EPC23, Explained: The Employer Practice Checklist Behind PRisMA 2024

Of the three instruments in a PRisMA 2024 assessment, EPC23 is the one almost nobody writes about. LEO26 gets the attention, because employees actually fill it in. EPC23 sits in the next step along, quieter and less understood, and it is often the thing that saves a high-scoring work unit from a pile of work it does not need. Worth understanding properly.

The name, decoded

EPC23 stands for Employer Practice Checklist, and the 23 is simply the number of points it contains. It is published alongside LEO26 in the DOSH Guidelines on Psychosocial Risk Assessment and Management at the Workplace 2024 (PRisMA 2024). Where LEO26 asks your employees how the work actually feels, EPC23 turns the question on the organisation: what are you already doing about it?

When EPC23 actually appears

Most assessments never reach EPC23 at all, which tends to surprise employers. It only activates when a work unit scores high risk on LEO26. If every unit comes back low risk, the assessment moves straight to record keeping and the next review date, and the checklist stays in the drawer. EPC23 is Stage II of the process (Steps 8 and 9 of the eleven), and it runs only for the units that flagged. The whole eleven-step sequence is mapped out in the step-by-step process guide.

What the 23 points look at

The checklist walks through the controls a workplace might already have for psychosocial risk. Think grievance channels that people actually use, a real process for reviewing workload, supervisors trained to spot strain rather than only chase output, clarity about who is responsible for what, and the everyday support that makes a hard week survivable. The PTP records what genuinely exists, not what the policy folder claims exists. A written policy nobody follows scores the same as no policy at all.

Why the matching step matters

A high LEO26 score does not automatically mean a unit is in trouble. Sometimes the work genuinely is demanding (an ICU, a finance team at month-end) and the employer has already built strong support around it. EPC23 is what catches that. The PTP lays the high-risk findings next to the existing controls and asks where the real gaps are. A unit can look alarming on the LEO26 numbers and turn out to be well held. Another can look borderline and reveal almost nothing underneath. Without the matching step you would treat both the same, and pour effort into the wrong one.

What EPC23 is not

It is not the employee survey (that is LEO26), and it is not a diagnosis of any individual. Nor is it optional once a unit scores high. Skip it, and your action plan rests on the LEO26 numbers alone, which is the very guesswork the checklist exists to remove.

What happens after EPC23

Once the gaps are clear, the assessment moves into Stage III: the PRiMA action plan (Psychosocial Risk Management Plan of Actions), where each priority gets a concrete action, an owner, and a date. High-risk units are then reassessed after 12 months. The screening tool that starts the whole thing is covered in the LEO26 explainer, and the person who runs it is described in the PTP explainer.

Dr. Kirath Sidhu (Dr. Harkirath Singh Harbans Singh) is a registered Occupational Health Doctor and certified Psychosocial Trained Person (DOSH PTP-291/26). He provides PRisMA 2024 assessments for employers across Penang and Malaysia through ASP Medical Group.