What is PRisMA 2024?

A plain explanation of the DOSH guideline, written for the person who has just been told it is their job.

PRisMA 2024 is the Guidelines on Psychosocial Risk Assessment and Management at the Workplace, published by DOSH, Malaysia's Department of Occupational Safety and Health. It sets out how employers should assess and manage psychosocial risk: the features of work design, organisation and management that can harm employees' mental health.

Is PRisMA 2024 law?

The guideline itself is guidance, but the duty behind it is law. Section 18B of the Occupational Safety and Health Act 1994, as amended in 2022, requires employers to assess risks to safety and health at the workplace, and psychosocial risk falls within that duty. Penalties reach RM500,000, imprisonment of up to 2 years, or both.

In practice, PRisMA 2024 is the reference DOSH uses for how a psychosocial risk assessment should be done. Following it is the defensible way to discharge the duty. The guideline is aligned with ISO 45003:2021, the international standard for psychological health and safety at work.

What the guideline asks employers to do

  • Assess by work unit. Risk is assessed separately for each work unit, including management, because a warehouse night shift and a finance team do not carry the same pressures.
  • Screen employees privately with LEO26. Employees complete LEO26, the guideline's 26 item screening questionnaire, which scores job control, work demand and job support. Results are consolidated by work unit and read against the guideline's cut off values, never reported individually.
  • Verify existing controls with EPC23. Where a unit returns high risk, the employer's work unit representative completes EPC23, the 23 point Employer Practice Checklist, and the evidence behind each answer marked yes is verified.
  • Act on findings. LEO26 and EPC23 are matched to build the PRiMA plan, the Psychosocial Risk Management Plan of Actions, drawing on prescribed actions across 7 themes: social support, working environment, job matching, training and education, transparency and fairness, control, and workload. Where the 2 instruments disagree, priority goes to the LEO26 component scoring high risk.
  • Keep records and reassess. Reports go to the audit file, the employer retains records for at least 7 years, and reassessment runs every 12 months where risk is high, otherwise every 2 years.

Who conducts the assessment?

The guideline provides for a Psychosocial Trained Person, a PTP, to conduct and manage the assessment. The PTP runs the screening, verifies the employer's controls, prepares the action plan, signs the report and maintains the records. Our assessments are run by a registered PTP.

Does the assessment diagnose anyone?

No. PRisMA looks at work design and organisational risk factors such as workload, control, support and workplace relationships. It is not a clinical or diagnostic tool, it does not assess any individual's mental health, and individual answers are never shown to the employer.

What to do next

If you want the whole thing in one document, the free 28 page PRisMA guide covers the regulation, 5 industry hazard profiles, 3 checklists and a 90 day plan. If you have never run an assessment, start with the free gap check to see the size of your gap. If you are planning budget, prices are published and banded by headcount. If DOSH has already issued a directive, go straight to directive response.

Last reviewed 28 August 2026. Regulatory references: Occupational Safety and Health Act 1994 (Act 514), Section 18B; DOSH Guidelines on Psychosocial Risk Assessment and Management at the Workplace (2024); ISO 45003:2021.