Design, control and review
A control isn't just a claim. It's ranked, verified, and scheduled to be checked again.
Most tools let you type anything into a "control" field and call it done. PsychProof ranks it against the hierarchy of controls, makes you define how you'll know it worked, and schedules the next check itself. This is the step we think actually differentiates PsychProof.
Any text counts as a control
Most tools don't check whether it actually changes the hazard.
Effectiveness is self-rated
A 1-5 score at the time it was written, never checked again.
Reviews are whatever you remember
No system-suggested date, no record of why one was chosen.
Ranked, not just logged
Every control is placed on the hierarchy, on the record.
When you design a control, you place it on the same five-tier hierarchy the Code of Practice and ISO 45003 use for any other hazard. It's a guide, not a verdict, but it means a control that just informs people is never quietly treated the same as one that changes the hazard itself.
Eliminate the hazard
Removes the source of the hazard entirely, rather than managing exposure to it.
Substitute or reduce
Replaces or reduces the harmful practice, exposure, or condition driving the hazard.
Engineering or systemic
Changes the system, process, or environment so the hazard is structurally less likely.
Administrative
Policy, procedure, training, or awareness. Relies on people following it correctly.
Individual support
EAP, resilience, or coping support for the individual. Does not change the hazard itself.
Each suggested control names its tier, its evidence strength, and where the recommendation comes from, not a blank box for you to fill in.
Victoria's 2025 Psychological Health Regulations go further: training, information or instruction can't be the sole or predominant control. PsychProof enforces that rule at the point a control is logged, not at audit time.
Before it counts as done
You define how you'll know it worked, before it's marked complete.
Saving a control means choosing an effectiveness signal: something concrete you'll check to know it's actually holding, not a vague gut-feel rating filled in once and never revisited. If the signal doesn't match the tier of control you picked, PsychProof tells you before you move on.
Reviews that set themselves
The next review date isn't a guess. It's calculated, and always overridable.
PsychProof suggests a review date from the hazard's likelihood, severity, exposure and current controls, with a one-line reason you can see ("High residual risk. Review suggested within 30 days."). You can always change it. If you do, both the suggested date and the one you chose stay on the record, so the decision is documented either way.
Extreme
7 days
High
30 days
Medium
90 days
Low
365 days
These are seeded defaults. Every band is configurable in Settings, and severity 5 hazards are never allowed to drift onto a distant review, whatever the likelihood.
An honest score, not a vanity metric
Your posture score can't be padded by one good hazard.
Only controls actually marked implemented or verified count, never ones still sitting at "planned". A hazard with no implemented control scores zero, and it's still included in the average, so twenty ignored hazards can't hide behind one you handled well. The breakdown also shows how much of your control set is stuck at Administrative or Individual support, versus actually structural.
Questions we get asked
Isn't the hierarchy of controls just for physical hazards?
No. Safe Work Australia's Code of Practice and ISO 45003 apply the same hierarchy to psychosocial hazards, and Victoria's 2025 Psychological Health Regulations go further: training, information or instruction cannot be the sole or predominant control. PsychProof enforces that at the point a control is logged, not after the fact.
What if training genuinely is the right control here?
You can still log it. It just gets scored honestly as an Administrative-tier control, and the system won't let it stand as your only control for a hazard. That's the point: the hierarchy doesn't stop you using a lower-order control, it stops it quietly counting as enough.
Who sets the review date, us or the system?
The system suggests one, from the risk rating, with a one-line reason you can see. You can always override it, and both the suggested and the chosen date stay on the record, so the decision is documented either way.
Does the posture score just average everything together?
No, deliberately not. A hazard with no implemented control scores zero and is still included in the average, so one well-controlled hazard can't mask twenty ignored ones. Only controls actually marked implemented or verified count, not ones still sitting at 'planned'.