Psychosocial Risk Assessment at Work: Legislation, ISO 45003 and Practical Steps

What is psychosocial risk assessment and what is its legal basis? Law No. 6331, the Risk Assessment Regulation, ISO 45003 and practical steps are covered here.

In many workplaces, "risk assessment" brings to mind machine guards, noise measurements and chemical exposure. Yet in the very same factory, endless overtime, unclear job descriptions, harsh management language or conflict within the team also pave the way to accidents, absenteeism and staff turnover. Psychosocial risk assessment aims to identify, in a systematic way, these hazards that arise from how work is organised and from relationships at work, and to take action against them. In this article we look at what the concept means, its legislative basis in Turkey, the framework introduced by the ISO 45003 guidance and how the process can be carried out step by step.

What Is Psychosocial Risk?

Psychosocial hazards are factors related to the design, organisation and management of work and to social relationships in the workplace that can adversely affect an employee's mental and physical health. Risk, in turn, is the likelihood and severity of these hazards causing harm.

ISO 45003:2021, an international guidance document, groups psychosocial hazards under three main headings:

• How work is organised: Workload and pace, working hours and shift patterns, role clarity, autonomy in decision-making, change management.
• Social factors at work: Relationships with managers and colleagues, support, recognition, violence, harassment and bullying.
• Work environment, equipment and hazardous tasks: The psychological load created by noise, lighting, inadequate equipment or high-risk tasks.

The Ministry of Labour and Social Security's 2024 Psychosocial Factors Information Guide uses a more detailed classification and lists ten categories: the nature of the work, workload and work pace, work schedules, control, environment and equipment, organisational culture, interpersonal relationships, role at work, career development, and the interaction between work and life outside work (ÇSGB, 2024). The guide is advisory, but it offers a useful roadmap for deciding which headings to look at in an assessment.

What Do Psychosocial Risks Cost a Business?

Psychosocial risks are not an abstract "wellbeing" topic. According to the report published by the ILO in April 2026, psychosocial risk factors cause more than 840,000 deaths every year through related cardiovascular diseases and mental disorders, and their economic impact is estimated at 1.37% of global GDP per year (ILO, 2026).

ISO 45003 likewise lists among the possible consequences of psychosocial risks cardiovascular disease, musculoskeletal disorders, anxiety and depression, as well as declines in job satisfaction, commitment and productivity. In a large European survey, 46% of employees report severe time pressure or work overload, and 27% report stress, depression or anxiety caused or made worse by work (EU-OSHA, 2022).

There is one more detail that matters for factories: in the ESENER 2024 survey covering 41,458 workplaces in Europe, the workplaces that reported none of the psychosocial risk factors were found most often in manufacturing and agriculture. The survey interprets this as a finding that may point to a lack of awareness rather than an absence of risks (EU-OSHA, 2025). In other words, the perception that "we don't have such a problem here" may mean that the problem is simply not yet visible.

The indicators for Turkey are also striking. According to the report based on Gallup's 2025 data, 66% of employees in Turkey say they experienced stress during a large part of the previous day; the global average is 40%. The proportion of employees who are genuinely engaged with their work is 8% (Gallup, 2026). This picture suggests that psychosocial topics such as workload, management style and working conditions are a priority for workplaces in Turkey as well. When psychosocial risks go unnoticed, they often show themselves indirectly, as absenteeism, frequent resignations, rising errors and accidents, or conflict within teams.

Is Psychosocial Risk Assessment a Legal Requirement?

This question is asked often, and the answer needs to be worded carefully. The words "psychosocial" and "stress" do not appear in the Occupational Health and Safety Law No. 6331. However, psychosocial hazards fall within the scope of risk assessment through both the law and the regulation.

What does Law No. 6331 say?

• Article 4: The employer is obliged to ensure the work-related health and safety of employees and carries out, or has carried out, a risk assessment.
• Article 5/ç: It requires that the adverse effects of monotonous work and production pace on health and safety be prevented, or minimised where they cannot be prevented.
• Article 5/f: It provides for the development of a coherent and comprehensive prevention policy covering the effects of factors relating to technology, work organisation, working conditions, social relationships and the working environment.
• Article 10: It requires that risk assessment take into account groups that need special policies, such as young, older, disabled, pregnant or breastfeeding workers, as well as the situation of women workers.

What does the Risk Assessment Regulation say?

Article 8 of the Occupational Health and Safety Risk Assessment Regulation provides that, alongside physical, chemical, biological and ergonomic sources of hazard in the working environment, psychosocial sources of hazard must also be identified and recorded. The same article requires that, if no measurement or examination has previously been carried out for psychosocial sources of hazard, the necessary checks, measurements and investigations be carried out.

Under Article 12 of the Regulation, the risk assessment is renewed at least every 2 years in very hazardous workplaces, every 4 years in hazardous workplaces and every 6 years in less hazardous workplaces. It is also renewed whenever a workplace accident, occupational disease, near-miss event or health surveillance findings require it. The risk assessment team includes the employer or their representative, the occupational safety specialist, the workplace physician, the employee representative, support staff and employees representing the units (Article 6). A psychologist is not a mandatory member of the team; however, external expert support can be obtained for psychosocial topics.

Psychosocial hazards are not an "extra" topic in risk assessment; they are one of the sources of hazard the regulation lists explicitly. The real question is not whether it will be done, but how, and how well.

What Is ISO 45003 and How Does It Relate to ISO 45001?

ISO 45003:2021 is titled "Occupational health and safety management: Psychological health and safety at work: Guidelines for managing psychosocial risks" and has also been published in Turkish by TSE (the Turkish Standards Institution). It can be applied to organisations of any size and in any sector.

Two points need underlining:

• ISO 45003 is a guidance document, not a certification standard. There is no such thing as an "ISO 45003 certificate". The standard contains recommendations.
• It complements ISO 45001. ISO 45001 is the occupational health and safety management system, and certification is carried out against it. ISO 45003 applies ISO 45001's requirements for hazard identification and risk assessment to the psychosocial field. For a factory that holds an ISO 45001 certificate, psychosocial risk assessment is a natural part of the management system.

Of the workplaces in Europe that carry out risk assessments, 64% say they have enough information on how to include psychosocial risks in the assessment (EU-OSHA, 2025). For a significant share of the rest, ISO 45003 and the ÇSGB guide can help structure the method. Small and medium-sized businesses without an ISO 45001 certificate can also use ISO 45003 like a checklist to see which topics are being overlooked. The framework the guidance provides carries the basic steps of a management system into the psychosocial field: leadership by top management, worker participation, hazard identification, planning of measures and continual improvement.

How Is Psychosocial Risk Assessment Carried Out? Step-by-Step Practice

Different methods can be used in practice; the steps below offer a general flow consistent with the legislation and the ISO 45003 framework:

1. Preparation and ownership: Secure the support of top management, involve the employee representative in the process and announce clearly that the results will be used to improve things, not to blame anyone.
2. Collect existing data: Absenteeism, resignations, overtime, workplace accident and near-miss records, reports submitted through the complaints and suggestions system and the workplace physician's collective health surveillance findings provide important clues.
3. Gather employees' views: Anonymous surveys, small focus group discussions by unit and field observation can be used together. The measurement tools attached to the ÇSGB guide are resources that can be used at this stage.
4. Identify and prioritise hazards: Classify the findings under the three headings of ISO 45003 or the ten categories of the ÇSGB. Determine in which unit, on which shift and in which group the risk is concentrated.
5. Plan the measures: Give priority to organisational measures aimed at the source, for example redistributing workload, reviewing the shift plan, clarifying job descriptions and establishing bullying and complaint procedures. Individual support and training complement these measures.
6. Record and implement: Enter the findings and measures in the risk assessment document and assign people responsible and dates.
7. Monitor and update: Re-measure the indicators you have set at regular intervals; renew the assessment after a workplace accident or a major organisational change.

A warning is important here: psychosocial risk assessment is not an individual "mental health screening" of employees. The WHO has made no recommendation on screening programmes in the workplace because their benefits and harms are uncertain (WHO, 2022). The focus of the assessment is not people but the work and working conditions.

Some hazards need special attention. We have discussed the relationship between shift work and the risks of fatigue and accidents in the article on shift work and occupational safety, and the obligations relating to psychological harassment in the article on workplace mobbing.

Common Mistakes in Psychosocial Risk Assessment

A psychosocial risk assessment may look complete on paper and yet have no counterpart on the shop floor. Common mistakes in practice are as follows:

• Turning it into a formality: Adding a single line headed "stress" to the general risk assessment form does not meet the identification and recording that the regulation requires.
• Placing the problem on the individual: The comment "some employees can't cope with stress" overlooks sources such as workload, shift patterns or management style.
• Failing to guarantee confidentiality: If employees fear that their survey answers will be used against them, they will not reflect the true picture. In small units, results must be reported in a way that does not make individuals identifiable.
• Not sharing the results: If a survey is carried out and nothing changes afterwards, participation in and trust towards the next survey falls.
• Settling for training alone: A stress management seminar can be useful, but it does not remove problems in work organisation. As the ILO stresses, individual measures should complement organisational measures, not replace them (ILO, 2026).

Suppose that in a food factory the survey results showed intense time pressure and communication problems with supervisors in the packaging unit. In this case, rather than giving stress training only to the unit's employees, addressing production targets, staff planning and the supervisor's communication skills together would be an approach more in line with the purpose of psychosocial risk assessment.

How to Get Started in Your Organisation

To begin a psychosocial risk assessment you do not need a large budget or a complex system; what you need is a regular method.

• Needs analysis: Check to what extent psychosocial topics appear in your current risk assessment. Compare the last year's absenteeism, resignation and accident data by unit. To get a first idea of the priority areas in your organisation, you can use the corporate needs analysis section.
• Programme: According to the findings, plan organisational measures first, then complementary steps such as manager training, employee briefings and individual support. In Europe, 39% of workplaces with 20 or more employees are found to have an action plan against work-related stress (EU-OSHA, 2025); a written plan ensures the continuity of the process.
• Measurement: Track regularly the indicators the ILO recommends, that is, absenteeism, resignations, reports of violence and harassment, use of support services and employee surveys (ILO, 2026).

A clinical psychologist working together with your occupational safety specialist and workplace physician can contribute, in particular, to interpreting survey and interview findings and designing measures. You can review the corporate service options on the corporate services page.

Frequently Asked Questions

Who carries out the psychosocial risk assessment?

According to the regulation, the risk assessment is carried out by a team made up of the employer or their representative, the occupational safety specialist, the workplace physician, the employee representative, support staff and unit representatives. For psychosocial topics, advice can be obtained from external specialists such as a clinical psychologist.

How often should psychosocial risk assessment be renewed?

It is subject to the same periods as the general risk assessment: at least every 2 years in very hazardous workplaces, every 4 years in hazardous workplaces and every 6 years in less hazardous workplaces. It should be renewed earlier if a workplace accident, a near-miss event or health surveillance findings require it.

Do we have to obtain an ISO 45003 certificate?

No. ISO 45003 is a guidance document, not a certification standard. Certification is carried out against ISO 45001; ISO 45003 provides guidance on how psychosocial risks can be managed within that system.

Is an employee survey enough on its own?

Generally not. Surveys are an important source of data, but a more reliable picture emerges when they are evaluated together with absenteeism, accident and resignation records, focus group discussions and field observation.

• #psychosocial risk assessment
• #ISO 45003
• #occupational health and safety
• #work stress

Yazar

Eda Erkan Alapala

Klinik Psikolog. İstanbul Kent Üniversitesi Klinik Psikoloji Tezli Yüksek Lisans mezunu; bilişsel davranışçı terapi, çocuk merkezli oyun terapisi ve çocuk-ergen psikoterapisi alanlarında eğitimlerini tamamlamıştır.

Eğitimler