Most organisations that believe they are measuring psychosocial risk are in fact measuring engagement, once a year, at company level. The instruments look alike. Both ask people how work is going. Both produce a percentage. The divergence appears the moment someone asks the four questions a psychosocial duty actually turns on: what hazards did you identify, how did you assess them, what did you do, and how did you review it.
The four questions
An engagement survey can usually answer the first question badly and the other three not at all. It surfaces sentiment rather than hazards, reports at a level too aggregated to locate anything, and rarely produces a documented control or a scheduled review. That is not a criticism of engagement surveys. They were designed to measure something else and they do it competently.
Aggregation is the specific failure
The most common technical problem is aggregation. Company level reporting hides exactly the concentration you are legally required to find. A workforce can return a healthy overall score while one supervisor layer or one shift pattern carries almost all of the strain, and the aggregate will never show it. Psychosocial hazards concentrate structurally, so measurement has to be able to resolve to the group where the structure actually bites.
The second failure is language
Generic instruments ask generic questions, and generic questions get generic answers. An item about workload means something different to a fly in fly out gas crew, a disability support worker on a lone shift, and an account manager on a client deadline. When the item does not reference the real conditions of the job, people answer it as a mood question rather than a risk question, and the result is unusable for control design.
What a defensible cycle looks like
Identification against named domains, at a resolution that can locate concentration. Assessment that separates likelihood from consequence. Controls that are recorded, owned and dated, with at least some sitting higher than training in the hierarchy. Review on a stated cadence, with the result of the review written down. None of this is exotic. It is the same structure applied to physical hazards for decades. The only novel part is applying it to hazards that do not leave a mark.
The uncomfortable implication
If your psychosocial evidence is an engagement survey, you do not have a gap in your reporting. You have a gap in your risk management, and the reporting is simply where it becomes visible. That is an easier problem to fix than it sounds, but it is not fixed by adding questions.
