Stress risk assessment in the UK: why an ISRA alone doesn't make you compliant

Key takeaways

• An ISRA isn’t the same as legal compliance. An Individual Stress Risk Assessment supports one employee after stress has surfaced, whereas UK law requires an organisation-wide psychosocial risk assessment carried out before anyone is harmed.
• The legal duty has specific requirements. Employers with five or more staff must record significant findings, identify groups particularly at risk and review the assessment after major changes like restructures. HSE’s Management Standards are the recognised method, but any documented approach covering the same ground is acceptable.
• ISRAs alone have three key gaps. They act too late (after someone is already affected), they can’t reveal patterns across teams, shifts or sites, and they tend to fix the same root cause repeatedly at the individual level rather than addressing systemic issues like understaffing.
• The two approaches work best together. The organisational assessment drives changes to how work is designed, while ISRAs provide personal action plans. Themes from ISRAs, absence data and exit interviews should feed back into the organisational risk register, a view shared by ISO 45003 and by the 80+ jurisdictions that now regulate psychosocial risk.
• The shift is from reacting to preventing. Absence, grievances and turnover show harm that has already happened; a psychosocial risk assessment identifies where pressure is building in the work itself.

"We're compliant, we've got an ISRA framework in place."

A client said this to us recently, and the reasoning seems to make sense. The organisation takes stress seriously, its managers are trained to spot it, and there's a clear process to help someone who is struggling.

There’s just one problem: UK law requires something different. An Individual Stress Risk Assessment (ISRA) supports a single person once an issue has surfaced. The actual legal duty is a psychosocial risk assessment, which covers the whole organisation and happens before anyone gets to their breaking point. With 964,000 workers in Great Britain reporting work-related stress, depression or anxiety in 2024/25, HSE is paying closer attention to that distinction.

What is an Individual Stress Risk Assessment (ISRA)?

An ISRA is usually a conversation between a manager and an employee who has reported stress, is showing signs of it, or is coming back from stress-related absence. Together they work out what's causing the pressure, often using HSE's six areas (demands, control, support, relationships, role and change), and agree how to fix the problem.

That might mean adjusting workload or deadlines, clarifying role expectations and priorities, scheduling regular one-to-ones or adopting a phased return. The ISRA can lead to a referral to Occupational Health or an EAP. The plan is written down, shared with the employee and reviewed until things settle.

All of this is good practice that HSE expects. Its guidance says employers may need individual action plans for people suffering from stress. So there's nothing wrong with having an ISRA process. The problem comes when it's the only thing in place.

Is a psychosocial risk assessment a legal requirement in the UK?

Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a "suitable and sufficient" assessment of the risks to their employees' health at work. Mental health is included.

HSE's wording is direct. Employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it. It's the same duty that applies to any other workplace hazard, under section 2 of the Health and Safety at Work etc. Act 1974 as well as Regulation 3.

If a business has five or more employees, the significant findings have to be recorded, including any groups identified as especially at risk. The assessment should be reviewed after any significant change, such as a restructure, or whenever there's reason to think it is no longer accurate. Following HSE's Management Standards is the recognised way to do a risk assessment. You don't have to use them, but whatever method you choose needs to cover the same ground and be documented.

You'll notice that none of this depends on someone becoming unwell first.

Why isn’t an ISRA on its own enough?

The most obvious gap is timing. Regulation 3 is about finding hazards and putting controls in place in advance, whereas an ISRA starts after someone is already affected.

An ISRA also can't see patterns across groups. The regulations ask employers to identify groups of employees who are particularly at risk, and a process that deals with one person at a time won't show you that a particular team, shift or site is at higher risk of harm.

Individual stress risk assessments also tend to fix the same problem over and over. Say five people in one department each have an ISRA, and each one points to unmanageable workload. Five sets of adjustments might help those five people. If the root cause of the stress is understaffing, though, new cases will continue to show up until someone changes how the work is resourced. HSE's own checklist asks whether employers are focusing on prevention and organisational-level solutions.

How do ISRAs and organisational stress risk assessments work together?

The ISRA remains a valuable workplace tool. And it works best on top of an organisational assessment, with each one doing a different job.

The two strategies support and amplify each other. Themes that keep coming up in ISRAs, along with absence and exit interview data, should feed back into the organisational risk register. That way a recurring cause gets fixed, preventing potential harm for many instead of helping one person at a time.

ISO 45003, the international guidance on psychological health and safety at work, takes the same view. It treats individual support as one part of a wider system built around prevention. For organisations working in several countries this is crucial, as more than 80 jurisdictions now regulate psychosocial risk. The detail varies from country to country but the expectation of an organisation-level assessment is broadly the same.

Five questions to test your compliance

Not sure which side of the line your organisation sits on? This short quiz can help make it clear:

1. When did you last assess stress or psychosocial risk across the organisation, separately from individual cases?
2. If an HSE inspector asked to see that assessment tomorrow, what would you hand over?
3. Which teams or sites are most at risk, and what evidence tells you that?
4. Have the themes from your ISRAs, absence data and exit interviews ever resulted in change at organisational level?
5. If you operate outside the UK, how confident are you about your obligations in other markets?

If most of your answers lead back to individual cases and the EAP, the organisational assessment is probably the missing piece.

Moving from reacting to preventing

Absence, claims, turnover and grievances reveal that someone is already struggling. ISRAs and EAPs help you respond when that happens, and they should stay. A psychosocial risk assessment does something more. It shows you where pressure is building in the work itself, before stress turns into a sick note or a resignation.

Where does your organisation stand on psychosocial risk?

Find out where your organisation stands on psychosocial risk by completing our short survey, and receive a free 30-minute consultation to discuss your results.

Start survey

Frequently asked questions

What's the difference between an ISRA and a psychosocial risk assessment?

An ISRA looks at one employee's situation once they're showing signs of stress. A psychosocial risk assessment looks at hazards across the organisation, such as heavy workload, lack of control or poorly managed change, before they cause harm.

Do small businesses need a written stress risk assessment?

Every employer has to assess the risk of work-related stress. If you employ five or more people, you must also write down the significant findings.

Do I have to use the HSE Management Standards?

No. They're the recognised approach, but you can use another method as long as it covers the same hazards and is documented.

How often should a stress risk assessment be reviewed?

Whenever there's a significant change, such as a restructure or new systems, or a reason to think it's no longer valid. Reviewing it on a regular cycle, for example once a year, is also good practice.

Does having an EAP mean we're managing stress risk?

Not on its own. An EAP supports people who are already struggling. The legal duty is to assess and act on the causes of stress in the work itself.

This article covers Great Britain. Northern Ireland has equivalent regulations enforced by HSENI. It provides general information rather than legal advice.