PCBU Responsibilities for Property Owners and FM Companies

A property business rarely employs the people who do its riskiest work. The cleaner, the lift technician, the electrician on the switchboard, and the crew on the roof are almost all somebody else's staff. WHS law does not see it that way. Under the model WHS Act, a contractor who carries out work for your business is, in the Act's word, your worker.¹

This guide is for the facilities manager or property manager who signs for contractor management at a building owner, a managing agent, or an FM company. It sets out what the law asks of each business in a shared building, and the records that show you did it.

What Are a PCBU's Responsibilities?

A PCBU is a person conducting a business or undertaking. It must ensure, so far as is reasonably practicable, the health and safety of workers it engages or causes to be engaged, and of workers whose activities it influences or directs, while they are at work in the business or undertaking.¹

It must also ensure, so far as is reasonably practicable, that other people are not put at risk by its work.¹ Safe Work Australia calls this the primary duty.²

The model Act spells out what the primary duty includes. So far as is reasonably practicable, a PCBU must ensure:¹

• a work environment free of risks to health and safety, provided and maintained;
• safe plant and structures, provided and maintained;
• safe systems of work;
• the safe use, handling, and storage of plant, structures, and substances;
• adequate facilities for workers' welfare, and access to them;
• the information, training, instruction, and supervision needed to protect everyone from the risks of the work; and
• monitoring of workers' health and of workplace conditions, to prevent illness or injury.

The word that matters for property is "worker". Under the model Act a person is a worker if they carry out work in any capacity for a PCBU, including as an employee, a contractor or subcontractor, or an employee of a contractor or subcontractor.¹ So a building owner can owe a duty to a subcontractor's technician it has never met, where it caused them to be engaged or influences or directs their work.

Every state and territory except Victoria has enacted its own version of the model laws; Western Australia's became operational on 31 March 2022.³ Section numbers below are the model Act's unless a state is named, and a state's own Act can differ. Where we name a state, it is mostly NSW, because the worked example is in Parramatta.

Who Is a PCBU, and Who Is Not?

Usually more than one business in the same building. One of Safe Work Australia's examples of several PCBUs at one site is a multi-tenanted shopping centre: the owner, the centre manager, each business in the shops, and those carrying out "cleaning, security and shopping trolley collection".⁴

So in one commercial portfolio the owner, the managing agent or FM provider, every tenant, and every trade contractor can each be a PCBU with duties over the same floor, lift, or roof. Whether a particular owner conducts a business or undertaking at all is, Safe Work Australia says, "a fact to be determined in each case".²

The model Act names who is not one. A person does not conduct a business or undertaking to the extent they are "engaged solely as a worker in, or as an officer of, that business or undertaking".¹

So a facilities manager employed only as a worker is not, in that role, a PCBU. Nor is an elected member of a local authority acting in that capacity, or a volunteer association where none of the volunteers employs anyone to carry out work for the association.¹

An employed facilities manager still has a worker's duty while at work (s 28). They must take reasonable care for their own health and safety, and that their acts or omissions do not harm others. They must comply, so far as they are reasonably able, with reasonable instructions, and cooperate with reasonable policies notified to workers.¹ A senior one may also be an officer, covered below.

What Does "Reasonably Practicable" Mean?

Many duties in this guide are qualified by it, though not all: keeping the asbestos register, notifying an incident, and sighting a licence are not. The model Act defines it as what "is, or was at a particular time, reasonably able to be done in relation to ensuring health and safety", weighing up all relevant matters, including:¹

• the likelihood of the hazard or risk occurring;
• the degree of harm that might result;
• what the person knows, or ought reasonably to know, about the hazard and the ways of eliminating or minimising it;
• the availability and suitability of those ways; and
• the cost of them, "including whether the cost is grossly disproportionate to the risk".

Cost comes last. It is weighed after assessing the risk and the ways of dealing with it, including whether the cost is grossly disproportionate to the risk.¹

The Duty That Comes With Managing or Controlling a Building.

This is the duty most guides skip. An owner or FM company carries it to the extent it manages or controls the building, even if it never touches a tool.¹

Section 20 of the model Act applies to a PCBU "to the extent that the business or undertaking involves the management or control, in whole or in part, of the workplace." That person "must ensure, so far as is reasonably practicable, that the workplace, the means of entering and exiting the workplace and anything arising from the workplace are without risks to the health and safety of any person."¹

Section 21 places a parallel duty, also so far as is reasonably practicable, on a PCBU with management or control of fixtures, fittings, or plant at a workplace.¹ In our reading, for a building that takes in its lifts, HVAC, and other building services.

Safe Work Australia's office-block example shows who can hold it. The building owner and property manager "have duties as persons with management or control of the building" to ensure people can safely enter and exit. The example adds: "Each of these duties is subject to what is reasonably practicable."⁵

Under Victoria's own law, WorkSafe Victoria says the person who manages or controls a workplace "can include an employer, the building or site owner and the property management or tenant of a building or site where there is a workplace."⁶

Who Owes What in One Building.

Each duty holder acts on what it can influence and control. This table is our reading of the sources, set out from the owner's side.¹

Who	What it usually controls	What it must do
Building owner	The structure, base-building plant, the asbestos register, who is engaged for major works	Where it manages or controls the building, in whole or in part: so far as is reasonably practicable, keep it and its entry and exit without risk, and leave an incident site undisturbed; keep the asbestos register unless an exemption applies, keep it readily accessible, and give copies where the regulations require. Where others also have a duty on the same matter: so far as is reasonably practicable, consult, cooperate, and coordinate with them
Managing agent or FM provider	Day-to-day engagement and supervision of trades, access, permits, induction	Its own primary duty to its contractors and their workers; where it manages or controls the building, in whole or in part, the same building, incident site, and asbestos duties as the owner; where others also have a duty on the same matter, so far as is reasonably practicable, consult, cooperate, and coordinate with tenants and the owner
Tenant	Its own premises, staff, and fit-out work	Its own primary duty; the management or control duty for the premises it manages or controls; so far as is reasonably practicable, consult, cooperate, and coordinate with the owner and managing agent on shared matters such as emergency plans
Trade contractor	How the job is done, its workers, its equipment, and any area it controls	Its own primary duty to its workers; the management or control duty for any area it manages or controls; where others also have a duty on the same matter, so far as is reasonably practicable, consult, cooperate, and coordinate with them

The overlaps are deliberate. Safe Work Australia gives the example of a building manager and a tenant who "will have the same duty to ensure toilet facilities are maintained at the workplace."⁷

In Victoria, WorkSafe Victoria says a business that leases a building and runs its business from it is generally not the person with management or control for asbestos.⁸

Can You Contract Out Your WHS Duties?

No. "A duty cannot be transferred to another person," says the model Act, and more than one person can hold the same duty at once.¹ Where they do, each "must discharge the person's duty to the extent to which the person has the capacity to influence and control the matter or would have had that capacity but for an agreement or arrangement purporting to limit or remove that capacity."¹

The Act voids the attempt. A term that purports "to transfer to another person any duty owed under this Act is void" (s 272).¹ Safe Work Australia's contractual chain fact sheet puts it plainly: "WHS duties cannot be contracted out to another party, such as a subcontractor."⁷

Agreements between duty holders are fine, the fact sheet says, "so long as it does not limit or modify their WHS obligations", and it is good practice to record the consultation.⁷

For an FM service agreement, that changes what the contract is for. It cannot move the owner's duty to the FM provider. Nor does a clause that takes away the owner's say shrink its duty: the owner is still measured against the capacity it would have had but for that agreement.¹

What the agreement can do is set out who does what, how information flows, who notifies the regulator, and what records each keeps.

What Does Consult, Cooperate, and Coordinate Mean?

Section 46 of the model Act says that where more than one person has a duty in relation to the same matter, "each person with the duty must, so far as is reasonably practicable, consult, co-operate and co-ordinate activities with all other persons who have a duty in relation to the same matter."¹

Safe Work Australia's code of practice applies it to property. A landlord or managing agent "should consult, cooperate and coordinate activities with commercial tenants, for example about emergency plans and procedures, or with a contractor carrying out maintenance or repair work."⁵

The owner of a large shopping centre "may need formal mechanisms with the retail businesses, for example written agreements and consultative committees."⁵ The code's worked example is a lift service. Before maintenance on the lifts, "the property manager consults with the maintenance contractor, the tenants and the cleaning contractor so duty holders know of the work and what they each need to do".⁵

Consulting other businesses is not the same as consulting workers. Section 47 separately requires a PCBU, so far as is reasonably practicable, to consult the workers who carry out work for it, contractors included, who are, or are likely to be, directly affected by a health and safety matter.¹

Under section 48, that means sharing the relevant information with them, giving them a reasonable opportunity to express views, raise issues, and contribute to the decision, taking their views into account, and telling them the outcome in a timely manner. Where the workers have a health and safety representative, the consultation must involve that representative.¹

Codes of practice are admissible in court under the WHS laws,⁵ and each state and territory decides whether to adopt a model code.³ NSW now goes further. In the version of its Act in force from 1 July 2026, a PCBU must comply with an approved code of practice, or manage the risk a different way that gives an equivalent or higher standard.¹⁰

Officers Carry a Duty of Their Own.

If the business has a duty, its officers must "exercise due diligence to ensure that the person conducting the business or undertaking complies with that duty or obligation."¹ The Act defines an officer by reference to section 9 of the Corporations Act 2001.¹

Safe Work Australia describes an officer as someone who "makes, or participates in making, significant decisions that affect the whole, or a substantial part, of the business, or has the capacity to significantly affect the business' financial standing".² That may include a senior facilities manager as well as a director. Whether a particular person is one depends on their role, and is a question for your lawyer.

Due diligence, the Act says, includes taking reasonable steps to:¹

• keep up to date with WHS matters;
• understand the business's operations and their hazards;
• see that the business has and uses the right resources and processes;
• see that it has processes for receiving and responding in a timely way to information about incidents, hazards, and risks;
• see that it has and implements processes for complying with its duties; and
• "verify the provision and use of the resources and processes".

The examples under that list include processes for reporting notifiable incidents.¹ An officer can be convicted of failing the duty whether or not the business has been.¹

The stakes are real. As at 29 September 2026, the NSW Act sets a maximum of 10 years' imprisonment, or 18,805 penalty units, or both, for an individual PCBU or officer convicted of a Category 1 offence, 9,038 penalty units or 10 years' imprisonment, or both, for any other individual, and 90,424 penalty units for a body corporate (s 31).⁹

A Category 1 offence is committed by a person with a health and safety duty who, without reasonable excuse, exposes someone to whom the duty is owed, or for an officer someone to whom the business owes a duty, to a risk of death or serious injury or illness, with gross negligence or reckless as to that risk.⁹

In NSW, industrial manslaughter can only be committed by a PCBU or an officer of one: a failure to comply with their own health and safety duty, engaged in with gross negligence, that causes the death of a worker or another person to whom the business owes a health and safety duty. As at 29 September 2026 it carries a maximum of imprisonment for 25 years for an individual, and AU$20,000,000 for a body corporate (NSW s 34C).⁹

Who Notifies the Regulator When a Contractor Is Hurt?

In NSW, a PCBU must ensure the regulator is notified "immediately after becoming aware that a notifiable incident arising out of the conduct of the business or undertaking has occurred", by telephone or in writing, and by the fastest possible means.⁹ The regulator in NSW is SafeWork NSW.¹⁰

Elsewhere, the WHS regulator is WorkSafe Victoria, Workplace Health and Safety Queensland, SafeWork SA, WorkSafe WA, WorkSafe Tasmania, NT WorkSafe, or WorkSafe ACT, and Comcare for the Commonwealth.¹¹ Each state's own Act sets what is notified and how.

Under the NSW Act, a notifiable incident is a death, a serious injury or illness, or a dangerous incident. A dangerous incident includes the fall or release from a height of any plant, substance, or thing, where it exposes someone to a serious risk from an immediate or imminent exposure, even if nobody is hurt.⁹ The business must keep a record of each notifiable incident for at least 5 years.⁹

The site must be left alone. Where a notifiable incident has occurred, the person with management or control of the workplace must ensure, so far as is reasonably practicable, that the site is not disturbed until an inspector arrives or any earlier time an inspector directs.⁹

That does not stop anyone helping an injured person, doing what is essential to make the site safe, or acting with an inspector's permission (NSW s 39).⁹ On a building the FM company runs day to day, the person in control will often be the FM company, though the owner or the contractor may also control the part where it happened.

When several businesses share a roof, more than one of them may be running the work the incident arose from. So settle who makes the call in the FM agreement and the contractor's induction, not in a conversation after the event.

The December 2025 model Act adds more to notify, including violent incidents and long work-related absences, with a notify-once rule, a duty to preserve evidence as well as the site, and a duty on the business that notifies and the person in control of the site to tell each other immediately, so far as is reasonably practicable (s 39A).¹

On 29 September 2026, NSW's Act still defined a notifiable incident without violent incidents, and had no notify-once rule.⁹ We checked NSW only; in another state, check that state's Act.

Checking a Contractor Before They Start.

Regulators are plain that engaging a contractor does not end the duty. Safe Work Australia's fact sheet says: "WHS duties cannot be contracted out to another party, such as a subcontractor."⁷

In practice, managing them like your own workers means four things. Select on evidence: the workers' qualifications, licences, and certificates, and the contractor's safety record, incidents, and any notices or prosecutions. Induct them before they start. Supervise more closely for new contractors, high risk work, and complex work. And write it into the contract: roles and responsibilities, what happens on non-compliance, incident reporting, and when they are on site.

How those four steps fit into one working system, and eight questions for judging one, are in the contractor safety management system guide.

The controls themselves follow a set order. Under regulation 36, where it is not reasonably practicable to eliminate a risk, it is minimised, so far as is reasonably practicable, by substitution, isolation, or engineering controls first, then by administrative controls, and only then by personal protective equipment.¹² A permit and a harness are the last lines on a roof, not the first.

Three checks are legal requirements under the regulations, not good practice:¹²

• Licences. A PCBU must not direct or allow a worker to do high risk work that needs a licence "unless the person sees written evidence" of it (regulation 85). Operating a slewing mobile crane and dogging are both licensed classes.¹²
• Construction induction. It must not direct or allow a worker to do construction work unless they have completed general construction induction training and, if that was more than 2 years ago, have done construction work in the last 2 years (regulation 317).¹²
• Asbestos removal. A business that commissions asbestos removal must use a licensed removalist, with narrow exceptions (regulation 458).¹²

Insurance is different. We found no WHS provision that makes checking public liability insurance a legal duty, so treat it as your own requirement, set in your contracts. WorkSafe WA's guidance, written under WA's previous Act, lists insurance among the documents to settle before a contractor starts.¹³

The model Act also makes it an offence, without reasonable excuse, to enter into, provide, or take the benefit of insurance that covers a WHS monetary penalty (s 272A).¹ So, under the model Act at least, no policy should be relied on to pay the fine; check your own state's Act.

Re-Roofing Around the Plant on a Multi-Tenant Office.

Take a 1980s office building in Parramatta with eight tenants. The owner has appointed an FM company. On the owner's behalf, the FM company engages a roofing contractor to replace the torch-on membrane and flashings around the rooftop plant over two weekends. The roofer hires a slewing mobile crane, with its operator and dogger, from a crane hire firm to lift materials from the street.

The whole job, crane hire included, costs under AU$250,000. So under the Work Health and Safety Regulation 2025 (NSW) it is not a construction project (section 292), and there is no principal contractor to appoint (section 293).¹⁴ SafeWork NSW gives the same AU$250,000 line for a construction project.²⁵

It is still construction work, because the NSW Regulation covers work in connection with the "repair, maintenance, refurbishment" of a structure (section 289). It is high risk construction work, because it involves a risk of a person falling more than 2 metres (section 291).¹⁴

Before the first weekend, the facilities manager has done seven things.

1. Checked the contractors. Both firms' safety records and insurance are on file. The crane hire firm directs the crane crew, so under section 85 it must see written evidence of any high risk work licence needed.¹⁴ Under Schedule 3 of the NSW Regulation, operating a slewing mobile crane and dogging both need one.¹⁴ Section 85 can also reach a business that allows the work, so the roofer and the FM company have seen them too.¹⁴
2. Seen the SWMS and the cards. The roofer, as the business carrying out the high risk construction work, must ensure a safe work method statement is prepared before the work starts (section 299), and the FM company has a copy. The crew's general construction induction cards (section 317) are on file.¹⁴
3. Reviewed and handed over the asbestos register. The building dates from the 1980s. In our reading, a full membrane replacement is refurbishment, not minor or routine maintenance or other minor work, so the refurbishment rules apply (section 447).¹⁴ Before work starts the register must be reviewed, revised if it is inadequate for the work, and copied to the roofer (sections 448 and 449).¹⁴ The FM company does this for the owner, which has management or control.
4. Checked the roof itself. The owner's roof anchors and edge protection have current inspection records. The roofer's SWMS sets how falls are controlled, with edge protection first and harnesses only where that cannot be used. Roof access is by the FM company's permit.
5. Issued the hot-work permit and isolations. Torch-on membrane means naked flame beside plant. The FM company's hot-work permit sets the conditions. The plant near the work is isolated and locked out, and the nearby outside-air intakes are shut so fumes stay out of the tenancies. The fire services contractor isolates the detectors in the work zone and restores them each evening, and a fire watch stays on after the torch is off.
6. Coordinated the building. Tenants were told which goods lift the roofers are using for tools and waste, and when. The cleaning contractor knows the loading dock is closed on Saturday morning. The security contractor knows who is signing in after hours. The crane hire firm has arranged its council approvals to work from the street, with the exclusion zone set in its lift plan.
7. Agreed who notifies. If a notifiable incident happens, such as a serious injury, or material falling from the roof in a way that exposes someone to serious risk, the FM company calls SafeWork NSW. It leaves the site as it is, except to help the injured or do what is essential to make it safe, and tells the owner. The contractor's induction says so.⁹

The licences sighted, the SWMS, the register handed over, the permits and isolations, the notices to tenants, and the sign-in times are all kept against the job.

None of that moved the owner's duty to the FM company, or the FM company's to the contractors. The owner, the FM company, the roofer, and the crane hire firm each do their part. The tenants and the other contractors are told what they need to know, and a record shows it.

Asbestos: The Register Is the Controller's Job.

The person with management or control of a workplace must ensure, so far as is reasonably practicable, that asbestos there is identified by a competent person. It must also ensure that an asbestos register is prepared and kept at the workplace.¹²

The register duty "applies to buildings whenever constructed". It does not apply only where a building was constructed after 31 December 2003 and no asbestos has been identified or is likely to be present.¹²

Contractors are written into it. The register must be readily accessible to a business that carries out, or intends to carry out, work at the workplace, and one whose work risks exposure to airborne asbestos must be given a copy.¹²

When management or control of the workplace passes to someone else, such as a new FM provider, the outgoing controller must ensure, so far as is reasonably practicable, that the register goes to them. Where asbestos is identified or likely, a written asbestos management plan is required too.¹²

Before demolition or refurbishment of a structure or plant built or installed before 31 December 2003, other than minor or routine maintenance or other minor work, the register is reviewed, and a copy goes to the business doing the work before it starts.¹²

In a renovation example, Safe Work Australia's code puts the owner in charge of keeping it current: "the building owner has management and control over the workplace and is responsible for ensuring the current asbestos register is updated".¹⁵ In Victoria the register sits under the OHS Regulations 2017,¹⁶ and is reviewed and, if necessary, revised at least every 5 years.¹⁷

When Does a Building Owner Become the Principal Contractor?

When it commissions a construction project and does not appoint someone else. Under the model regulations, a construction project is one where "the cost of the construction work" is AU$250,000 or more, and NSW sets the same threshold.¹²¹⁴²⁵ The business that commissions it "is, subject to this regulation, the principal contractor for the project."¹²

It can engage another business as principal contractor only by authorising it to have management or control of the workplace and to discharge the principal contractor's duties. A project has only one principal contractor at a time.¹²

For an FM company, the first question is which business is commissioning. Where it engages contractors on the owner's behalf, the FM agreement should say whether the owner or the FM company commissions major works, and who is appointed and authorised as principal contractor. Where a job is close to the threshold, ask your WHS adviser how its cost is counted.

Appointing one does not end the owner's part. The commissioning business must give the principal contractor any information it has about hazards and risks at or near the workplace.¹²

In Victoria the threshold is AU$350,000.¹⁸ The owner is the principal contractor unless it appoints one and authorises it to manage or control the workplace to the extent needed for the principal contractor's duties (OHS Regulations 2017, r 333).¹⁷

How Victoria Differs.

Victoria has not adopted the model WHS laws; it runs the Occupational Health and Safety Act 2004.³ The duties land in much the same place, in different words.

For contractors, the Act extends an employer's duties to an independent contractor it engages, and the contractor's employees, for matters over which the employer "has control or would have control if not for any agreement purporting to limit or remove that control" (s 21(3)(b)).¹⁹

WorkSafe Victoria summarises section 26 this way: anyone who manages or controls a workplace must ensure, so far as is reasonably practicable, that it is safe and without risks to health, including entering and exiting, and "this duty is limited to things that the person manages or controls."²⁰

An employer or self-employed person must not, without reasonable excuse, fail to notify WorkSafe Victoria immediately after becoming aware of an incident of a kind listed in section 37 at a workplace under its management and control. It need not notify where it is the only person harmed or put at risk. A written record follows within 48 hours of being required to notify, and a copy is kept for at least 5 years (s 38).¹⁹

WorkSafe Victoria's worked example will be familiar: a landlord responsible for maintaining and authorising repairs finds asbestos in the roof. "You have management of this matter in the workplace and must control this risk."⁶ A portfolio that crosses the Murray should check the Victorian Act itself, not read the model sections across.

What Evidence Should a Property Owner Hold?

The sources above point to the same short list. It is the record you would want to be able to hand a regulator after an incident:

• The prequalification record for each contractor: licences, qualifications, insurance, and safety history, current and with expiry dates. The subcontractor documents checklist says how to verify each one and when it expires.
• The written evidence of any high risk work licence, sighted before the work.
• The safe work method statement for any high risk construction work.
• The asbestos register, who received it, and when.
• Inspection records for roof anchors and edge protection.
• The permits the FM company issued: roof access, hot work, isolations.
• Induction and site sign-in records for every contractor who came on site.
• The consult, cooperate, and coordinate record: who was told what before shared work, who notifies the regulator, and any written agreement between owner, FM provider, and tenants.
• For construction projects, who is principal contractor and what hazard information they were given.

Keeping that across a property portfolio is where ComplyFlow is built to help. Contractors are prequalified through a questionnaire with mandatory insurances and uploaded documents.²¹ One report shows every document across the account, including anything expiring within a set number of days.²²

A site document such as a register can be made visible to contractors and shown to them at sign-in.²³ Permits, such as roof access or hot work, are set up as permit types, with each section going to its reviewer for approval and contractors signing in to the active permit.²⁴ For more on how that works across buildings, see our page for property and facilities management, or our guide to inspection software across a multi-site property portfolio.

The duty was never going to sit with the contractor alone. After something goes wrong on a roof, the questions are what the owner and its managing agent knew, what they checked, and what they can show. A facilities manager who can answer that from one record is in a very different position from one who has to reconstruct it from an inbox.