PRisMA psychosocial risk assessment for Malaysian employers
A statutory duty, handled by a wellness partner rather than a report writer. We run the full PRisMA 2024 cycle with a registered Psychosocial Trained Person, deliver your report within 30 days, and then help you act on what it finds.
What Malaysian employers are required to do
Section 18B of the Occupational Safety and Health Act 1994, as amended in 2022, requires employers to conduct risk assessments covering risks to safety and health at the workplace. Psychosocial risk is part of that duty. Penalties reach RM500,000, imprisonment of up to 2 years, or both.
DOSH published the Guidelines on Psychosocial Risk Assessment and Management at the Workplace, known as PRisMA 2024, setting out how the assessment should be conducted. The guideline is aligned with ISO 45003:2021, the international standard for psychological health and safety at work.
The duty applies across sectors and sizes. It is not limited to large employers or to specific industries. New to the guideline? Start with what PRisMA 2024 actually says.
The 2 instruments: LEO26 and EPC23
LEO26 is the PRisMA psychosocial risk assessment tool, the Likelihood of Environment and Occupational Exposure Scale towards Psychosocial Risk in the Workplace. It is a 26 item screening questionnaire, guided by International Labour Organisation documents and aligned with ISO 45003:2021. Employees complete it privately. Its items score 3 components, Job Control, Work Demand and Job Support, and a cut off value decides whether each is high or low risk once scores are consolidated by work unit.
EPC23 is the Employer Practice Checklist, 23 points on what the employer already does about psychosocial risk. Your work unit representative completes it, not your employees, and it is only required where LEO26 returns high risk. The PTP confirms the evidence behind every answer marked yes. Every no becomes an input to the action plan.
They work together. LEO26 finds where the risk is, EPC23 measures what is already in place against it. Where they disagree, the guideline is explicit: priority goes to a LEO26 component scoring high risk, even where the matching EPC23 answers look satisfactory. A written policy nobody follows does not close the gap.
Matching the 2 produces the PRiMA plan, the Psychosocial Risk Management Plan of Actions, which sets prescribed actions across 7 themes: social support, working environment, job matching, training and education, transparency and fairness, control, and workload. Actions are categorised short term, 1 to 6 months, and long term, 12 months.
How a PRisMA assessment runs
Scope by work unit
Every work unit is assessed separately, including management, because pressure is rarely distributed evenly across a business.
Screen your employees with LEO26
The 26 item questionnaire, completed privately. We run it in English, Bahasa Malaysia, Bahasa Indonesia, Mandarin, Cantonese, Tamil, Nepali and Bengali, on mobile, on shared kiosk tablets, or on paper where a workforce has no devices.
Score and identify risk levels
Results are consolidated by work unit and scored against the guideline's cut off values for job control, work demand and job support. Individual answers are never shown to the employer.
Review your existing practices with EPC23
Where a work unit returns high risk, your representative completes the 23 point Employer Practice Checklist, and our PTP verifies the evidence behind each answer marked yes.
Build the PRiMA action plan
LEO26 and EPC23 are matched, and findings drawn against the guideline's prescribed actions across 7 themes, then prioritised.
Report within 30 days
Signed by the PTP, in the required format, ready for your DOSH audit file.
Reassess
Every 12 months where risk is high, otherwise every 2 years. The employer retains records for at least 7 years.
Most providers stop at the report
An assessment tells you that workload is a problem in your night shift, or that support is weak in your warehouse. It does not fix either.
The action plan prescribes what should happen next: training and education, better social support, manager communication, psychosocial support for employees with mental health conditions. Those are the things we do every day.
So the report is not the end of our engagement. It is the point at which we know exactly what your workplace needs, and can put it in place, with the training component claimable through HRD Corp.
At the next reassessment, you can see whether it worked.
Your people will not be identified. Ever.
Individual responses are never shown to the employer. Results are only ever reported at work unit level, and no unit is reported at all if it is too small to protect anonymity.
If someone's answers suggest they are struggling, they see a private route to support at the end of the questionnaire. That is between them and the care team.
This is not only a legal position under PDPA. It is the reason people answer honestly, which is the reason the assessment is worth anything. Read more on our trust and data privacy page.
Frequently asked questions
Is a psychosocial risk assessment compulsory in Malaysia?
Employers have a statutory duty to assess workplace risks under Section 18B of the Occupational Safety and Health Act 1994. PRisMA 2024 is the DOSH guideline setting out how psychosocial risk should be assessed and managed.
What is the penalty for not doing it?
Non compliance with the risk assessment duty carries a fine of up to RM500,000, imprisonment of up to 2 years, or both.
What are LEO26 and EPC23?
LEO26 is the 26 item questionnaire employees complete privately, scoring job control, work demand and job support. EPC23 is the 23 point Employer Practice Checklist your own representative completes, required only where LEO26 returns high risk. More in what PRisMA 2024 actually says.
Who can conduct the assessment?
The guideline provides for a Psychosocial Trained Person to conduct and manage the process, verify the employer's existing controls, prepare the action plan and maintain records.
How long does it take?
We deliver the signed report within 30 days of completing fieldwork. Where you are working to a DOSH deadline, our expedited service starts fieldwork within 72 hours and reports within 14 days.
Does it diagnose employees?
No. The assessment looks at work design and organisational risk factors. It is not a clinical or diagnostic tool, and it does not assess any individual's mental health.
What does it cost?
Prices start at RM4,500 and are published in full on our pricing page, banded by headcount.
Last reviewed 28 August 2026. Regulatory references: Occupational Safety and Health Act 1994 (Act 514), Section 18B; DOSH Guidelines on Psychosocial Risk Assessment and Management at the Workplace (2024), paragraphs 9.5 and 10.3; ISO 45003:2021.
Know where you stand before DOSH asks
Take the free gap check, or see published pricing banded by headcount. High exposure sector? Start with manufacturing. Prefer to read first? The free 28 page PRisMA guide covers the duty, the instruments and a 90 day plan.
