Health & Safety Maturity Assessment

About this model

About this assessment

About the Health & Safety maturity model

Workplace health and safety is not a compliance checkbox or a department — it is a reflection of how much an organisation genuinely values the people who work for it. The strongest safety cultures are not built on rules and enforcement alone; they are built on trust, learning, and the belief that every person should go home in the same condition they arrived. This model assesses whether safety is something your organisation does to people (rules, audits, consequences) or something it does with people (shared ownership, open reporting, continuous improvement). True safety maturity means that protecting people from harm — physical and psychological — is woven into how decisions are made, how work is planned, and how leaders behave every day.

This maturity model evaluates workplace health and safety across six areas that together cover the full spectrum of a safety management system: from leadership commitment and hazard identification through to incident response, worker competency, regulatory compliance, and psychological wellbeing. It is designed to help organisations see beyond compliance and understand how deeply safety is embedded in their culture and operations. The model uses three maturity levels that reflect a genuine progression from organisations that react to harm after it occurs, to those that systematically prevent it, to those where safety is a generative force that drives continuous improvement and organisational learning.

Who this assessment is for

This model is relevant to any organisation where people work — whether in offices, factories, construction sites, healthcare facilities, warehouses, retail environments, or field operations. It is designed for:

• Safety leaders and WHS professionals who want to benchmark their safety management system and identify priority improvement areas
• Senior executives and board members who need to understand the maturity of their organisation's safety culture beyond lag indicators like injury rates
• Operations and line managers who are accountable for safety outcomes in their areas and want practical guidance on what good looks like
• HR and people leaders who recognise that psychosocial safety and worker wellbeing are inseparable from physical safety
• Organisations preparing for regulatory audits, certification, or cultural transformation who need an honest internal assessment before external scrutiny

The three maturity levels

• Level 1 — Incident-Driven: Safety is managed through compliance and incident response. The organisation meets minimum legal requirements but relies on rules, penalties, and corrective action after incidents to manage safety. Hazards are identified mainly after someone is hurt. Reporting is low because workers do not trust the system or see the value. Leadership involvement is sporadic and triggered by events rather than commitment. Psychosocial risks are not recognised as safety issues. The organisation measures safety by counting injuries — the absence of incidents is mistaken for the presence of safety.

• Level 2 — Procedural: Formal safety management systems are in place and consistently applied. Hazards are identified proactively through inspections and risk assessments. Incidents are investigated for contributing factors, not just blamed on individuals. Training is role-specific and records are maintained. Workers have clear reporting channels and receive feedback on their reports. Compliance obligations are tracked and met. The organisation recognises psychosocial risks for high-exposure roles. Safety performance is monitored through a mix of lead and lag indicators. The system works, but it depends on process discipline rather than cultural commitment.

• Level 3 — Generative: Safety is a core organisational value that influences every decision. Workers at all levels actively identify and control risks as a natural part of their work, not because a procedure tells them to. Near-misses are reported at high rates and valued as prevention data. Investigations seek systemic causes and challenge assumptions. Leaders are visible safety advocates who stop work without hesitation when conditions are unsafe. Psychosocial safety is managed with the same rigour as physical safety. The organisation learns continuously — from its own incidents, from near-misses, from other industries, and from the everyday observations of its workforce. Safety is not a priority that competes with production; it is a precondition for how work gets done.

The 6 areas assessed

1. Safety Leadership & Culture

Assesses whether leaders at all levels visibly and consistently prioritise safety, and whether the organisational culture genuinely supports workers in raising concerns, stopping unsafe work, and participating in safety improvement. A strong safety culture is not about posters and slogans — it is about whether workers believe that their safety matters more than the schedule.

2. Hazard Identification & Risk Assessment

Evaluates how the organisation finds hazards before they cause harm, how thoroughly risks are assessed, and how effectively controls are selected and maintained. Mature organisations treat hazard identification as a continuous, worker-driven activity rather than a periodic compliance exercise, and they apply the hierarchy of controls rigorously rather than defaulting to PPE and procedures.

3. Incident Management & Investigation

Examines how the organisation responds to incidents and near-misses, investigates root causes, and ensures corrective actions are implemented and verified. The critical shift in maturity is from blaming individuals to understanding system failures, and from treating near-misses as non-events to recognising them as the most valuable source of prevention intelligence.

4. Training & Competency

Assesses whether workers are genuinely competent to work safely — not just trained on paper. Mature organisations distinguish between completing a course and demonstrating the ability to identify hazards, apply controls, and respond to emergencies in the specific context of each worker's role. This area also covers contractor competency management and the identification of knowledge gaps.

5. Compliance & Assurance

Evaluates whether the organisation meets its legal obligations and, more importantly, whether it verifies that safety controls actually work in practice. This goes beyond having documentation — it assesses whether the organisation can demonstrate that its safety system delivers real protection, and whether it operates to audit-ready standards every day rather than preparing a facade for inspections.

6. Wellbeing & Psychosocial Safety

Assesses whether the organisation protects workers from psychological harm — including excessive workload, fatigue, bullying, harassment, and trauma exposure — with the same rigour it applies to physical hazards. Mature organisations recognise that mental health and psychosocial safety are not HR issues separate from workplace safety; they are core safety risks that require systematic identification, assessment, and control.

How this model relates to other frameworks

• ISO 45001 — Occupational Health and Safety Management Systems
• Safe Work Australia — Model WHS Laws and Codes of Practice
• OSHA (US) — Recommended Practices for Safety and Health Programs
• HSE (UK) — Managing for Health and Safety (HSG65)
• ICMM Health and Safety Critical Control Management
• ILO-OSH 2001 — Guidelines on Occupational Safety and Health Management Systems
• IOGP Report 459 — Life-Saving Rules
• Hudson Safety Culture Ladder

Frequently asked questions