Working at Heights: The Law, the Controls, and Your Roof

The contractor who asks for the roof key is rarely the one who designed the roof. They do not know which skylight is fibreglass, when the anchors were last tested, or that the plant room door opens onto an edge with no guardrail. The business that controls the building does, or should.

This guide is for facilities managers who let contractors onto commercial roofs in property and facilities management, and for operations managers whose distribution centres put people on racking, mezzanines and trailers in transport and logistics. It covers the law, the controls, the safe work method statement (SWMS), licences, rescue, and what to check and keep. The examples are illustrations, not customers.

What Is Working at Heights?

Working at heights is any work where a person could fall from one level to another and the fall is reasonably likely to cause injury. Under the model WHS Regulations, a business at a workplace must manage the risk of a fall from one level to another that is reasonably likely to cause injury, including from an elevated workplace, near an opening or an edge, or on a surface a person could fall through.¹ Safe Work Australia's falls code adds that falls can also happen at ground level into holes, such as trenches or service pits.²

So it covers a fixed ladder to a plant deck, a loading dock edge, a warehouse mezzanine and a trailer deck; the falls code's own examples include stacking warehouse shelves, roof work and unloading a large truck.²

In Safe Work Australia's 2026 statistics, falls from a height killed 28 workers in 2025, 13% of all worker deaths, and have been the second most common way workers die for 3 consecutive years. Being hit by falling objects killed another 21.³

Is There a Minimum Height for Working at Heights?

No. The model duty applies wherever a fall is reasonably likely to cause injury, whatever the height.¹ The 2 metres that everyone quotes is something else: under the model Regulations, construction work that involves a risk of a person falling more than 2 metres is high risk construction work, which needs a safe work method statement before it starts.¹ It is a paperwork trigger, not where the risk begins.

Victoria writes it differently. Its falls Part of the OHS Regulations 2017 defines a fall as an involuntary fall of more than 2 metres, but the Regulations' own note says the employer's duty under the OHS Act still includes managing risks from falls of 2 metres or less, so far as is reasonably practicable.⁴

South Australia shows why a dated source matters. Its Work Health and Safety Regulations 2012 set the trigger for high risk construction work at a risk of falling more than 3 metres until 30 June 2026; a variation gazetted on 30 October 2025 changed it to more than 2 metres, the same as the model, from 1 July 2026.⁶⁵ A flyer dated April 2022 on SafeWork SA's website, produced by the South Australian Construction Safety Alliance, still gives the old 3 metres.⁷ Go by the Regulations in force, not the flyer.

Who Is Responsible When a Contractor Works on Your Roof?

Both businesses, and neither can hand its duty to the other: under the model Act a duty cannot be transferred, more than one business can hold the same duty, and each must meet it to the extent it can influence and control the matter, or could have but for an agreement that limits it.⁸ The business that engages the contractor owes the primary duty, so far as is reasonably practicable, to the contractor and its workers. The business that manages or controls the building must ensure, so far as is reasonably practicable, that the workplace and the means of entering and exiting it are without risks to any person, and a similar duty applies to fixtures, fittings or plant it manages or controls.⁸

Where your business manages or controls the roof hatch, the fixed ladder, the walkways, the edge protection, and the anchor system, they fall within your own duty, alongside the contractor's. Where both businesses have a duty in relation to the same matter, each must, so far as is reasonably practicable, consult, co-operate and co-ordinate activities with the other.⁸

Engaging a licensed, insured, well-regarded contractor does not move your duty onto them.⁸ If an anchor you manage has not been tested, or a skylight you know about is not marked, the gap is yours to close before the job, not theirs to discover during it. You also carry duties of your own as a worker: to take reasonable care for your own health and safety, and that your acts or omissions do not adversely affect the health and safety of others. If your role makes you an officer, which the model Act defines by reference to section 9 of the Corporations Act 2001, you must also exercise due diligence to ensure the business complies with its duties.⁸

The Order of Controls the Law Sets for Falls.

So far as is reasonably practicable, work that involves a fall risk must be carried out on the ground or on a solid construction. Safe means of access to and exit from the workplace, and from any area with a fall risk, must also be provided, and that duty carries no "so far as is reasonably practicable".¹

If it is not reasonably practicable to eliminate the fall risk, the business must minimise it by providing and maintaining a safe system of work: a fall prevention device if reasonably practicable; if not, a work positioning system; and if neither, a fall arrest system, so far as is reasonably practicable.¹ A fall prevention device includes a secure fence, edge protection, working platforms, and covers. Safe Work Australia gives barriers, scaffolding and elevating work platforms as examples, industrial rope access as a work positioning system, and a safety net or catch platform as fall arrest.¹⁹ A combination can be used where one control is not enough.

Training, procedures, signs and permits are administrative controls that support those controls. The falls code says administrative controls must not be used on their own unless no higher-order control is reasonably practicable.²

When Does Work at Height Need a SWMS?

When it is construction work with a risk of a person falling more than 2 metres. The catch for a facilities team is how wide construction work is. The model definition covers work in connection with the repair, maintenance, alteration, fitting-out or commissioning of a structure, and any installation or testing carried out in connection with that work, but leaves out testing, maintenance or repair work of a minor nature.¹

So a solar installation on an office roof, new signage fixed at a parapet, or a gutter replacement is usually construction work, and with a risk of a person falling more than 2 metres it needs a SWMS. Work on plant, such as a condenser, is different: the construction chapter covers plant only in the cases regulation 290(2) lists, including work on plant that relates to construction work, though a building can still require a SWMS as a condition of access.¹ A gutter clean well inside a guardrail may be minor. Minor is a judgement the Regulations leave undefined; where the call is close, ask for the SWMS.

The business doing the high risk construction work must make sure a SWMS is prepared before the work starts. It must identify the work, specify the hazards and risks, describe the control measures, and describe how they will be put in place, monitored, and reviewed.¹ Our guide to what a SWMS must contain covers the document in full. Read it against your roof: a SWMS that never mentions your skylights or your anchor system was written for a different building.

In Victoria, high risk construction work also starts at a risk of falling more than 2 metres, but construction work is defined in its own words. The definition lists installation, testing, maintenance and repair work performed in connection with construction work, and the installation, testing and maintenance of gas, water, sewerage, electricity or telecommunications services, and it excludes routine or minor testing, maintenance or repair work performed in connection with a building or structure. Where a SWMS is required, the work must follow it.⁴

Fragile Roofs, Skylights, and People Below.

These are the hazards the building knows about and the contractor cannot see from the hatch. The falls code names fragile surfaces to watch: cement sheeting roofs, rusty metal roofs, fibreglass sheeting roofs, and skylights.²

Covers count as a fall prevention device. The code says a cover over a hole or opening must be strong enough to stop people or objects falling through, should be securely fixed, and should be signed as a cover; covers over penetrations should withstand a point load of at least 2 kilonewtons, that is 200 kilograms.² Mark every skylight and fragile area on the roof plan you give contractors, and fix mesh, a cover or a barrier before the first job, not as part of it.

Falls of objects are a separate duty. Under the model Regulations, a business must manage the risk of an object falling on a person where it is reasonably likely to cause injury and, where it is not reasonably practicable to eliminate the risk, prevent the object falling freely or, failing that, provide a system to arrest its fall, so far as is reasonably practicable; an exclusion zone is one of the listed examples.¹ In an office tower the people below are tenants, couriers and pedestrians on the footpath. In a distribution centre they are pickers and forklift operators in the aisle under the work. The code also flags loading docks, where loads are placed on elevated areas, as a falling object risk.²

Anchor Points, Harnesses, and Rescue Plans.

The falls code says anchorages should be tested and approved by a competent person before use, and that insert-type anchors in concrete need pull-out testing because their grip cannot be judged by looking; it points to AS/NZS 1891.4 for anchor strength.² Each component of an individual fall arrest system should be inspected by a competent person after installation, at regular intervals, and immediately after it has arrested a fall.²

Rope access window cleaning has its own checks in the code: fixed anchorage points checked by a competent person before ropes are attached, a back-up system for each person, such as a second independently anchored rope, and exclusion zones below the work and the anchors.²

A fall arrest harness without a rescue plan leaves the worker hanging. Where a fall arrest system is used, the model Regulations require emergency procedures, including rescue, that are tested so they are effective, with training for the workers involved.¹ The code says rescue of a worker suspended in a harness should be prompt to prevent suspension intolerance, and that a worker should not use fall arrest unless at least one other person on the site can rescue them.² A lone technician on a roof at 6am, clipped to an anchor nobody has tested, fails both. Victoria's rule is wider in one respect: emergency procedures must be established before the task for every control below elimination, must, so far as is reasonably practicable, enable rescue and first aid, and must be able to be carried out immediately after a fall.⁴

Do Contractors Need a Licence or Ticket to Work at Heights?

Not a licence for working at heights itself. The model high risk work licence classes have no working at heights class. Two classes turn on height: scaffolding work, defined as erecting, altering or dismantling a scaffold from which a person or object could fall more than 4 metres, and use of a boom-type elevating work platform where the boom is 11 metres or more, measured as the greater of its maximum height and maximum outreach.¹ Before you direct or allow a worker to do licensed high risk work, you must see written evidence from the worker that they hold the right licence.¹ Our high risk work licence check guide shows how to verify one with the state that issued it.

The "working at heights ticket" is a statement of attainment for a nationally recognised unit of competency, Work safely at heights. On training.gov.au, RIIWHS204 Release 1 has been current since 2 September 2026 and supersedes RIIWHS204E, recorded as equivalent. The construction training package has its own unit with the same title, CPCCCM2012, current in Release 2 since 24 December 2024.¹⁰ The model Act and Regulations do not name either unit, so under the model laws a ticket is evidence of training, not a licence. The model Act requires a business to provide, so far as is reasonably practicable, any information, training, instruction or supervision necessary to protect people from the risks of its work.⁸ Check the unit covers the system the contractor will use on your roof.

What to Check Before a Contractor Goes Up, and What to Keep.

Run these checks before access is given, with the contractor's documents in front of you.

• The task has been looked at for a way to do it from the ground, from a solid construction, or with edge protection, before anyone mentions a harness.
• The roof or area plan given to the contractor marks edges, skylights, fragile sheeting, openings, anchors, and the access route.
• Anchors to be used have a current inspection by a competent person, and the date is on your record.
• Construction work with a fall risk over 2 metres has a SWMS that names your roof, your hazards, and your controls, read before the job is booked.
• Any boom-type elevating work platform of 11 metres or more, and any scaffolding work from which a person or object could fall more than 4 metres, is done by a worker whose licence you have seen and recorded.
• Training for the system to be used is in evidence, and the unit named is current.
• Where fall arrest is used, the rescue plan names who will do the rescue, with what equipment, and how quickly, and it has been tested.
• An exclusion zone protects people below, and tenants, security, and other contractors know the dates.
• The contractor has signed in, and someone at the building knows they are at height and when they will be down.

Keep each item with the job. Two are also legal records under the model Regulations: the business that directs or allows high risk work must keep the licence evidence for at least 1 year after the work, and the business doing high risk construction work must keep its SWMS until the work is completed, or for at least 2 years after a notifiable incident connected with it.¹

Working at Heights in a Distribution Centre.

Take a regional distribution centre with 10-metre selective racking, a pick mezzanine and 12 roller doors on the dock. A forklift has struck an upright, and the racking contractor wants to replace a damaged beam level at about 8 metres. The operations manager's first question is how to do it without anyone climbing the racking: a boom-type elevating work platform, with the aisle closed.

The checks follow from that. The boom measures more than 11 metres at full outreach, so the operations manager sees the operator's high risk work licence and records the class and expiry. The centre treats the beam replacement as construction work with a fall risk over 2 metres, so the contractor's SWMS is read before the work is booked, and it names the aisle closure, the platform's anchor point for the harness lanyard, and who stays at the base controls for a rescue. Pickers and forklifts are kept out of the aisle and the one beside it, because a dropped bolt from 8 metres is a falling object.

Carriers' drivers climbing onto trailer decks are working at height on your dock. The falls code's transport example says a transport company should consult the goods suppliers and the businesses receiving the goods about how falls will be controlled during loading and unloading, including checking whether equipment is available so drivers do not have to climb onto loads, and it lists mechanical tarp spreaders as a way to keep the job on the ground.² A roller door spring replacement above a dock door goes the same way: a scissor lift, not a ladder against the door frame, with the door isolated. Under the model Regulations, construction work in an area with any movement of powered mobile plant, such as forklifts, is high risk construction work whatever the height, so where the job is construction work it needs a SWMS too.¹

What the centre keeps: the licence sighting, the SWMS and the date it was read, the aisle closure, and what carriers were told.

A Rooftop Job on an Office Building, Worked Through.

Take a 1990s office building of eight storeys. Its roof carries two condensing units, one about 1.5 metres from an edge with no parapet, a fibreglass skylight over the atrium, a fixed anchor system for window cleaning, and box gutters. This month four contractors want access: an HVAC technician replacing a fan motor on the edge unit, a solar installer measuring up, a gutter cleaner, and the window cleaners on rope access.

When the HVAC contractor asks for the roof key, the facilities manager checks the roof file first. The anchor certificate shows the last inspection was 14 months ago, past the interval in the anchor system's own documents, so the window cleaners are rebooked until it is reinspected. The fan motor job is beside an unprotected edge, so the manager asks for temporary guardrail along that edge, from the unit along the box gutter section due for cleaning, rather than a harness, and for a SWMS, which the building requires as a condition of access for work beside an edge, whether or not the job is construction work in law. The skylight gets a fixed mesh cover and a sign before anyone else goes up.

The footpath under the window cleaners' drop gets an exclusion zone, the tenant below the condensing units is told the dates, and the gutter cleaner works behind the same guardrail, a fall prevention device, so needs no harness. The solar installer's measure-up changes nothing, but the installation is construction work with a risk of a fall of more than 2 metres, so it will need a SWMS.

What the building keeps: the marked-up roof plan, the anchor inspection record, each SWMS, the guardrail installation date, and who went up and when.

What Are the Penalties for Working at Heights Breaches?

Under the model WHS Act, failing a health and safety duty in a way that exposes someone to a risk of death or serious injury is a category 2 offence.⁸ Safe Work Australia's model figures for the year from 1 July 2026 put the category 2 maximum at AU$2,470,000 for a body corporate, AU$494,000 for an individual as a business or officer, and AU$247,000 for any other individual, such as a worker.¹¹

The specific falls duties in the model Regulations, working from the ground or a solid construction, providing the right control, and setting up and testing rescue, each carry a tier E maximum, which the same page puts at AU$9,900 for an individual and AU$50,000 for a body corporate.¹¹¹ These are the model amounts; each state and territory sets its own figures.

In the model Act as at 5 December 2025, a serious fall, or a thing falling from a height, that immediately or imminently exposes a person to a serious risk to their health or safety is a dangerous incident, which the regulator must be notified of immediately after becoming aware of it, and the business with management or control of the workplace must, so far as is reasonably practicable, preserve the site until an inspector releases it. These are the model Act's words, and they apply in your state or territory only as it has enacted them.⁸

How Victoria Differs.

Safe Work Australia lists every jurisdiction except Victoria as having adopted the model WHS laws.¹¹ Its law is the Occupational Health and Safety Act 2004, with the OHS Regulations 2017. After elimination, the order runs from a passive fall prevention device, such as a temporary work platform, roof safety mesh or guard railing, to a work positioning system, then fall arrest, and only then a ladder or administrative controls. And using administrative controls alone requires a written record before the task starts, with a maximum of 60 penalty units for a natural person and 300 for a body corporate (AU$12,546 and AU$62,730 at the penalty unit value of AU$209.10 from 1 July 2026).⁴¹²

Keeping Height Work Records in One Place.

Most of the checklist above is records: licences, training, SWMS, permits, and who signed in. In ComplyFlow, document requirements can be assigned to a particular site, such as a high risk work licence for one roof or facility, and adding one marks each active contractor as waiting on that document until it is supplied; training requirements can be assigned to a site and triggered for contractors only, as the site compliance requirements guide explains.¹³

A roof access permit in digital permits has a permit type, sites, an expiry and a permit holder, and each section can have its own reviewer, so the anchor check can sit with the role that owns the anchors; contractors sign into an active permit from the mobile sign-in app, as the permits guide sets out.¹⁴

At the sign-in point, a site induction is completed when due and recorded, a checklist of hazard acknowledgements must all be ticked before the person can continue, and site documents such as site plans show as the last step, as the sign-in guide describes.¹⁵

Know the Roof Before Anyone Climbs It.

The building brings the knowledge the contractor lacks: where the edges are, which surfaces will not hold, which anchors were tested and when, and who is underneath. Put that on one roof plan and check it before every job. To see contractor licences, permits, and sign-ins on one record, book a demo.