PRisMA DOSH Explained: How Employers Assess Psychosocial Risk

PRisMA is the Department of Occupational Safety and Health (DOSH) framework that Malaysian employers use to screen, assess and control psychosocial risks such as workload, low job control and poor support. It is set out in the Guidelines on Psychosocial Risk Assessment and Management at the Workplace 2024 and supports the risk assessment duty under OSHA 1994.

This guide explains what the PRisMA DOSH process involves, who it applies to, the legal basis, the 11 steps in the guideline, the records you need to keep and the mistakes that most often weaken an assessment.

What is PRisMA under DOSH?

PRisMA stands for Psychosocial Risk Assessment and Management at the Workplace. DOSH, under the Ministry of Human Resources, published the Guidelines on Psychosocial Risk Assessment and Management at the Workplace (PRisMA) 2024 to help employers screen for work-related psychosocial risks, choose control measures and standardise how they record and monitor psychosocial health at work.

A psychosocial risk is the chance that the way work is designed, organised or managed harms a worker's mental or physical health. Typical hazards include excessive workload, unrealistic deadlines, unclear roles, low autonomy, conflict with supervisors, bullying, harassment and long or inflexible hours.

PRisMA focuses on work-related risk only. Problems that arise purely outside work, such as a family bereavement, fall outside its scope, although a good employer will still offer support for them through an Employee Assistance Programme.

Is PRisMA mandatory for employers in Malaysia?

The guideline itself is guidance, but the duty behind it is law. Section 18B of the Occupational Safety and Health Act 1994 (Act 514), introduced by the Occupational Safety and Health (Amendment) Act 2022, requires employers to carry out a risk assessment of the safety and health risks at work and to put controls in place where the assessment shows they are needed. The PRisMA guideline notes that breaching section 18B is an offence carrying a fine of up to RM500,000.

At the MEF OSH Conference in May 2026, DOSH deputy director-general (Occupational Health) Ahmad Jailani Mansor described psychosocial risk assessment under section 18B as a statutory responsibility for employers, according to the New Straits Times. In August 2026, DOSH Director-General Hazlina Yon told The Star that the department could consider enforcement action under Act 514 where an employer fails to act on complaints or to manage psychosocial risks.

In practical terms, an HR leader should treat PRisMA as the expected method for showing DOSH that psychosocial hazards have been assessed and controlled, in the same way a HIRARC shows that physical hazards have been assessed.

Who does PRisMA apply to?

The guideline applies to all places of work in Malaysia covered by OSHA 1994, including the public services and statutory authorities, apart from the work listed in the First Schedule of the Act. This wide coverage follows the 2022 amendment, which came into force on 1 June 2024, as the Ministry of Human Resources confirmed in a statement reported by Malay Mail.

That means PRisMA is not limited to factories, construction or other high-hazard sectors. Offices, banks, hospitals, retailers, shared service centres and technology firms are all in scope. DOSH has said that psychosocial risk can occur in all sectors, and that the public service sector has recorded the highest number of psychosocial-risk complaints it has received.

Within the organisation, the guideline sets out three groups of responsibility:

• Employers must carry out the assessment and act on the findings.
• A Psychosocial Trained Person (PTP) should be appointed to run the assessment, keep all information confidential and report to the employer.
• Employees must cooperate with the assessment and report psychosocial issues to the employer.

What tools does the PRisMA guideline use?

PRisMA relies on two main instruments, used in sequence.

LEO26 employee questionnaire

LEO26 is a 26-item screening questionnaire completed by employees in the targeted work units. It scores three components: Job Control, Work Demand and Job Support. Each individual score is compared against cut-off values to flag people at high risk, and the results are then rolled up by work unit and for the whole organisation.

EPC23 employer practice checklist

EPC23 is a 23-point Employer Practice Checklist completed by a work unit representative. It reviews the controls already in place and is used when LEO26 shows a high-risk result. Matching the two tools tells you where risk is high and current practice is weak, which is where action should start.

Plan of actions and reporting form

The guideline also provides a Psychosocial Risk Management Plan of Actions table, with themes such as social support, working environment, job matching, training and education, transparency and fairness, and control and workload. A standard PRisMA Reporting Form is included in the appendices.

How do you carry out a PRisMA assessment step by step?

The guideline arranges the process into three stages and 11 steps. Here is how they work in practice.

Stage I: hazard identification

1. Distribute LEO26 to all employees in the targeted work units, with a clear briefing on confidentiality.
2. Collect LEO26 from all respondents within a fixed window, usually a few working days.
3. Calculate each individual score for Job Control, Work Demand and Job Support.
4. Identify individuals with high-risk status against the cut-offs, handled only by the PTP.
5. Total the high-risk individuals by work unit to see where risk clusters.
6. Calculate the organisational psychosocial risk score for each component.
7. Determine the organisational psychosocial risk status using the organisational cut-offs in the guideline.

Stage II: risk assessment

Steps 8 and 9 test whether current controls are adequate.

• Step 8, assess current practice with EPC23 where LEO26 shows high risk.
• Step 9, prioritise risk by matching LEO26 results against EPC23 findings.

Stage III: risk control

Steps 10 and 11 turn findings into action and set the review cycle.

• Step 10, prepare a risk management plan of actions, split into short-term actions (1 to 6 months) and long-term actions (12 months).
• Step 11, reassess. If any LEO26 component is high risk, re-evaluate after 12 months or sooner if needed. If none is high risk, reassess after two years or when a reactive trigger occurs.

Record keeping runs across all three stages and is the sixth component of the framework.

What documents should employers keep for PRisMA?

DOSH auditors will look for evidence that the process was followed and that findings led to action. Use this checklist to prepare your file:

• Letter or record appointing the Psychosocial Trained Person.
• Scope note listing the work units assessed, headcount invited and response rate.
• Employee briefing materials, including the confidentiality statement.
• Aggregated LEO26 results by work unit and for the organisation (never named individual results in HR files).
• Completed EPC23 checklists for high-risk units.
• The PTP's assessment report, which the guideline says should reach the employer within 30 days.
• The plan of actions, with owners, deadlines and budget.
• Minutes showing the safety and health committee reviewed the findings.
• Evidence of completed actions, such as training records, revised job descriptions or new workload policies.
• The reassessment schedule and results.

The guideline asks employers to keep these records for at least seven years, and to protect confidentiality in line with the Personal Data Protection Act 2010.

How does PRisMA relate to ISO 45003?

ISO 45003:2021 is the international standard giving guidance on managing psychological health and safety within an occupational health and safety management system. The PRisMA guideline references it. ISO 45003 sets the broad management approach, while PRisMA gives Malaysian employers a specific, scored method with defined tools and cut-offs.

Organisations certified to ISO 45001 can fold PRisMA results into their existing hazard register, management review and internal audit cycle. That avoids running psychosocial risk as a separate HR project that never reaches the safety committee.

What are the most common PRisMA mistakes?

Most weak assessments fail for predictable reasons. Watch for these:

• Treating it as a survey, not a risk assessment. Collecting LEO26 scores without EPC23, a plan of actions and a reassessment date does not complete the process.
• Breaking confidentiality. If managers can see who scored high risk, response quality drops and trust suffers. Keep individual data with the PTP.
• Low response rates. A rushed rollout with no briefing leaves gaps in high-risk teams. Brief people first and give them protected time to respond.
• Only offering individual fixes. Wellness talks help, but if Work Demand is high the control has to change the work itself, such as staffing, deadlines or approval layers.
• No owner or budget. Every action needs a named owner and a date, or it will stall.
• Ignoring complaints between assessments. DOSH has said it may act where employers fail to respond to worker complaints. A clear grievance route matters as much as the survey.

How can HR turn PRisMA findings into action?

The plan of actions should match controls to the component that scored high. A simple way to build it:

• High Work Demand: review headcount against volume, set realistic deadlines, cut duplicate reporting and agree response-time norms for after-hours messages.
• Low Job Control: give teams more say in scheduling and task order, and push routine decisions closer to the work.
• Low Job Support: train managers to spot distress and respond well, build peer support and make confidential counselling easy to reach.

Where your team lacks a trained assessor, ThoughtFull's DOSH-compliant PRisMA psychosocial risk assessment runs the LEO26 and EPC23 process with a certified assessor, keeps submissions away from HR and delivers a formal report with prioritised recommendations. It is designed to support OSHA 1994 and ISO 45003.

Support controls then need to be in place. Many employers pair PRisMA with Mental Health First Responders at Work training, which is HRD Corp claimable, and with an EAP in Malaysia so that employees flagged as high risk can reach a counsellor quickly. Outside Malaysia, the Organisational Mental Wellness Assessment gives regional teams an anonymised baseline using PHQ-2, GAD-7 and the Edmondson psychological safety scale.

For broader context on why psychosocial risk is a leadership issue, see our article on psychological safety at work.

What should HR do next?

Start with three moves this quarter: appoint or contract a Psychosocial Trained Person, choose the work units for your first LEO26 round and put PRisMA on the agenda of your next safety and health committee meeting. That gives you a defensible start before the next DOSH audit and a clear picture of where your people are under strain.

If you would like help scoping your first assessment and the support that follows, book a demo with ThoughtFull and our team will walk you through the process.