"Duty of care" is one of those phrases that everybody uses and almost nobody defines. In an Australian workplace it has a precise meaning, and the precision is in the qualifier rather than the duty.
The duty is to ensure health and safety so far as is reasonably practicable. Not absolutely. Not as far as possible. Not as far as is affordable. Reasonably practicable — which section 18 of the Work Health and Safety Act defines in five parts.
The five-part test
To work out what is reasonably practicable, you weigh, at the relevant time:
- The likelihood of the hazard or the risk occurring.
- The degree of harm that might result if it does.
- What the person concerned knows, or ought reasonably to know, about the hazard or risk, and about ways of eliminating or minimising it.
- The availability and suitability of ways to eliminate or minimise the risk.
- After assessing the extent of the risk and the available ways of eliminating or minimising it, whether the cost of doing so is grossly disproportionate to the risk.
Read the fifth one again, because the drafting is doing something specific. Cost is not one of five equal considerations. It is explicitly sequenced after the risk and the available controls have been assessed, and the threshold is not "expensive" — it is grossly disproportionate.
That is a very high bar. A control that costs a lot but is proportionate to a risk of death is reasonably practicable. A control that costs a modest amount and addresses a trivial risk may not be. The comparison is always to the risk, never to the budget.
Why the order matters more than the list
Most organisations can recite the five factors. Far fewer apply them in order, and the order is where enforcement action tends to land.
The common failure looks like this: somebody proposes a control, somebody else asks what it costs, and the number ends the conversation. No assessment of likelihood was written down. No assessment of the degree of harm. No survey of what else was available. The risk was never quantified, so there is nothing for the cost to be disproportionate to.
When that sequence is reconstructed in an investigation, it reads as a business decision dressed as a safety decision. The record that would have helped — a written consideration of the risk, the options and why one was chosen — was never made.
The inverse is surprisingly strong evidence. An organisation that assessed a risk properly, considered three controls, adopted the second because the first was genuinely unsuitable, and wrote that down at the time is in a good position even if the outcome was bad. Reasonably practicable is judged at the relevant time, on what was knowable then.
"Ought reasonably to know" is the factor that moves
The third factor is the one that changes underneath you.
You are held to what you know and what you ought reasonably to know. That second half tracks the state of industry practice. When a control is novel and unproven, not using it is defensible. When it appears in a code of practice, is sold by several suppliers, is discussed at every industry conference and is used by your competitors, the position has moved — whether or not anyone wrote to tell you.
For contractor management specifically, this is not theoretical. Verifying a worker's competency against the task and the site, rather than accepting a declaration, has moved from a leading practice to an expected one over the last decade. So has holding equipment to the same standard as people. An operator arguing in 2026 that checking was impractical is arguing against an industry that plainly finds it practical.
What it looks like on a site with contracting companies
Where the duty is shared — and on a contracting company site it always is — reasonably practicable is measured against your capacity to influence and control the matter.
A principal that controls site access has enormous capacity to influence who comes through the gate. That makes verification at the gate reasonably practicable almost by definition, and "the contracting company told us they were current" a weak answer, because checking was available and suitable and not remotely disproportionate.
A contracting company that controls who it rosters has the same capacity in its own domain. It cannot argue that its client's portal was responsible for knowing whether its people were current, because the contracting company is the one who decided who to send.
There is a version of this that appears repeatedly in investigations, and it is worth naming because it is so avoidable. A credential lapses. Nobody notices, because the system that would have noticed is a spreadsheet somebody maintains between other duties. The person works for weeks in that state. Nothing happens — until something does, and the question becomes: what would it have cost to know?
The answer, in 2026, is very little. Which is exactly the problem, because the fifth factor cuts both ways.
Where this sits in Queensland resources
If your work is on a Queensland mine or quarry, the wording that binds you is not section 18 of the WHS Act. The Coal Mining Safety and Health Act 1999 and the Mining and Quarrying Safety and Health Act 1999 use their own formulation: risk must be reduced to an acceptable level, and the Acts define that as within acceptable limits and as low as reasonably achievable.
It reaches much the same place by a different route, and it puts an extra obligation on the way: since 1 June 2026, Queensland operators have had to demonstrate a systematic, verifiable approach to the critical controls standing between a worker and a fatal event. That is a shift from "we assessed the risk" to "we can show this specific control was in place and working on this specific day", and it is much harder to satisfy from memory.
The practical version
Strip out the law and the duty resolves to four questions you should be able to answer on any given day:
- What could seriously hurt someone here?
- What are we relying on to stop that?
- How do we know that thing is actually in place right now?
- When did we last check, and what happened when it was not?
Organisations that can answer all four have a duty of care position. Organisations that can answer the first two have a risk register. The gap between them is where nearly every enforcement action lives.
