A Shocking Wake-Up Call: When A Government Agency Faces WHS Prosecution

On 26 May 25, Comcare publicly announced that Services Australia had been charged with breaching federal work health and safety laws after a worker was violently attacked at a Melbourne Centrelink office. The charge arose from a 23 May 23 incident at the Airport West Centrelink office, where a Centrelink worker suffered serious injuries after being stabbed by an individual at the workplace.

This is not a matter to be treated as a standard “difficult customer” incident. It is a serious workplace violence event that has now moved into the criminal WHS space, with Comcare alleging that Services Australia failed to comply with its primary duty under the Work Health and Safety Act 2011 (Cth).

It also carries a broader message for government agencies, public-facing organisations and any business that places workers in direct contact with members of the public. Workplace violence is not background noise, and it is not an unavoidable inconvenience of frontline service delivery. It is a hazard that must be identified, assessed, controlled and reviewed with the same seriousness as plant, traffic, electricity, working at heights or hazardous substances.

What Happened At Airport West

The incident occurred at the Airport West Centrelink office in Melbourne on 23 May 23. A worker was stabbed by an individual at the workplace and suffered serious injuries. The public reporting and later regulatory action make clear that this was not merely a security incident, it was a work health and safety event with significant human and organisational consequences.

Comcare investigated the incident and the Commonwealth Director of Public Prosecutions filed a single charge against Services Australia. The charge alleges that Services Australia failed to comply with its primary health and safety duty to ensure, so far as was reasonably practicable, the health and safety of workers.

That framing matters. The issue is not whether public service work can involve difficult interactions. Everyone knows it can. The legal question is whether the agency took reasonably practicable steps to eliminate or minimise the risk of physical violence to workers.

The WHS Charge And The Duty At Issue

The charge is a Category 2 offence under the Work Health and Safety Act 2011.

Category 2 offences involve an alleged failure to comply with a health and safety duty that exposes an individual to a risk of death or serious injury or illness. In this case, Comcare stated that the maximum penalty is $1.5 million.

Comcare’s public statement identifies several alleged control failures. These included failing to provide at least two uniformed security guards at the workplace at all times, including one guard inside the public entrance, failing to manage entry to the workplace, and failing to give the service centre manager authority to decide whether managed entry should be implemented and remain in place.

Those allegations go directly to the control environment. They are not peripheral administrative points. Security presence, entry management and local authority to implement managed entry are practical controls that sit between an identified risk and a worker standing in front of a potentially violent person.

The matter remains a legal proceeding, so care is needed. A charge is an allegation until determined by a court. The important WHS lesson, however, can be discussed now without deciding guilt. Where a regulator alleges that foreseeable violence was not controlled through practical measures, every similar organisation should be reviewing its own exposure before a court, a worker or an inspector does it for them.

Workplace Violence Is A WHS Hazard, Not A Customer Service Problem

One of the persistent failures in public-facing work is the tendency to manage aggression as a customer service issue. That approach is too narrow. A worker being threatened, assaulted, stalked, spat at, cornered, shoved, punched or stabbed is not experiencing “poor customer behaviour”. They are being exposed to a hazard with physical and psychological consequences.

That distinction changes the control logic. Customer service training may help a worker communicate clearly, de-escalate a tense interaction or disengage early. It does not replace physical security, safe design, duress response, exclusion arrangements, effective information sharing, entry control, supervision and escalation pathways.

The blunt point is this. If a worker is exposed to foreseeable violence, the organisation needs controls that do not depend entirely on the worker talking their way out of danger. De-escalation is a useful skill, but it is not body armour. It should not be dressed up as the primary control because it is cheaper than fixing the operating environment.

The Risk Management Failure To Look For

The central risk management question is not whether the agency had policies about customer aggression. The better question is whether the risk controls were matched to the real operating conditions at the service centre. That includes the layout, the entry point, the visibility of security, the ability to refuse or delay entry, the response time to escalating behaviour, and whether staff had authority to put the site into a safer operating mode.

A mature risk assessment should consider who attends the workplace, what triggers may exist, what patterns of aggression have occurred previously, and what controls are needed when a person presents a known or escalating risk. It should also consider the condition of the workers themselves, including whether they are isolated, exposed at the front counter, physically separated from an exit, or reliant on delayed assistance.

The control test is practical. If a person becomes violent at the entry point, what physically stops them reaching workers? If a person is refused service or removed, what prevents them returning immediately? If a manager believes managed entry is required, do they have authority to implement it without waiting for approval from someone comfortably distant from the front line? If security is present, are they positioned and instructed in a way that actually controls the risk?

Those are not theoretical questions. They are the operational questions that separate a meaningful violence prevention system from a policy suite with a lanyard.

Frontline Workers Need Authority, Not Just Instructions

Comcare’s statement referred to the alleged failure to give the service centre manager authority to decide whether managed entry should be implemented and remain in place. That point deserves attention because frontline safety often collapses when authority is centralised away from the people closest to the risk.

A manager on site needs defined authority to escalate controls when conditions change. That may include closing or restricting entry, requiring security presence at a specific point, changing customer flow, delaying service, calling police, isolating workers from a threat, or stopping face-to-face service until the risk is controlled.

If the authority does not sit close enough to the hazard, the system becomes slow. A slow system in a violence scenario is not conservative. It is exposed. By the time the approval chain has had a think about it, the person at the counter may already be dealing with the consequences.

The Public Sector Cannot Hide Behind Public Service Complexity

Government agencies perform difficult work. Services Australia workers deal with people under financial, social, medical and psychological stress, and those interactions can become volatile. That context is real, but it does not remove the WHS duty.

In fact, that context strengthens the case for disciplined controls. If an agency knows it provides essential services to people who may be distressed, angry, desperate or unwell, then occupational violence is not unforeseeable. It is a known hazard arising from the nature of the work.

The public sector also has scale. In 2023, the responsible Minister publicly referred to Services Australia having 318 service centres across Australia, more than 6000 staff providing face-to-face support, 10 million face-to-face interactions in 2022 to 2023, and almost 9000 customer aggression incidents in the face-to-face category during that same period. Those figures are not a reason to shrug. They are a reason to build a stronger control system.

Broader Reform Momentum

After the Airport West stabbing, the former Minister for Government Services asked former Victoria Police Chief Commissioner Graham Ashton to review safety for Services Australia staff and users. Public statements at the time referred to 44 recommendations from the Ashton review and announced action including additional security guards, improved IT systems, updated service centre design and advanced customer aggression training for selected staff.

That reform context is important. It shows that the issue was not confined to one site or one event. It was recognised as a broader safety problem across a large public-facing operating model.

The proposed Commonwealth Workplace Protection Order Scheme also reflects a shift in thinking. Instead of leaving individual workers to pursue personal intervention orders after threatening behaviour, the agency would have power to act on behalf of staff. That is the correct direction of travel. The burden of controlling workplace violence should sit with the organisation, not be quietly pushed back onto the individual worker who is already carrying the risk.

What Agencies Should Be Reviewing Now

Any agency or organisation with public-facing workers should be reviewing its violence prevention arrangements now, not after a regulator asks for them. The review should start with actual events, not polished assumptions. Look at aggression reports, duress activations, security callouts, police attendance, near misses, worker complaints, customer bans, repeat offenders and locations where workers already feel exposed.

The review should then test the controls. Is there controlled entry where the risk profile warrants it? Are security guards trained, briefed and positioned to intervene effectively? Are workers physically separated from foreseeable violence where required? Are duress systems monitored and tested? Are site managers authorised to escalate controls immediately? Are workers told what to do when a banned or aggressive person returns?

There should also be a strong psychosocial lens. Workers exposed to threats and violence may experience psychological harm even when there is no physical injury. A system that only counts blood on the floor will miss the warning signs, then act surprised when the injury profile turns up later in claims, turnover, absenteeism, conflict and deteriorating trust.

The Leadership Lesson

This prosecution should make senior leaders uncomfortable. Not because every risk can be eliminated, and not because every violent act can be predicted with precision.

It should make them uncomfortable because workplace violence in public-facing work is foreseeable, and foreseeable hazards require real controls.

Boards, executives and officers should be asking whether they understand the organisation’s violence risk profile. They should ask what the credible worst-case event looks like, what controls are relied upon, how those controls are verified, and what authority frontline leaders have when the risk changes.

They should also ask whether the organisation has fallen into the common trap of confusing reporting with control. Reporting aggression after the event is not the same as preventing it. A dashboard of incidents is useful only if it drives better design, stronger decisions and practical change at the point of exposure.

The Practical Takeaway

The Services Australia prosecution is a clear warning that occupational violence is a WHS issue with criminal law consequences. It is not enough to say that workers are trained, customers can be difficult, and security is available somewhere in the building. The question is whether the organisation has eliminated or minimised the risk so far as is reasonably practicable.

That means practical controls at the front line. Managed entry where required. Clear authority for local escalation. Security arrangements that reflect actual risk. Site design that does not expose workers unnecessarily. Information sharing that prevents known risks walking back in unnoticed. Training that supports the control system rather than replacing it.

The hard lesson is simple. If the work exposes people to violence, the organisation must control violence as part of the work. Anything less is not public service. It is risk transfer wearing a government badge.