Is PRisMA Mandatory for Malaysian Employers under DOSH and OSHA 2022?

Short answer: mandatory duty vs PRisMA guideline

Malaysian employers, self-employed persons and principals have a statutory duty under the Occupational Safety and Health Act 1994 (as amended by Act A1648 / OSHAA 2022; in force 1 June 2024), section 18B, to conduct a risk assessment (shall, per s.18B) in relation to the safety and health risk posed to any person who may be affected by their undertaking at the place of work, and to implement such controls where assessment shows risk control is required (shall implement).

Contravention of section 18B is an offence under section 19: on conviction, liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both. (Note: the DOSH PRisMA Guidelines section 08.1 Legislations box restates the fine limb only; the Act wording above includes the imprisonment provision.)

PRisMA 2024 is the Department of Occupational Safety and Health (DOSH) Guidelines on Psychosocial Risk Assessment and Management at the Workplace — the published framework for screening, assessing and managing workplace psychosocial risks using tools such as LEO26 (Stage I) and EPC23 (Stage II), with assistance from a Psychosocial Trained Person (PTP). The guidelines state that they "are to be adopted by employers and employees as a guide"; employers "shall" assess as stipulated in the Act and "should" appoint a Psychosocial Trained Person (PTP) to assist with PRisMA; places of work are also "encouraged to adopt and implement" PRisMA.

So: assessing and controlling relevant safety and health risk is mandatory; "PRisMA by brand name" is the DOSH method, not a separately worded offence in the Act. PRisMA is organisational, preventative and non-clinical — DOSH: "not a clinical diagnostic tool." Wellness surveys, Employee Assistance Programme (EAP) access or resilience training do not replace the assessment-and-action record.

Element	Status	Source
Risk assessment at place of work	Shall (mandatory)	OSHA 1994 s.18B
Implement controls where required	Shall (mandatory)	OSHA 1994 s.18B
PRisMA 2024 guideline framework	Adopted as a guide; encouraged	DOSH Guidelines §09.1, Preface
Appoint a Psychosocial Trained Person (PTP)	Should (recommended)	DOSH Guidelines §09.2

What OSHA 1994 (amended 2022) actually requires

The Occupational Safety and Health Act 1994 (Act 514), as amended by the Occupational Safety and Health (Amendment) Act 2022 (Act A1648), which came into operation on 1 June 2024, imposes the following duties:

Section 18B(1): "Every employer, self-employed person or principal shall conduct a risk assessment in relation to the safety and health risk posed to any person who may be affected by his undertaking at the place of work."

Section 18B(2): "Where a risk assessment indicates that risk control is required to eliminate or reduce the safety and health risk, the employer, self-employed person or principal shall implement such control."

Section 18B(3): "For the purposes of this section, 'risk assessment' means the process of evaluating the risks to safety and health arising from hazards at work and determining the appropriate measures for risk control."

The Act also states in section 4(c) that one of the objects of the Act is "to promote an occupational environment for persons at work which is adapted to their physiological and psychological needs." This framing provision shows that psychological needs are within scope, but the Act text does not use the words "psychosocial" or "PRisMA" in section 18B itself.

The duty applies to employers, self-employed persons, and principals at places of work in Malaysia. Certain industries and workplaces listed in the First Schedule of OSHA 1994 are excepted. Consult the Act or legal counsel for your specific context.

What the DOSH PRisMA 2024 Guidelines add

The Department of Occupational Safety and Health published the Guidelines on Psychosocial Risk Assessment and Management at the Workplace 2024 to provide employers with guidance on how to screen, assess and manage psychosocial risks at work. The guidelines cover workplace psychosocial risks — not non-work-related personal factors.

Guideline scope (section 09.1): "These guidelines are to be adopted by employers and employees as a guide for the assessment and management of psychosocial risks in the workplace."

Preface: "All places of work are encouraged to adopt and implement PRisMA as an effective tool…"

Employer roles (section 09.2): "Employers shall conduct risk assessments as stipulated in the Act. They also should appoint Psychosocial Trained Person (PTP) to assist them to conduct PRisMA assessment."

Case Study 4: The guidelines note that employers with established programmes that are "on par with PRisMA" can "continue the existing practice OR may choose to adopt these guidelines."

So the guideline language is clear: PRisMA is the DOSH method for discharging the statutory duty for psychosocial risk; it is not a separate named offence. The assessment duty is mandatory; PRisMA by name is not.

Is appointing a PTP compulsory?

The guidelines state that employers should appoint a Psychosocial Trained Person (PTP) to assist them to conduct PRisMA assessment — "should," not "shall." However, appointing a current DOSH-certified PTP is the audit-defensible path. A PTP:

• Assists with identifying hazards, assessing existing controls, prioritising risk, managing risks, reassessing, presenting findings, and maintaining records (DOSH Guidelines section 09.4);
• Must maintain the confidentiality of all information and perform their duties with integrity;
• Maintains confidentiality under the Personal Data Protection Act (PDPA) 2010;
• Follows structured screening and assessment protocols (LEO26 / EPC23) and provides a defensible record for DOSH inspection.

While the guideline uses "should," the practical question is whether you want a defensible PRisMA record if DOSH inspects. A current PTP number on the report is that defensible record.

What happens if employers ignore risk assessment (section 19)

The Occupational Safety and Health Act 1994, section 19, states:

"A person who contravenes the provisions of section 15, 16, 17, 18, 18A or 18B shall be guilty of an offence and shall, on conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both."

Note that the DOSH PRisMA 2024 Guidelines section 08.1 Legislations box restates the fine limb only (not exceeding five hundred thousand ringgit). The Act wording above includes the imprisonment provision (or to imprisonment for a term not exceeding two years or to both).

This is the factual penalty framing from the statute. Boards should be briefed on this accurately — not as a scare tactic, but as the legal context for why psychosocial risk assessment is budgeted as a statutory OSH duty, not an optional wellness programme.

Who should run PRisMA (Psychosocial Trained Person)

A DOSH-certified Psychosocial Trained Person (PTP). Not every safety officer, and not a generic wellness vendor. The person who signs the report holds a current PTP number.

For this practice, Dr. Elijah Ting — drelijah.org, Sibu, Sarawak — holds registration PTP/ASV-053/26. He conducts Stage I (LEO26) and, where indicated, Stage II (EPC23) himself for Malaysian employers under OSHA 1994 as amended 2022. This is organisational, preventative, non-clinical occupational safety and health work.

What employers get: screening, assessment, system-level classification, a written PRiMA Action Plan, and the 12-month re-evaluation the duty requires — one accountable PTP from start to follow-up. See PRisMA OSH Compliance for delivery detail.

How a defensible cycle looks

A defensible PRisMA cycle under the DOSH guidelines follows these stages:

• I Stage I screening — LEO26
  Employee screening across work units by Job Content (JC), Work Demand (WD), and Job Support (JS). Risk is seen by the way work is organised, not only by individual complaint.
• II Stage II assessment — EPC23 (if required)
  If any LEO26 organisational risk component is high, the PTP proceeds with the employer-practice checklist (EPC23): what the organisation actually does, not what the policy binder claims.
• III System-level classification
  Risk is classified where it belongs — the unit, the design of the work, the way people are led — so action is not dumped on the individual.
• IV PRiMA Action Plan
  A written, defensible plan of controls and follow-through. The PTP should submit the report to the employer within 30 days (per DOSH guidelines Step 10).
• V Reassessment
  If any LEO26 component is high-risk: re-evaluate after 12 months or when needed. If none high: reassess according to reactive criteria after two years or when needed.

Records must be kept for at least seven (7) years or whichever is longer for DOSH audit purposes.

For a detailed explanation of how the cycle runs in practice, see the PRisMA OSH Compliance page.

What does not satisfy the duty

The following do not satisfy the statutory assessment-and-control duty under section 18B, even though they may be valuable in other ways:

• Wellness survey / score-only questionnaire — A survey that produces a score and no action will not carry an audit, and it will not carry the people who filled it in.
• Employee Assistance Programme (EAP) alone — EAP provides individual support and counselling; PRisMA is organisational risk assessment and control. EAP may sit beside PRisMA; it does not replace it.
• Resilience workshop alone — Team capability training does not replace the statutory assessment-and-action record. Leadership and resilience programmes (such as Earned Leadership or Workplace Resilience) may sit beside PRisMA as part of an organisation's broader psychosocial risk controls; they do not replace the duty.
• Clinical counselling mistaken for OSH record — PRisMA is not a clinical diagnostic tool (DOSH guidelines). It is not clinical psychological therapy, psychiatric evaluation, or medical counselling. It is preventative, organisational, occupational safety and health work.

Frequently asked questions

Is PRisMA itself mandatory, or only the risk assessment?

The duty under OSHA 1994 section 18B is mandatory: employers, self-employed persons, and principals shall conduct a risk assessment and shall implement controls where required. PRisMA 2024 is the Department of Occupational Safety and Health (DOSH) guideline framework for psychosocial risk assessment. The guidelines "are to be adopted… as a guide"; employers "shall" assess as stipulated in the Act and "should" appoint a Psychosocial Trained Person (PTP) to assist with PRisMA; places of work are "encouraged to adopt and implement" PRisMA. Case Study 4 in the DOSH guidelines notes that programmes "on par with PRisMA" may continue or adopt these guidelines.

What is the penalty if we skip psychosocial / safety-and-health risk assessment?

Under the Occupational Safety and Health Act 1994, section 19: A person who contravenes section 18B shall be guilty of an offence and shall, on conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both. The DOSH PRisMA Guidelines section 08.1 Legislations box restates the fine limb only.

Must we appoint a Psychosocial Trained Person (PTP)?

The DOSH guidelines state that employers should appoint a Psychosocial Trained Person (PTP) to assist them to conduct PRisMA assessment. While the guideline uses "should" rather than "shall," appointing a current DOSH-certified PTP is the audit-defensible path. A PTP maintains confidentiality under the Personal Data Protection Act (PDPA) 2010, follows structured screening and assessment protocols, and provides a defensible record for DOSH inspection.

Who does this apply to — SMEs? Public sector? Principals?

The duty under section 18B applies to every employer, self-employed person, or principal at the place of work in Malaysia in accordance with OSHA 1994. The DOSH PRisMA guidelines apply to "places of work in Malaysia." Certain industries and workplaces listed in the First Schedule of OSHA 1994 are excepted. Consult the Act or legal counsel for your specific context.

Is Stage II (EPC23) always required?

No. Stage II (EPC23) is triggered when Stage I (LEO26) shows that organisational risk status is high in any of the three components: Job Content (JC), Work Demand (WD), or Job Support (JS). If none of those components is high, the employer should reassess according to reactive criteria after two years or when needed. Stage II is not automatically required for every employer or work unit.

Does an Employee Assistance Programme (EAP) satisfy the duty?

No. An EAP provides individual support and counselling; PRisMA is organisational risk assessment and control. DOSH PRisMA guidelines are clear that PRisMA is used to identify workplace psychosocial risk factors or hazards, not to assess non-work-related or personal factors. EAP may sit beside statutory psychosocial risk work; it does not replace the assessment-and-control record required under section 18B.

Can wellness or resilience training replace PRisMA?

No. Wellness surveys, resilience workshops, and team capability training do not replace the statutory assessment-and-action record. They may sit beside PRisMA as part of an organisation's broader psychosocial risk controls, but they do not satisfy the duty under section 18B to conduct a risk assessment and implement controls where required.

Is PRisMA a mental-health diagnosis or clinical tool?

No. The DOSH guidelines state clearly: PRisMA is not a clinical diagnostic tool. It is used to identify workplace psychosocial risk factors or hazards. PRisMA is preventative, organisational, and non-clinical occupational safety and health work — not clinical psychological therapy, psychiatric evaluation, or medical counselling.

Next step

If your board needs a defensible psychosocial risk record — not a wellness score — start with a 30-minute scoping call. We will confirm whether the statutory PRisMA cycle is the right next step, and what Stage I vs Stage II would look like for your work units.

Book a scoping call or email via contact page.

Delivery context: PRisMA OSH Compliance (Dr. Elijah Ting, PTP/ASV-053/26, Sibu, Sarawak).

Disclaimer: This page is an informational occupational safety and health explainer. It is not legal advice. For legal advice specific to your organisation's facts and circumstances, consult legal counsel. The primary sources cited are the Occupational Safety and Health Act 1994 (Act 514) Reprint, Version 1.6.2024, and the DOSH Guidelines on Psychosocial Risk Assessment and Management at the Workplace 2024.