risk? | The completed checklist, dated, per role or location | Minutes |
| Is it in your risk register? | A register entry with an owner, a control and a review date | Minutes |
| Did you consult workers? | Consultation records, including what workers raised and what changed | Same day |
| What controls did you apply? | Controls documented against the hierarchy, showing what was considered above training | Same day |
| Did you train people? | Completion records by person and course version, refreshed on a cycle | Minutes |
| What happened after the last incident? | The investigation, the control review under regulation 38, and what changed | Same day |
The fourth row is the one that separates organisations.
Documenting that you considered elimination and isolation and explaining why they were not reasonably practicable is a far stronger position than a training record alone.
The same standard is set out in audit-ready risk management.
6 Common Mistakes In Managing Occupational Violence
- Starting at training: De-escalation training is a level 5 control. Useful, and the weakest thing you can do first. A regulator will ask what was considered above it.
- Recording only physical incidents: Verbal abuse and threats are the leading indicator. An organisation seeing only assaults is not safer, it is blind for longer.
- Treating client aggression as unavoidable: Behaviour driven by illness or distress may not be intentional, and the exposure is still controllable through rostering, environment and process design.
- Issuing duress alarms without a tested response: A device nobody is monitoring, or with no agreed response time, is equipment rather than a control. Test it.
- Ignoring the process that creates the trigger: Long waits, unexplained refusals and repeated requests for the same information generate aggression. That is a design problem sitting upstream of every incident.
- Sending the worker straight back: Psychological injury from occupational violence frequently surfaces later than physical injury, and the immediate response sets what everyone else believes about reporting.
Bringing It Together
Occupational violence and aggression is a psychosocial hazard with the same duty attached as any physical one.
The checklist identifies where your exposure sits. The hierarchy of control decides whether your response will hold up.
The distinguishing feature of this hazard is that the source is often not your employee, which is why it sits differently from most HR risk and so the usual levers do not apply.
What remains is the design of the work: who is exposed, when, alone or not, with what between them and the risk, and what happens to the information afterwards.
If you do one thing after reading this, complete the checklist for your highest-exposure role and put the result in your risk register with an owner and a review date.
That single entry is what a regulator asks for first, and most organisations do not have it because occupational violence is filed under security or human resources rather than safety.
Frequently Asked Questions
1. What is occupational violence and aggression?
Any incident where a person is abused, threatened or assaulted in circumstances arising out of their work. It includes verbal abuse, threats, intimidation, harassment and stalking as well as physical assault, and the source is frequently a client, patient, customer or member of the public rather than a colleague. Safe Work Australia treats workplace violence and aggression as a hazard employers must manage.
2. Is occupational violence a work health and safety issue or a security issue?
A work health and safety issue, and filing it under security is a common and costly error. Violence and aggression is a recognised psychosocial hazard, which brings it within the primary duty to manage risk and means the hierarchy of control applies. Organisations that treat it as security tend to reach for cameras and guards, which are isolation and administrative controls, without assessing what could be eliminated.
3. What should an occupational violence risk assessment cover?
At minimum the eight factors in the checklist above: working alone or in isolated areas, unfamiliar or unpredictable environments, night or after-hours work, service to people who may behave unpredictably, service that causes frustration or resentment, handling cash or drugs or valuables, enforcement activities, and whether incidents are recorded and shared. Add anything specific to your setting, and consult the workers exposed, since they usually know where the risk actually sits.
4. What controls are most effective against occupational violence?
The ones highest in the hierarchy. Eliminating the exposure, such as removing cash from a site or ending lone night shifts at a high-risk location. Then substitution, such as cashless payment or appointments instead of walk-ins. Then isolation through screens, barriers and controlled entry, then engineering changes such as lighting and sightlines. Training and duress devices are levels 5 and 6 and should support the higher controls rather than replace them.
5. Do we have to report occupational violence incidents to the regulator?
Sometimes. A serious injury or illness arising from an incident of violence may be notifiable, and the notification window is short. The practical control is a documented assessment process that predates any incident, so the decision is not being made under pressure. Check your jurisdiction’s incident notification requirements, since duties vary between states and territories.
6. Should verbal abuse and threats be recorded if nobody was hurt?
Yes, and this is the single highest-value change most organisations can make. Verbal abuse and threats are the leading indicator of physical incidents. An organisation recording only assaults has no early warning, so it will always be responding to the serious incident rather than the pattern that produced it. Make the first step of reporting take under a minute.
7. When do we have to review our occupational violence controls?
Under regulation 38 of the model work health and safety regulations, control measures must be reviewed when a new hazard or risk is identified, when a control is found not to be effective, after a notifiable incident, before a change at the workplace, and when a health and safety representative requests it. An annual review alone will miss all five triggers.
8. Does the duty cover aggression from clients who are unwell or not acting deliberately?
Yes. The duty attaches to the risk to the worker, not to the intent of the person creating it. Behaviour arising from illness, medication, dementia or distress may be entirely unintentional and still exposes the worker to harm. In those settings the controls sit almost entirely in work design: staffing levels, environment, behaviour flags, and whether a worker can withdraw safely.
Sources
- Safe Work Australia, Workplace violence and aggression
- Safe Work Australia, Psychosocial hazards
- Safe Work Australia, Incident notification
- Safe Work Australia, Key Work Health and Safety Statistics Australia 2025
- Work Health and Safety Regulations 2011 (Cth), regulation 34, Duty to manage risks
- Work Health and Safety Regulations 2011 (Cth), regulation 36, Hierarchy of control
- Work Health and Safety Regulations 2011 (Cth), regulation 38, Review of control measures
- WorkSafe Victoria, WorkWell toolkit: violence and aggression
- WorkSafe Victoria, New regulations make psychological health a priority
See how Sentrient supports psychological safety
Occupational violence carries the same duty as a physical hazard, and the same need for evidence. Sentrient helps Australian employers identify, control and record it alongside everything else in the register.
Disclaimer: This article is general information, not legal advice. Work health and safety duties vary between states and territories, and Victoria has additional psychological health regulations in force from 1 December 2025. Confirm your obligations with your work health and safety regulator or a qualified adviser before acting.
Read More About Occupational Violence And Aggression:
- How To Prevent Common Types Of Occupational Violence And Aggression In The Workplace
- Leadership and Culture Can Help Control Risks of Work-Related Violence
- New Compliance Course Released – Occupational Violence and Aggression Training Course
- Steps To Enable Diversity And Workplace Flexibility
- Common Misconceptions Around Work Functions
