Victoria’s new positive duty for officers raises an interesting question about where safety law is heading – and the implications for boards.

Due to commence by 1 April 2028, new section 39AA of the Occupational Health and Safety Act 2004 (Vic) will require an officer to exercise due diligence, including by taking reasonable steps to ensure the body corporate has and implements processes for complying with its duties and obligations under the OHS Act and regulations.

Assurance is only one aspect of due diligence. And while this article talks about directors and boards, the statutory duty applies more broadly to officers of a body corporate.

Boards face two practical issues.

The first is one of focus.

For a large organisation, obtaining assurance of compliance with OHS legislation can mean dealing with hundreds of requirements. The breadth of the duty creates an obvious pressure to delve further into the detail of operational compliance.

But receiving ever more detail is not the same as effective oversight. Too much detail in board safety reporting can obscure the risks and exceptions that most need attention.

The answer is not for directors to take over management or personally examine compliance with every legislative requirement. It is to obtain assurance that supports informed oversight without drawing the board into day-to-day operational decisions.

The challenge is to give directors a clear view of risks that could cause death, serious injury or serious illness, without losing assurance that the broader range of legal obligations is being met.

The second issue is the quality of that assurance.

An OHS audit is one way to assess compliance. But its limitations matter.

Depending on its scope and methodology, an audit can assess whether a business has systems to identify legal duties, assign responsibility and track action. That is useful. But an audit focused on systems and documents may not tell an officer whether important controls work in practice.

A board report stating that a confined-space procedure exists, for example, does not establish that it is being followed. Directors can ask how implementation was tested, what gaps were identified, what remains unresolved and how corrective action was verified.

Then there is expertise.

The expertise needed to assess confined-space compliance is not the same as that needed to assess psychosocial hazards. Officers should understand whether the people providing assurance have the expertise required for the risks and obligations they are assessing.

Many OHS duties also turn on what is “reasonably practicable”. Evidence that a risk assessment exists or an action is marked complete does not, by itself, establish that the business has done what was reasonably practicable.

AI adds another dimension. It can help map legal obligations, analyse incident data, identify trends and produce reports. Used well, it could improve assurance. But it makes the provenance and reliability of information even more important.

Was AI used, and for what purpose? Were the source data complete, accurate and current? Who reviewed the output, and did they have the relevant expertise? What independent verification was undertaken?

Regulatory guidance and, in time, court decisions may give us a clearer picture of what meaningful verification looks like and when officers can reasonably rely on the assurance they receive.

In the meantime, better assurance does not simply mean more reporting.

Directors can test the assurance itself: its scope, methodology, expertise, limitations and verification. And, just as they may hear directly from financial auditors, there may be value in having those responsible for significant OHS assurance work attend the board or relevant committee to explain what they examined, what they did not, what they found - and where they remain concerned.

That may be a better use of directors’ time than another 50 pages in the board pack.