From Scattered Records to a Structured Risk Workflow: How an Australian Healthcare Provider Built a Psychosocial Risk Management Workflow With Zoho Creator
Client Profile
The healthcare provider operates residential and community care services across several locations in Australia, with teams covering clinical, allied health, support, and administrative roles. Many employees work shifts, and their workload varies from day to day. Staff regularly dealt with high workloads, time pressure, emotionally demanding interactions, and at times aggression from patients or visitors. The organization needed a clear way to identify these workplace risks and determine where support or action was needed.
Expectations around managing psychosocial risk have become more explicit under Australian work health and safety regulations and codes of practice. The provider wanted a more structured way to show how hazards were being identified, assessed, controlled, and reviewed, and to give staff a simple way to raise concerns knowing they would be acted on.
Existing Approach to Psychosocial Hazard Reporting
Physical hazards and incidents were already captured through the provider's incident reporting process. Psychosocial hazards were handled in a more informal way. Staff raised concerns about workload, fatigue, occupational violence, bullying, or conflict through their line manager, by email to the WHS team, on paper forms, or in team meetings.
Risk assessments were recorded in a spreadsheet maintained by the WHS coordinator. Agreed control measures were captured in meeting notes, and follow-up relied on each manager's capacity.
This approach worked while the number of reports was small, but as the organization grew across sites, the WHS team needed a way to see every report, assessment, and action in one place.
Challenges With Hazard Reporting and Risk Assessment
Multiple reporting channels
Hazard reports came through email, paper forms, conversations, and meetings. This meant some reports did not reach the WHS team, while others were recorded more than once.
Different assessment methods
Risk assessments were handled differently across sites. Managers used different approaches to rate likelihood, consequence, frequency, and duration, which made it harder to assess risks in the same way across the organization.
Controls without clear ownership
Control measures were agreed in meetings, but there was no set place to record who owned each one or when it was due.
Reviews not scheduled
Without set review dates, it was hard to show whether a control was actually reducing the risk it was put in place for.
Sensitive reports in shared spaces
Bullying and harassment concerns sat in shared inboxes and spreadsheets, with limited control over who could view them.
Manual management reporting
Reports for management and the WHS committee were compiled by hand from several sources, which made trends across sites difficult to spot.
Requirements for a Centralized Workflow
The provider wanted staff to have one place to report a concern, whether they were working at a desk or on a shift. Reports needed to follow the same process for identifying the hazard, assessing the risk, putting controls in place, and reviewing the outcome. The process also needed to reflect the approach set out in Safe Work Australia's model Code of Practice for managing psychosocial hazards at work.
The provider also needed clear ownership for every control, including a due date and a way to follow up when an action was overdue. Access needed to be based on user roles so confidential reports were only available to the appropriate people. The organization wanted to keep a record of each report and be able to view information by site, hazard type, and risk level. It also needed a system that could be updated as its requirements changed, which made Zoho Creator a suitable platform for the application.
Zoho Creator Application and Workflow Design
Xponential built a custom Zoho Creator application to bring the provider's psychosocial risk information and reporting process into one place. The application covers the process from the initial hazard report through risk assessment, control actions, and review. It uses four linked modules: Hazard Reports, Risk Assessments, Control Actions, and Reviews. Site and team details, hazard categories, user roles, and notification rules are also included, allowing each hazard to be followed through its assessment, assigned controls, and review outcome.
The Zoho Creator application also uses role-based permissions to control access to information. Staff can submit and view their own reports, managers can view reports for their site, and the WHS team can access the full register. Sensitive reports are restricted to designated officers. The application is available through the Zoho Creator mobile app, so staff can report a concern while working away from a desk. This brought hazard reports, risk assessments, controls, and reviews together in one structured system instead of having them spread across emails, spreadsheets, paper records, and meeting notes.
Hazard Reporting, Risk Assessment, and Control Tracking
The new Zoho Creator application gives staff one place to report a psychosocial hazard. The form records basic details such as the site, team, type of hazard, what happened, how frequently it occurs, and how long staff are exposed to it. A report can also be marked as confidential. The WHS coordinator reviews the submission and completes the risk assessment using the organization's existing risk matrix. Control measures are added to the same record, along with the person responsible, due date, type of control, and current status.
Notifications, Ownership, and Review Workflows
The Zoho Creator Blueprint takes the report through the next steps instead of leaving follow-up to separate emails or meeting notes. A report moves from assessment to control assignment, progress, review, and closure. The person responsible receives a notification when an action is assigned, followed by reminders as the due date approaches or passes. The application also sets review dates based on the risk level and keeps the review outcome with the original report.
Reporting and Management Visibility
Zoho Creator dashboards give the WHS team and management a view of open hazards, risk levels, overdue actions, and upcoming reviews across sites. Leadership and the WHS committee can use the same live data to track trends and prepare reports without collecting information from separate spreadsheets and records.
Business Impact
The WHS team now manages hazard reports, risk assessments, control actions, and reviews in one system, with each hazard's full record kept together.
Every report raised by staff is captured in the register, whichever site or shift it comes from. Each control has an owner and due date, and automated reminders let the WHS team see which actions are overdue without following up manually. Management and WHS committee reports now come from live dashboards rather than being compiled by hand, which frees the team to spend its time on the trends in the data.
The application can be updated as the provider adds sites, hazard categories, or review requirements, so the process can change without building a new system.
Before and After Results
| Area | Before | After |
|---|---|---|
| Hazard intake | Email, verbal reports, paper forms, and meetings | One reporting form on web and mobile |
| Risk assessment | Varied by site and manager, held in spreadsheets | Standard risk matrix with ratings calculated automatically |
| Control ownership | Agreed in meetings, often without an owner or due date | Every control has a named owner, due date, and status |
| Follow ups | Manual reminders from individual managers | Automated reminders and escalation of overdue actions |
| Reviews | Ad hoc and rarely documented | Scheduled by risk rating, with outcomes recorded |
| Confidentiality | Shared inboxes and spreadsheets | Role-based access and restricted categories |
| Management reporting | Compiled manually across sites | Live dashboards by site, category, and risk level |
Xponential Digital