PRiSMA (Psychosocial Risk Assessment and Management at the Workplace) is DOSH’s official 2024 framework for identifying and controlling psychosocial hazards — stress, excessive workload, poor job control, harassment, and similar risks — at the workplace. It is not a separate law, but it is DOSH’s recommended way of fulfilling the existing risk assessment duty under Section 18B of the Occupational Safety and Health Act 1994 (Act 514), which carries a fine of up to RM500,000 if ignored. In practice, PRiSMA runs through three stages and 11 steps: identify hazards using a 26-item questionnaire (LEO26), assess and prioritise risk, then manage, reassess and record it.
PRiSMA stands for Psychosocial Risk Assessment and Management at the Workplace. It is a set of guidelines issued by the Department of Occupational Safety and Health (DOSH) in 2024, developed with input from the Ministry of Health, academia, PETRONAS, PERKESO, NIOSH and other bodies, and aligned with ISO 45003:2021 (Occupational Health and Safety Management — Psychological Health and Safety at Work).
PRiSMA gives employers a standardised method to:
It applies to all places of work in Malaysia covered by Act 514 — public and private sector alike — and covers work-related psychosocial risk only; personal or non-work-related psychosocial issues are explicitly outside its scope.
Not by name, but effectively yes for most employers. Section 18B of Act 514 requires every employer, self-employed person or principal to carry out a risk assessment covering the safety and health risks their undertaking poses — and psychosocial hazards fall within that duty. Failing to carry out a risk assessment is an offence under Section 19, punishable by a fine of up to RM500,000.
PRiSMA is the methodology DOSH has published specifically for the psychosocial half of that risk assessment duty. DOSH also protects the people who carry it out: Section 28A prevents an employer from taking action against anyone who provides occupational health services, which the guidelines note may include running a PRiSMA programme.
The guidelines also reference ISO 45003:2021, an international standard for managing psychosocial risk within an ISO 45001 occupational health and safety management system — useful for organisations that are already ISO 45001-certified or working toward it.
PRiSMA runs as a continuous cycle rather than a one-off exercise, built around three stages and six broad components, which break down into 11 concrete steps. Every work unit in the organisation — including top and middle management — must be assessed separately; results are not simply combined across the whole company.
This stage collects data from employees using LEO26 — a validated, 26-item questionnaire covering three components: Job Control (JC), Work Demand (WD) and Job Support (JS) — and turns it into an organisational risk status.
| Step | What Happens |
|---|---|
| Step 1 | Distribute the LEO26 questionnaire to all employees in the targeted work unit. Announce the programme early to maximise the response rate. |
| Step 2 | Collect completed LEO26 forms from all respondents. Allow a reasonable time to reach 100%, or the highest achievable response rate. |
| Step 3 | Calculate each employee’s individual LEO26 score across the three components (JC, WD, JS). |
| Step 4 | Compare each individual’s score against the Risk Indicator Cut-off Value (RICoV) to flag them as high-risk or not, per component. |
| Step 5 | Total the number of employees with a high-risk score, per component, within each work unit. |
| Step 6 | Calculate what percentage of the work unit’s employees fall into the high-risk category, per component. |
| Step 7 | Compare that percentage against LEO26’s cumulative high-risk cut-off — 50% and above for Job Control, 25% and above for Work Demand and Job Support — to get the work unit’s final organisational psychosocial risk status (High or Low) for each component. |
If the organisational risk status for all three components comes back Low, the PTP does not need to proceed to Stage II — the work unit is reassessed on the reactive schedule described further below.
If any of the three components (JC, WD or JS) comes back High in Step 7, the assessment moves into Stage II, which checks what the employer is already doing about it.
| Step | What Happens |
|---|---|
| Step 8 | The PTP distributes the Employer Practice Checklist (EPC23) — 23 yes/no items covering existing controls — to the relevant work unit representative to complete. The PTP verifies the evidence behind every “Yes” answer. |
| Step 9 | Risk prioritisation: the PTP matches the high-risk LEO26 components against the “No” answers on EPC23 to identify which specific areas need action first. Where LEO26 shows high risk but the matching EPC23 item is marked “Yes”, priority still goes to the LEO26 finding — the PTP should flag this discrepancy to the employer directly rather than treat the checklist as conclusive. |
| Step | What Happens |
|---|---|
| Step 10 | The PTP draws up a Risk Management Plan of Actions using the PRiMA table, recommending specific control measures under one or more of seven themes (see below), and presents the findings and recommended actions to the employer. The completed report goes to the employer within 30 days of finishing the assessment. |
| Step 11 | Reassessment: work units with any high-risk component are re-evaluated after 12 months, or sooner if needed. Work units where every component came back Low are reassessed after two years, or sooner if needed (for example, after a major organisational change or a spike in complaints). |
Recordkeeping runs throughout: the employer must keep all PRiSMA records — LEO26 data, EPC23 checklists, the PRiMA action plan and reports — for at least seven years, or longer if a longer retention period applies, for DOSH audit and continuous improvement purposes. The PTP must handle this data in line with the Personal Data Protection Act 2010.
DOSH’s stated position is that a proactive approach — assessing before problems surface, rather than only after — is the most effective way to manage psychosocial risk. Employers taking a proactive approach typically start the PRiSMA cycle off the back of:
A purely reactive approach — waiting until problems show up — is what the 11-step process above is designed to move employers away from. Signs an organisation is stuck reacting rather than assessing proactively include:
There isn’t a standalone offence for skipping PRiSMA by name, but every employer already has a legal duty under Section 18B of Act 514 to carry out a risk assessment covering the risks their workplace poses — and psychosocial hazards are one of those risks. PRiSMA is DOSH’s recommended methodology for meeting that duty. Not conducting any risk assessment at all is what triggers the Section 19 penalty (fine up to RM500,000), not skipping PRiSMA specifically.
Yes — the guidelines don’t set a minimum headcount.
A PTP has to attend the relevant training and be registered with DOSH.
The guidelines don’t fix a duration for Steps 1–9 — it depends on how quickly employees return the LEO26 questionnaire — but Step 10 sets a firm deadline: the PTP must submit the final report to the employer within 30 days of completing the assessment.
Yes. LEO26 is distributed to every employee within each targeted work unit, not just a sample. Since individual scores are what determine the work unit’s organisational risk status, the guidelines expect the PTP and employer to aim for a 100% response rate, or the highest achievable, rather than sampling a portion of staff.
No. EPC23 is completed once per work unit, not by every manager individually — it’s filled in by a representative of that work unit. It also only comes into play if the work unit’s LEO26 results already show high risk on at least one component (Job Control, Work Demand or Job Support); work units that come back low-risk skip EPC23 entirely.
MESH employs multiple methods depending on the organisation. For large operations, this typically means physical townhalls or focus group sessions run in batches; alternatively, we can run online engagement sessions that guide respondents through LEO26 directly. Once a work unit’s results show high risk, EPC23 is completed by that work unit’s representative, with the PTP verifying the evidence behind every “Yes” answer before using it for risk prioritisation.
The PTP moves into Stage II (EPC23) and Stage III (the PRiMA action plan), and the affected work unit must be reassessed within 12 months. If none of the three components come back high-risk, the work unit is reassessed on a longer, two-year cycle instead.
No. The guidelines are explicit that PRiSMA is not a clinical diagnostic tool — it identifies workplace psychosocial risk factors, not individual mental health conditions. Where a case needs clinical attention, the guidelines expect the employer to refer it to the appropriate professional (doctor, counsellor, industrial psychologist, occupational therapist, etc.).
Yes. MESH houses its own Psychosocial Trained Person (PTP) and is able to carry out all the steps up to issuance of the PRiSMA report on your behalf. Get in touch for a PRiSMA quotation.