Beyond the Hazard: Managing Risks Under WHS Regulation 35

In our previous deep dive, we explored The Art of the Spot—the critical first step of identifying hazards as mandated by WHS Regulation 34. But once you’ve identified a risk, you can’t simply document it in a spreadsheet and call it a day. Identification is the diagnosis; management is the cure.

In 2026, businesses are under more scrutiny than ever. With the evolution of the Work Health and Safety (WHS) Act, the "action phase" of safety has moved from being a back-office chore to a front-line priority. That action phase is defined by Regulation 35: Managing Risks to Health and Safety.

If Regulation 34 is about finding problems, Regulation 35 is about solving them. Here is everything a Person Conducting a Business or Undertaking (PCBU) needs to know about turning safety insights into legal compliance and genuine worker protection.

The Core Mandate: Eliminate First, THEN Minimise What Risk is Left

Regulation 35 is deceptively simple in its wording, but profound in its impact. It states that a PCBU must manage risks to health and safety by:

1. Eliminating risks so far as is reasonably practicable; and

2. If it is not reasonably practicable to eliminate risks, minimising those risks so far as is reasonably practicable.

The PCBU cannot just choose not to eliminate, there is a legal hierarchy at play. You don't jump straight to safety glasses and high-vis vests because they are cheap; you start with the most effective solution: getting rid of the danger entirely.

The Golden Rule: Eliminate First

The law is uncompromising on this point: your first priority must always be to get rid of the risk. If a hazard doesn't exist, it can't hurt anyone.

• Industrial Example: If a machine in a fabrication shop is producing deafening noise levels that could cause permanent hearing loss, can that process be automated in a soundproof room where workers don't need to enter while it is in operation?

• Office Example: Unmanaged computer and power cables create the risk of trips and falls. Can under floor or skirting mounted cable trays be installed?

If you have a noisy machine that doesn't need to be there, take it out. If a task is unnecessarily dangerous, find a way to stop doing it. Elimination is the only 100% effective control measure.

The "Reasonably Practicable" Balance

We often hear the term "reasonably practicable" in safety circles, but it is frequently misunderstood as a loophole for cost-cutting. In reality, it is a strict legal test.

Under Regulation 35, "reasonably practicable" requires a PCBU to weigh up five specific factors before deciding on a course of action. It’s an objective test—meaning you are judged against what a "reasonable" person in your position would do.

1. Likelihood of the Hazard Occurring

   • How often is this risk likely to eventuate? If you have a forklift operating in a high-traffic pedestrian zone 24/7, the likelihood of a collision is high. High likelihood demands a higher level of control (like physical barriers, not just a "watch out" sign).

2. Degree of Harm

   • What is the "worst-case scenario"? If the hazard could result in a fatality or a permanent disability, the law expects you to move mountains to control it. When we deal with heavy industry and extreme heat, the "degree of harm" is often catastrophic, setting a very high bar for what is considered "reasonable."

3. Knowledge (What You Should Know)

   • In 2026, you cannot claim you didn't know a risk existed if the information was readily available. This includes:

     • Industry standards and Codes of Practice.

     • Manufacturer instructions for machinery.

     • Academic research (especially regarding psychosocial hazards and mental health).

4. Availability and Suitability of Controls

   • Is there a solution on the market? If a new type of "smart" scaffolding exists that prevents falls more effectively than traditional methods, and it’s available in your area, you are expected to consider it. If the solution exists but you choose not to use it, you must have a very strong reason why.

5. The Cost (The Final Factor)

   • Only after considering the first four factors can you look at the price tag. Safety is not a line item you can simply cut to save a buck. For cost to be a valid reason to skip a safety measure, it must be ‘grossly disproportionate’ to the risk. If a $10,000 fix prevents a $1,000,000 catastrophe (or a human life), that cost is perfectly reasonable.

The Roadmap to Minimisation: The Hierarchy of Control

If you’ve proven that you cannot eliminate a risk, you must move to Regulation 36, which outlines the Hierarchy of Control. Think of this as your roadmap for minimizing harm.

Control Level Strategy Example in Practice

Control Level	Strategy	Example in Practice
Highest	Substitution	Replacing a toxic solvent with a water-based cleaner.
High	Isolation	Placing chemicals in a bunded, lockable sea-container when not in use to stop unauthorised access.
Medium	Engineering	Installing physical guards on moving machine parts.
Low Administrative	Administrative	Training, "Danger" signs, and rotating shifts to reduce exposure.
Lowest	PPE	Hard hats, gloves, and earplugs (the "last resort").

Why is PPE at the bottom?

PPE is the lowest control because it relies on human behaviour. A worker might forget their earplugs, or the gloves might tear. An engineering control (like a guard) works every time, regardless of whether the worker is having a "bad day."

2026 Context: Managing "Invisible" Risks

As we navigate 2026, the application of Regulation 35 has expanded into the digital and psychological realms.

• Psychosocial Risk Management

  • Regulators now treat mental health with the same weight as physical safety. Managing the risk of burnout, bullying, or vicarious trauma requires more than an EAP (Employee Assistance Program). It requires Good Work Design—minimising risk by changing the way work is structured, which is a form of administrative and engineering control for the mind.

• Tech-Driven Hazards

  • With the rise of AI-monitored workplaces and automated machinery in mining and logistics industries, new risks have emerged. Regulation 35 requires PCBUs to manage the risks associated with these new technologies, ensuring that "automation" doesn't introduce "isolation" or "unpredictable mechanical failure" as new hazards.

Conclusion: Now that you know the law, and what do you do about it?

Ultimately, managing risk is about being smart, being thorough, and—most importantly—being committed to the idea that every worker should go home in the same condition they arrived.

Review your control systems, asking if you have missed a higher control method. Create clear, accountable action lists for any hazards that aren't yet adequately controlled; in the eyes of regulators, an identified hazard without a documented plan is simply a disaster waiting to happen!

April 2026