WHS Regulations & Risk Controls Checklist 2026 (Qld)
Most trade business owners already know the honest answer to a simple question: if a WHS inspector turned up on-site tomorrow, could every person on the crew show current, properly applied risk controls, or would someone be scrambling to find paperwork that should already be sorted.
WHS compliance for electrical and trade businesses isn't optional, and it never really was, but that doesn't mean it's simple either. Working out which regulations actually apply to a business your size, figuring out what risk controls need to be written down versus just done, and keeping track of who on the team still needs a current UEECD0007 can start to feel less like a compliance task and more like a second job nobody signed up for.
That's what this checklist is for. It breaks down what Queensland's 2026 WHS regulations actually require of a PCBU, walks through the hierarchy of risk controls the way it plays out on an electrical or trade site rather than the theory-only version, and puts it together into something practical enough to print off and hand to a site supervisor, or keep on file for the next audit.
No jargon dressed up as expertise, no box-ticking for the sake of it. Just what's needed, in the order it's needed.
What Are the WHS Risk Control Requirements in Queensland?
Under Queensland's Work Health and Safety Act 2011, a PCBU (person conducting a business or undertaking) is required to manage workplace risks through a four-step process:
Identify hazards. Anything on-site with the potential to cause harm. Electrical risks, manual handling, working at heights, whatever's specific to the job.
Assess the risks. Work out how likely each hazard is to cause harm, and how severe that harm could be.
Control the risks. Apply the hierarchy of controls, starting at elimination and working down through substitution, engineering controls, administrative controls, and PPE. PPE is the last stop, not the first.
Review control measures. Check regularly that what's in place is actually working, and update it when conditions on-site change.
PCBUs also have to consult with workers, provide proper training and instruction, and keep records of hazards, risk assessments, and the control measures put in place. That last part, the record-keeping, is usually where things fall apart for small operators. Not because anyone's being careless, but because nobody has time to document it properly when there's a job on.
Your 2026 WHS Obligations as a PCBU
What "PCBU" actually means, and why it applies even to a small operator
PCBU stands for person conducting a business or undertaking. That's every trade business owner, whether there are three people on the books or twenty, whether it's a sole trader with a couple of apprentices or multiple crews across different sites. There's no size cut-off where the obligations stop applying. It's a common assumption that WHS law is really aimed at large construction outfits with dedicated safety officers, and that smaller operators can worry about it properly once the business grows. That's backwards. Smaller operations are often more exposed, because there's no safety officer and no dedicated compliance person, just the owner trying to run the job and stay across the paperwork at the same time.
The primary duty of care under s.19 WHS Act 2011, in plain English
Section 19 of the WHS Act is the part that matters day to day. Stripped of the legal language, it comes down to this: a PCBU has to do what's reasonably practicable to keep workers, and anyone else affected by the work, safe from harm. That covers the obvious, like making sure equipment is safe and work areas are set up properly. It also covers things that get forgotten, like making sure workers actually know how to use equipment safely, that there are adequate facilities on-site, and that health and conditions are monitored where the work calls for it. "Reasonably practicable" means doing what a sensible operator in that position would do, not eliminating every conceivable risk regardless of cost or effort.
5 PCBU duties that can't be delegated away
Provide and maintain a safe work environment
Provide safe plant and structures, properly maintained
Ensure safe systems of work are used and followed
Provide adequate facilities and access to them
Provide the information, training, instruction, and supervision needed to work safely
Knowing the obligations is step one. Applying the right level of control once a risk is identified is where it actually gets used.
The Hierarchy of Risk Controls, Applied to Trade Work
The hierarchy of controls gets taught in every WHS course going, but on paper it can feel abstract. Applied to an electrical or trade site, it looks like this.
Elimination and substitution
Elimination means removing the hazard completely. On a trade site, that might mean doing work de-energized instead of live wherever that's genuinely possible, so the risk isn't managed, it's gone. Substitution is one step down, swapping something dangerous for something less dangerous, like using a lower-voltage tool for a job instead of one that requires higher voltage, or swapping a hazardous material for a safer alternative. These sit at the top of the hierarchy because they deal with the hazard itself, not just the exposure to it.
Engineering and isolation controls
This is where most electrical WHS practice actually lives day to day. Engineering controls change the way the work environment or equipment is set up so the hazard is contained or isolated rather than removed outright. Lockout and tagout procedures are the clearest example, physically isolating equipment and tagging it so nobody can re-energize it while someone's working on it. Done properly, these controls hold up well. Done half-heartedly, they're one of the biggest sources of near-misses, because people assume the tag alone is enough without the actual isolation process behind it.
Administrative controls and PPE
Administrative controls are things like safe work procedures, signage, training, and scheduling work to reduce exposure. PPE sits at the very bottom of the hierarchy, and that placement matters. PPE doesn't remove or reduce the hazard at all, it puts a barrier between the worker and a hazard that already exists. It's still necessary, but it's the last line of defense, not the first thing to reach for.
The common mistake: PPE as the primary control
A business hands out gloves, glasses, and hi-vis, ticks the PPE box, and calls the risk managed. It isn't. If PPE is doing all the work because nothing above it in the hierarchy has been properly applied, that's not a controlled risk, it's a risk being hoped against. An inspector will ask what controls sit above PPE before looking at the PPE itself.
Your 4-Step Risk Checklist
The same four-step process from earlier, broken out so it can be run against real hazards on a real site rather than read as theory.
Step 1: Identify. Walk the site, or think through the job, and write down anything with the potential to cause harm, electrical hazards, working at height, manual handling, plant and equipment, even fatigue or weather conditions where relevant. Don't filter at this stage, get it all down.
Step 2: Assess. For each hazard, work out how likely it is to cause harm, and how severe that harm would be. A hazard that's unlikely but catastrophic needs different treatment to one that's common but low-severity.
Step 3: Control. Apply the hierarchy of controls covered above. Start at elimination, work down. Document what's been put in place and why that level of control was chosen over the ones above it.
Step 4: Review. Controls aren't set-and-forget. Check that what's in place is actually working, not just sitting on paper. Review on a schedule, and review early if anything changes, new equipment, a near-miss, a change in the work itself.
Record-keeping: what gets asked for
This is usually the gap. Most small trade businesses handle risk management reasonably well operationally, they just don't write it down properly. An inspector or a principal contractor doing a pre-start check will want to see the hazard identified, the assessment behind it, the control chosen, and evidence it's been reviewed. If that trail doesn't exist on paper, it's treated as though the process never happened, even if it genuinely did.
When controls need reviewing
There's no single timeframe that covers every hazard, it depends on the risk and the work. As a general rule, review on a set schedule for lower-risk, ongoing hazards, and review immediately if new plant or equipment is introduced, there's a near-miss or incident, the way the work is done changes, or new workers come onto a task who haven't been through the existing controls.
Audit-ready in 4 steps
Hazards identified and written down, not just known
Risk assessed for likelihood and severity
Control measure chosen and documented, with the level noted
Review date set, and an early-review trigger list in place
This checklist covers ongoing practice. One part of crew compliance still needs to be formally certified, which is where UEECD0007 fits in.
Where UEECD0007 Fits Into Your Compliance Picture
Everything above is about the ongoing practice of managing risk on-site. UEECD0007 is different, it's the formal, certified competency that sits underneath all of it. It's the unit that confirms someone on the crew actually understands WHS regulations and risk control application in an electrical context, not just that the business has a process written down somewhere.
→ Understanding UEECD0007: What You Actually Need
Get this right and compliance stops being a cost center, it becomes something to put in front of a principal contractor with confidence.
Turning Compliance Into a Tender Advantage
Most business owners treat WHS compliance as defensive, something sorted so nothing goes wrong and nobody comes after the business. That's true, but it's only half the picture. Done properly, a compliance file is something to put in front of a principal contractor and use to win work, not just to avoid losing it.
What principal contractors actually check
Before a principal contractor signs off on bringing a business onto a site, they're checking more than whether a WHS policy exists somewhere. They want current certifications for everyone who'll be on-site, evidence of an actual risk management process rather than a template downloaded once and never touched again, and a record showing controls have been reviewed, not just written once and forgotten. Businesses that can produce this without a scramble stand out immediately, because most can't.
Packaging it into a tender-ready file
This doesn't need to be complicated. Take the four-step checklist above, keep it current for each active job or site, and file it alongside current UEECD0007 certificates for the crew. When a tender or a principal contractor's pre-start pack asks for evidence of WHS compliance, that's something real to hand over, not something assembled under deadline pressure the night before.
What this looks like in practice
Picture a trade business chasing commercial work through a principal contractor, competing against a business with similar pricing. One hands over a compliance file with current certificates, documented risk assessments, and a clear review history. The other says it'll sort the paperwork out once it's on-site. It isn't hard to guess which one gets the call back.
Not sure if the current controls would hold up under that kind of scrutiny?
A compliance check is available on request, no obligation, just a straight answer on where things actually stand.
Conclusion
Running a trade business already means juggling more than most people outside the industry ever see, quotes, scheduling, materials, staff, and somewhere in amongst all that, WHS compliance that can't sit on the backburner until an inspector or a principal contractor asks for it. The four-step process covered here, identify, assess, control, review, isn't complicated in theory. What trips most small operators up isn't understanding it, it's keeping it documented and current while the job in front of them takes priority.
The hierarchy of controls matters more than most businesses give it credit for, mainly because PPE gets treated as the whole answer when it was only ever meant to be the last piece of it. Getting the levels above PPE right, elimination, substitution, engineering and isolation controls, administrative measures, is what actually keeps a crew safe and what actually holds up when someone asks for proof.
None of this needs to be a second job on top of running the business. A checklist that gets printed, a review schedule that's actually followed, and current certification for the people who need it, UEECD0007 included, covers most of what any business will ever be asked to produce. The businesses that struggle aren't the ones with worse safety practices, they're usually the ones that never wrote any of it down.
There's also a version of this where compliance stops being purely defensive. A file that's genuinely current and ready to hand over without a scramble is something a principal contractor notices, and in a competitive tender environment, that noticing translates directly into work. Two businesses with similar pricing rarely end up with similar outcomes if one can prove its house is in order and the other can't.
None of this needs to wait for an audit date or a tender deadline to force the issue. The businesses that stay ahead of it treat the checklist as something to run through now, not something to assemble under pressure once someone's already asking for it.
Anyone still unsure where their crew actually stands can start with the checklist download, no commitment, just something concrete to work from. A compliance review is available for anyone who'd rather talk it through directly.
