Corporate culture has a legal definition in the model WHS law, and "tolerated" is the word that should worry boards

The system: a loop, not a binder

Comcare's guidance is blunt about what a WHS management system is not: it is much more than simply having safety-related forms and policies in place and documented procedures. The point is achieving the measures and contents of the safety documentation in an ongoing and managed way. A working system, in Comcare's description, is evolving and continuously improving, uses feedback to manage and improve safety outcomes, builds on existing processes, integrates with other management systems, strengthens corporate culture and demonstrates due diligence. Two of the things it lists as essential evidence of maturity are exactly the legal duties covered below: Senior management is visibly involved and committed and Robust worker consultative arrangements are an essential element.

The voluntary reference frame is AS/NZS ISO 45001:2018, which specifies the requirements for a WHS management system, aims to prevent work-related injury and illness and proactively improve performance, and is aligned with the ISO 9000 family so it integrates with quality and environmental systems. The standard's text is paywalled at Standards Australia; this page describes it only through Comcare's free guidance. Its predecessor AS/NZS 4801:2001 is finished business: JAS-ANZ required certified organisations to migrate by 13 July 2023. And whatever the certificate says, certification is not compliance: the WHS duty stays with the PCBU, and it is a code of practice, not a standard, that a court may treat as evidence of what is reasonably practicable, per Safe Work Australia's model laws hub.

The shape of any such system is a cycle that plans, does, checks and acts on what the check finds. You can see that loop drawn in the free public artefacts: Comcare's national audit tool walks it as five elements (policy, planning, implementation, measurement and evaluation, management review), and the model How to manage work health and safety risks code walks it as four steps ending in review. The checking end of the loop, gap analysis and auditing, is its own discipline with its own public tools; we covered it in what a WHS audit actually checks. This page is about the system being checked: who has to lead it, who has to be consulted on it, and what the law says a culture is.

The leadership layer: six steps an officer cannot delegate

Section 27 of the model WHS Act gives officers, the people whose decisions affect the whole business, a personal duty to "exercise due diligence to ensure" the PCBU complies. Subsection (5) then defines due diligence as taking reasonable steps to: acquire and keep up to date knowledge of WHS matters; understand the operations and their hazards and risks; ensure the PCBU has available for use, and uses, appropriate resources and processes to eliminate or minimise risks; ensure there are processes for receiving and considering information about incidents, hazards and risks and responding in a timely way; ensure there are processes for complying with duties under the Act; and, the step that closes the loop, to verify the provision and use of the resources and processes in the previous three. A safety management system commissioned and never verified fails the list at its final step.

Two details in the section are worth a board paper of their own. Under subsection (4), an officer can be convicted "whether or not" the PCBU itself has been. And the December 2025 consolidation's examples of the compliance processes an officer must ensure now include reporting notifiable incidents, notifiable extended absences and notifiable suicides (language from the incident notification amendment covered in our reporting story), consulting with workers, and ensuring health and safety representatives get their training entitlements. The same six-step list reappears verbatim as a working checklist inside the psychosocial and healthcare codes, as our psychosocial code story sets out.

The worker layer: consultation is a duty with a penalty

Section 47 requires a PCBU to consult, so far as is reasonably practicable, with workers who are or are likely to be directly affected by a health and safety matter, and attaches a monetary penalty to the failure. Section 48 defines what counts: relevant information is shared, workers get a reasonable opportunity to express views and to contribute to the decision-making process, their views are taken into account, and they are advised of the outcome in a timely manner; where an elected health and safety representative exists, consultation must involve them. The model consultation code (July 2023 edition) compresses the test into one sentence: Consultation does not mean telling your workers about a health and safety decision or action after it has been taken.

Section 49 lists when consultation is required: when identifying hazards and assessing risks; when deciding on ways to eliminate or minimise those risks; when deciding on the adequacy of welfare facilities; when proposing changes that may affect workers' health or safety; and when making decisions about the procedures for consultation itself, issue resolution, health and workplace monitoring, and information and training. There is structural machinery behind it too: under sections 75 to 79 of the Act, if a health and safety representative or five or more workers request a health and safety committee, the PCBU must establish one within two months. The consultation code names the return on all this in plain terms: workers who were actively involved in decisions understand them better, and understanding the views of others leads to greater cooperation and trust.

Culture: the law defines it, and "tolerated" is the test

Safety culture reads as the soft end of this subject until you find it in the statute. The model WHS Act's corporate criminal responsibility provisions (sections 244A and 244B in the December 2025 consolidation) say that where a body corporate's state of mind must be established for an offence, it is sufficient to show that a corporate culture existed within the body corporate that directed, encouraged, tolerated or led to the carrying out of the conduct. The Act then defines the term: corporate culture means 1 or more attitudes, policies, rules, courses of conduct or practices existing within the body corporate generally or in the part of the body corporate in which the relevant activity takes place. Relevant factors include whether similar conduct had previously been authorised by a corporate officer, and whether the person involved reasonably expected it would have been. There is a defence: the body corporate proves it took reasonable precautions to prevent the conduct or its authorisation. The usual adoption honesty applies here as everywhere on this masthead: these are model provisions, carrying a jurisdictional note, and they bind in the form your jurisdiction's Act enacts them, so check your own statute.

Read with the rest of this page, the definition is clarifying. A culture, in the law's eyes, is not what the values wall says; it is the attitudes, practices and courses of conduct that actually exist, in the whole business or in the one team where the work happens. The July 2025 healthcare and social assistance code gives the sharpest regulator-documented example of a culture failing that test in practice: hazards treated as just part of the job, and patient care quietly outranking worker safety, which the code answers directly, saying care and client preferences do not take priority over worker safety. The buildable counter-culture is the mechanism set already described: leaders who verify rather than assume (section 27), consultation that happens before decisions rather than after (sections 47 to 49), incident information that flows and is acted on in a timely way, and a system that is used, reviewed and improved rather than filed. That is also why this masthead's pages on who holds which duty and the audit that tests the system keep pointing at each other: the system, the leadership and the culture are the same object seen from three angles.