Ask a business owner who is responsible for safety and you will usually hear one of two answers: "the business", or "our safety person". Both miss how WHS law is actually structured. Responsibility sits in more than one place, and the duties are different.
The PCBU: the business itself
Under the model WHS laws, the main duty holder is the person conducting a business or undertaking, known as the PCBU. A PCBU can be a company, a sole trader, a partnership or an unincorporated body, and it applies whether or not the business operates for profit. Workers and officers are not PCBUs in that capacity, and volunteer associations are excluded.
The PCBU's primary duty of care is to ensure, so far as is reasonably practicable, the health and safety of its workers while they are at work, and of any other people whose health and safety could be put at risk by the work it carries out. That covers workers it engages directly, workers it engages through contractors, and workers whose activities it influences or directs. A PCBU can also share duties with other PCBUs, for example on a shared site or in a contracting chain, and each must do what is reasonably practicable within its own influence and control.
The officer: the people who run the business
Separately from the PCBU's duty, the WHS Act places a duty on officers. An officer must exercise due diligence to ensure the PCBU complies with its WHS duties.
"Officer" is defined by reference to the Corporations Act. In practical terms it covers company directors and others who make, or take part in making, decisions that affect all or a substantial part of the business. In a small company, the owner-director is almost always an officer. Partners in a partnership are excluded from the officer definition. Volunteers can be officers, but cannot be prosecuted for breaching the officer duty.
The officer duty stands on its own. An officer can be found to have failed in their duty whether or not the business itself has been prosecuted.
What due diligence actually requires
The WHS Act lists what due diligence includes. In plain terms, an officer should be able to show they have:
- Taken reasonable steps to acquire and keep up to date their knowledge of WHS matters
- Taken reasonable steps to understand the nature of the business's operations and the hazards and risks that come with them
- Taken reasonable steps to make sure the business has, and uses, appropriate resources and processes to eliminate or minimise risks
- Taken reasonable steps to make sure the business has appropriate processes for receiving and considering information about incidents, hazards and risks, and for responding in a timely way
- Taken reasonable steps to make sure the business has, and implements, processes for complying with its duties, such as notifying incidents, consulting workers and providing training
- Taken reasonable steps to verify that the resources and processes above are provided and used
The key word is verify. Having a policy is not the same as checking that it is followed. Officers are expected to look at what is actually happening, not only at what has been written down.
What this looks like in a small business
For a small business, due diligence does not mean a dedicated safety department. It means being able to point to evidence. Hazards and incidents recorded and followed up. Risk assessments that match the work being done. Training that is recorded. Consultation that is documented. A regular point where the owner or director reviews what is open, what has been closed out, and what is outstanding. If something goes wrong, those records are how an officer shows the duty was taken seriously.
If you want to see how hazards and incidents differ and why both belong in your records, we cover that in Hazard Report or Incident Report? The Difference That Actually Matters. And if something has gone wrong, Where to Report a Workplace Incident, State by State covers who to contact in each state and territory.
The duty cannot be handed off
An officer can rely on a safety manager, a consultant or a software system for information and support, but cannot hand the duty itself to anyone else. Appointing a competent person is part of due diligence. It does not replace it.
Victoria is different, and changing
Victoria has not adopted the model WHS Act. It operates under the Occupational Health and Safety Act 2004, where officers can currently be held liable under sections 144 and 145 if the employer breaches the Act and the officer failed to take reasonable care. In July 2026 Parliament passed amendments that replace those sections with a positive due diligence duty on officers, bringing Victoria in line with the other jurisdictions. The amendments are not yet in force and are due to commence by 26 April 2028 at the latest, unless proclaimed earlier. If you operate in Victoria, check which provisions apply at the time.
Where MXM Institute fits in
Officers cannot verify what they cannot see. A WHS Gap Audit gives you an independent view of where your workplace stands against the legislation in your state or territory, with a risk-rated report and a prioritised action plan. SafeBase then gives you the registers, records and review points that show the system is being used, in one place. mxminstitute.com.au