If you have been sent a form asking you to confirm you are the PCBU, or an auditor has asked which PCBU holds a particular duty, the short answer is: the PCBU is the business itself. Not the site manager, not the safety adviser, not the director. The entity conducting the work.
That is easy enough. What makes the term worth a whole page is the second half — because on any site where a principal, a contracting company and a labour hire firm are all present, there are three PCBUs at once, all of them holding a duty to the same worker, and none of them able to hand it to the others.
What PCBU actually means
PCBU stands for person conducting a business or undertaking. It is defined at section 5 of the model Work Health and Safety Act, which has been adopted — with local variations — in every Australian jurisdiction except Victoria.
"Person" here is the legal sense of the word, which includes a body corporate. So in practice the PCBU is usually a company. It can also be a partnership, an unincorporated association, or a sole trader operating in their own name.
"Business or undertaking" is broader than it looks. The word undertaking is there specifically so the duty reaches organisations that are not commercial: not-for-profits, sporting clubs, charities and government agencies all conduct undertakings and are all PCBUs.
A few things are outside it. A volunteer association with no employees is not a PCBU. Neither is a strata title body corporate that does not employ anyone, or an individual doing something purely for their own private purposes — mowing their own lawn, renovating their own house.
PCBU, officer, worker: three different duties
This is where most confusion starts, because the three are routinely used as if they were the same thing.
The PCBU holds the primary duty of care: to ensure, so far as is reasonably practicable, the health and safety of its workers while they are at work, and of anyone else whose health and safety could be put at risk by the work. That covers the workplace itself, the plant and structures in it, the systems of work, the information and training given, and the monitoring of conditions.
An officer of the PCBU — a director, or someone who makes decisions that affect a substantial part of the business — holds a duty of due diligence. It is not the same duty in miniature. It is a duty to make sure the PCBU is doing its job, and the Act sets out what that involves: acquiring and keeping up to date knowledge of work health and safety matters, understanding the nature of the operations and their hazards, ensuring the PCBU has appropriate resources and processes to eliminate or minimise risk, ensuring it has processes for receiving and responding to information about incidents and hazards, and — the one that catches people — verifying that all of that is actually happening.
Verification is an active word. An officer who has a well-written safety management system and no idea whether anyone follows it has not discharged the duty.
A worker — which includes employees, contracting companies, subcontractors, labour hire staff, apprentices, work experience students and volunteers — must take reasonable care for their own safety and that of others, comply with reasonable instruction, and cooperate with reasonable policy.
Overlapping duties: the part that matters on a contracting company site
Section 16 of the Act says that more than one person can hold the same duty at the same time. Section 16 also says something that surprises people the first time they read it: where more than one person holds a duty, each of them retains responsibility for the duty and must discharge it to the extent that they have the capacity to influence and control the matter.
The duty is not divided. It is not 60/40 between the principal and the contracting company. Each of them holds the whole of it, limited only by what they can actually influence.
Concretely, on a site where a mine operator engages a maintenance contracting company that in turn brings labour hire operators:
- The operator holds a duty to everyone on its site — its own people, the contracting company's team, the labour hire operators.
- The contracting company holds a duty to its own workers and to anyone else affected by its work, including the operator's people.
- The labour hire company holds a duty to the workers it placed, even though it does not control the site they are standing on.
Section 46 then requires all of them to consult, cooperate and coordinate with each other, so far as is reasonably practicable. That is a positive obligation, not a courtesy.
The practical consequence is the one that drives most contractor compliance work in this country: a principal cannot discharge its duty by getting a contracting company to sign something. Taking a supplier's word for it is not the same as verifying, and "they told us their people were current" is a poor answer in an investigation. Equally, a contracting company cannot discharge its duty by pointing at the client's induction. The induction is evidence of the client's system, not of yours.
"So far as is reasonably practicable" is a test, not a hedge
Every PCBU duty is qualified by this phrase, and it is defined rather than left to argument. Section 18 lists what has to be weighed:
- the likelihood of the hazard or risk occurring;
- the degree of harm that might result;
- what the person knows, or ought reasonably to know, about the hazard and about ways of eliminating or minimising it;
- the availability and suitability of those ways; and
- after all of that, the cost, including whether it is grossly disproportionate to the risk.
Cost comes last, and only after the risk is understood. The order is deliberate, and regulators use it as a checklist.
Note the third item. "Ought reasonably to know" means the standard rises as industry practice rises. A control that was uncommon five years ago and is now normal is a control you ought to know about — which is why "we have always done it this way" tends to make things worse rather than better.
Where the PCBU framework does not apply
Here is the part that most PCBU explainers leave out, and it matters enormously if you work in resources.
Queensland mines and quarries are not regulated under the Work Health and Safety Act. They run on two separate pieces of legislation:
- the Coal Mining Safety and Health Act 1999 (Qld), for coal; and
- the Mining and Quarrying Safety and Health Act 1999 (Qld), for mineral mines and quarries.
Those Acts predate the harmonised model and were never folded into it. They use a different structure entirely. Instead of a PCBU, they name specific obligation holders: the operator, the site senior executive (SSE), supervisors, coal mine workers, contracting companies and suppliers, each with duties written out for them. Instead of an improvement or prohibition notice, an inspector issues a directive. Instead of a notifiable incident, a site reports a high potential incident.
So if you are the safety adviser for a Queensland coal mine, "PCBU" is a term you will encounter in your contracts and in your corporate policies and almost never in the Act that governs your site.
The complication — and the reason contracting companies in particular need to be careful — is that the two systems sit side by side. A Queensland contracting company doing maintenance on a coal mine one week and on a food processing plant the next is under the mining Act on Monday and the WHS Act on Thursday. Their office is under the WHS Act permanently. The obligations rhyme but they are not identical, and the reporting obligations in particular are quite different.
Western Australia went the other way: it repealed its separate mines safety legislation and brought resources under the Work Health and Safety Act 2020 (WA), which commenced on 31 March 2022, with a mining-specific regulation sitting under it. So a WA mine does have PCBUs. A Queensland one does not.
Victoria is the third exception, for a different reason: it never adopted the model laws at all, and continues to run on the Occupational Health and Safety Act 2004 (Vic), which uses "employer" and "self-employed person" rather than PCBU.
What this means if you engage contracting companies
Strip out the terminology and the obligation is the same in every jurisdiction: you have to know, and be able to show, that the people doing the work are competent to do it and that the plant they are using is fit for it. Not that you asked. That you knew.
That is a records problem before it is a safety problem, which is why it so often ends up owned by whoever is best at spreadsheets rather than by whoever is accountable. The questions an investigation asks are specific and dated:
- Who was on site on the day, and under whose engagement?
- What was each of them qualified to do, and what evidence of that did you hold at the time?
- When did you last check, and what did you do when something lapsed?
- What did you and the contracting company agree about who checks what, and is there a record of that consultation?
If those answers live in an inbox and a spreadsheet maintained by one person, the honest position is that you cannot produce them at speed — and the moment you most need them is the moment that person is on leave.
What this means if you are the contracting company
Your duty to your own workers is yours. It does not shrink because your client has a sophisticated portal, and it does not transfer because you uploaded certificates into one.
The practical trap is that client portals are built to answer the client's question — is this person cleared for our site? — and they answer it well. What they cannot do is answer yours: what lapses across all of my clients in the next sixty days, and which of my teams can still mobilise if it does? You need your own register for that, and if you do not have one, the portal becomes your early warning system. Its warning arrives at the gate.
