HSE Professional Guide: Mastering NEBOSH IG2 Risk Assessment (2026)

If you've made it to the NEBOSH IG2 practical assessment, you're already past the hardest theoretical hurdle. But here's where many candidates stumble — not because they don't understand health and safety, but because they underestimate what the examiner is actually looking for. The IG2 isn't a written exam you can cram for the night before. It's a professional-grade risk assessment report, and it needs to read like one.

Think of it this way: NEBOSH is asking you to demonstrate that you can do the job, not just talk about it. The assessment mirrors what a competent HSE professional does every day — walk a workplace, spot the hazards, evaluate the risks, and put together a credible action plan. Whether you're familiar with IOSH Managing Safely, have sat through an OSHA 30-Hour course, or are working toward your ASP/CSP certification, you'll recognize the methodology. The difference with IG2 is that you need to document it in a structured, examiner-ready format.

This guide walks you through every step of that process — from scoping your workplace to writing up your additional controls — with the kind of practical, field-tested advice that helps candidates move from a near-miss to a confident pass.

---

Understanding the NEBOSH IG2 Assessment Criteria

Before you put pen to paper (or fingers to keyboard), you need to understand what NEBOSH is actually marking. The IG2 uses a profiling system rather than a simple percentage score. Examiners assess your submission against bands — from Band D (inadequate) through to Band A (excellent) — across several key areas including hazard identification, risk evaluation, and the quality of your recommended controls.

What does that mean practically? It means depth and relevance matter more than volume. A submission with fifteen well-described hazards, properly evaluated with meaningful controls, will outperform one with forty vague bullet points every single time. NEBOSH examiners are experienced HSE professionals themselves. They can tell the difference between someone who walked the workplace with genuine curiosity and someone who copied a generic hazard checklist from the internet.

What the Examiner Wants to See

• Specific, observable hazards — not generic categories like "manual handling" but precise observations like "warehouse operatives manually lifting stock boxes weighing up to 25kg from floor level to a shelf at 1.8m height without mechanical assistance"
• Realistic risk evaluation — using a suitable risk matrix and justifying your likelihood and severity scores based on existing controls
• Proportionate, practical controls — recommendations that follow the hierarchy of controls and are actually implementable in your chosen workplace
• Professional presentation — logical structure, clear language, and internal consistency throughout

ISO 45001:2018 frames this perfectly — it requires organizations to identify hazards, assess risks, and determine controls in a systematic way. Your IG2 submission is essentially a demonstration of that exact process.

---

Step 1: Describing the Workplace and Scope

Your introduction sets the tone for everything that follows. A weak workplace description tells the examiner that the candidate hasn't really engaged with the environment — and that doubt tends to follow through the rest of the marking.

Choose a workplace you genuinely know. Ideally, it's somewhere you work or have worked. If you're using a hypothetical or arranged workplace, spend meaningful time there before you start writing. The IG2 allows you to use any real workplace, which is actually a significant advantage — you're not being dropped into an unfamiliar scenario.

What to Include in Your Workplace Description

Your description should cover:

• Type of workplace and industry sector (e.g., a medium-sized manufacturing facility producing plastic components, employing 85 workers across two shifts)
• Physical layout — number of buildings, floors, key operational areas
• Workforce profile — numbers, shift patterns, any vulnerable groups such as young workers, pregnant employees, or contractors
• Relevant operational activities — what actually happens there day to day
• Scope of your assessment — be specific about which area or activities you assessed and why

Don't try to cover an entire hospital or a multinational construction site. Scope it down. A well-assessed dispatch warehouse is infinitely better than a superficially assessed manufacturing campus. Examiners appreciate candidates who understand that a risk assessment has boundaries.

---

Step 2: Identifying Hazards and People at Risk

This is the heart of your submission, and it's where the strongest candidates separate themselves from the rest. Hazard identification isn't just about spotting obvious dangers — it's about understanding how energy, substances, and conditions interact with people in a specific environment.

Use a systematic walkthrough approach. In professional practice, this might be combined with document reviews (existing risk assessments, accident records, COSHH assessments) and consultation with workers. For your IG2, reference that you used these methods — it shows examiner awareness of best practice aligned with ISO 45001 and the requirements of proactive safety management.

Categories of Hazards to Consider

Structure your hazard identification across the main categories:

• Physical hazards — noise, vibration, temperature extremes, radiation, manual handling, working at height
• Mechanical hazards — moving machinery, cutting equipment, vehicles and pedestrian interfaces
• Chemical and biological hazards — COSHH-applicable substances, biological agents, dusts and fumes
• Psychosocial hazards — workload, lone working, workplace violence, shift work fatigue
• Electrical hazards — fixed installations, portable appliance use, overhead lines
• Fire and explosion — ignition sources, fuel, oxygen-enriching conditions

For each hazard, identify who is at risk and why. This goes beyond "all workers." Think about maintenance technicians who access machinery during changeovers, cleaning staff who work outside normal hours, delivery drivers unfamiliar with the site, or a young apprentice on their first week. This specificity is what NEBOSH is looking for.

Writing a Strong Hazard Statement

Compare these two examples:

❌ "Forklift trucks in the warehouse"

✅ "Pedestrian/forklift interface in the main goods-in area where forklift trucks operate on the same unmarked floor level as warehouse pickers, creating a collision risk particularly during high-volume goods receipt periods. Pedestrians at risk include warehouse operatives, supervisors, and visiting suppliers."

The second version gives the examiner context, mechanism of harm, and affected parties. That's Band A thinking.

---

Step 3: Evaluating Risks and Existing Controls

Once you've identified your hazards, you need to evaluate the level of risk — and this is where many candidates lose marks by either ignoring existing controls or applying their risk matrix inconsistently.

A robust evaluation follows this sequence: identify what controls are already in place, then assess the residual risk — the risk that remains after those controls are considered. This is a critical distinction. If you assess risk as if no controls exist, you're not reflecting reality, and your additional recommendations will be disproportionate.

Using a Risk Matrix Correctly

Most candidates use a 5x5 likelihood/severity matrix, which is perfectly appropriate. The key is consistency and justification. Don't just drop in numbers — explain why you've scored likelihood as a 3 rather than a 2. Reference observable factors:

• Frequency of the activity
• Competence level of those involved
• Reliability of existing controls (e.g., a worn floor marking is less effective than a physical barrier)
• Historical near-miss or incident data if available

Documenting Existing Controls

This is where many IG2 submissions fall short. Candidates either skip existing controls entirely or vaguely write "training provided" and "PPE issued" without any critical evaluation. A stronger approach critically examines the effectiveness of existing controls:

• Are procedures written, understood, and actually followed?
• Is PPE appropriate, properly maintained, and consistently worn?
• Are engineering controls functioning as intended?

If a permit-to-work system exists for hot work, note it — and note whether it's being applied correctly. If machinery guarding is in place but guards are routinely removed for cleaning, that's a significant gap. This kind of observational depth reflects real HSE professional competence.

---

Step 4: Identifying Additional Control Measures

Here's where you get to demonstrate your understanding of the hierarchy of controls — arguably the most important tool in the HSE professional's toolkit, recognized across NEBOSH IGC, OSHA standards, IOSH Managing Safely, and the ISO 45001 framework.

The hierarchy runs from most to least effective:

1. Elimination — remove the hazard entirely
2. Substitution — replace with something less hazardous
3. Engineering controls — isolate people from the hazard
4. Administrative controls — change how people work
5. PPE — last resort, protects the individual

Your additional controls should work down this hierarchy. Don't jump straight to PPE. If a noise hazard exists, consider whether the noisy process can be isolated (engineering) or scheduled during low-occupancy periods (administrative) before recommending ear defenders. If you do recommend PPE, acknowledge that it's supplementary to higher-level controls, not a standalone solution.

Writing Practical, Specific Recommendations

Vague recommendations fail. "Improve training" tells an examiner nothing. Compare:

❌ "Provide manual handling training"

✅ "Introduce a task-specific manual handling training programme for warehouse operatives covering the specific lifting and stacking tasks performed in the goods-in area, with refresher training every two years and competency assessment sign-off before operatives work unsupervised"

Specificity signals competence. It also makes your action plan (Step 5) much easier to write.

---

Step 5: Planning and Prioritizing Implementation

A risk assessment without an implementation plan is just a document. This section of your IG2 asks you to think like a manager as well as a safety professional — because getting controls implemented requires resources, timescales, and accountability.

Prioritize your actions using residual risk ratings. High-risk items should have immediate or short-term timescales. Medium-risk items might sit in a one-to-three-month window. Lower-risk improvements can be scheduled over a longer period, perhaps as part of a planned review cycle.

What Your Action Plan Should Specify

For each recommendation, include:

• What needs to be done (the specific control measure)
• Who is responsible (job title, not just "management")
• When it should be completed (realistic, risk-proportionate timescale)
• How completion will be verified (what does done look like?)

This structure aligns directly with ISO 45001's requirements for operational planning and control, and it reflects what a genuine HSE management system action log looks like in practice. It also gives the examiner clear evidence that you understand implementation, not just identification.

---

Common Pitfalls to Avoid in Your IG2 Submission

Even well-prepared candidates make avoidable mistakes. Here are the ones that consistently cost marks:

• Generic hazards with no workplace context — writing "slips, trips and falls" without describing the specific floor surface, contamination source, or footwear requirements in your workplace
• Ignoring psychosocial hazards — modern HSE practice (and NEBOSH marking) expects you to consider stress, fatigue, and wellbeing, not just physical hazards
• Inconsistent risk scoring — giving the same risk rating to a minor housekeeping issue and a serious machinery hazard undermines your credibility
• Relying entirely on PPE — defaulting to gloves, hard hats, and hi-vis without exploring higher-level controls suggests a surface-level understanding of risk management
• Failing to reference existing controls — jumping straight to residual risk without acknowledging what's already in place
• Vague action plan entries — "review procedures" and "monitor situation" are not acceptable controls
• Submitting an assessment that covers too broad a scope — trying to assess an entire site in ten hazards will result in superficial coverage

---

Expert Tips for Achieving a Pass

Beyond the technical requirements, there are some practical strategies that consistently help candidates perform at their best.

Walk the workplace more than once. Your first walkthrough gives you an overview. Your second — done with your hazard categories in mind — reveals the details. Talk to workers during this process. They know the real hazards, the workarounds, the controls that look good on paper but don't work in practice.

Cross-reference your IG1 knowledge. The NEBOSH IGC unit covers the theoretical underpinning — risk assessment methodology, legal frameworks, health and safety management systems. Apply that knowledge explicitly in your IG2 submission. Reference the reasoning behind your approach, not just the output.

Read the examiner's report. NEBOSH publishes examiner reports for the IG2, and they're invaluable. They tell you exactly what the marking team sees, what impresses them, and what consistently lets candidates down.

Draft, review, and revise. Don't submit your first draft. Step away from it for a day, then re-read it with fresh eyes — or better yet, ask a colleague with HSE experience to review it. Does it read like a professional document? Would a senior safety manager be satisfied with the quality of the analysis?

Think like an auditor. Candidates who approach the IG2 with an auditor's mindset — systematic, evidence-based, critical — tend to produce the strongest submissions. You're not trying to make the workplace look good or bad. You're documenting reality accurately and recommending proportionate improvements.

---

Key Takeaways

• The IG2 rewards depth and specificity over volume — ten well-described hazards beat forty vague ones
• Always document existing controls before evaluating residual risk
• Apply the hierarchy of controls to every recommendation, starting from elimination and working down
• Your action plan must specify what, who, when, and how — not just what
• Psychosocial hazards are expected in a modern IG2 submission
• Walk the workplace multiple times and talk to workers
• Read NEBOSH examiner reports to understand what top-band submissions look like
• ISO 45001, OSHA principles, and IOSH Managing Safely all reinforce the same systematic approach — use that knowledge

---

Conclusion

The NEBOSH IG2 is genuinely achievable if you approach it with the right mindset and method. It's not about passing an exam — it's about demonstrating that you can perform a credible, professional risk assessment in a real workplace. The candidates who pass well are those who engage seriously with the environment, apply systematic thinking, and write with the clarity and specificity of an experienced HSE professional.

The best way to build that confidence before submission is to practice. Work through scenario-based HSE professional questions that put you in unfamiliar workplaces and ask you to think on your feet. The more varied workplace scenarios you analyze during preparation, the more natural your IG2 assessment process will feel when it counts.

---

Frequently Asked Questions

Q: How many hazards do I need to identify in my IG2 submission?

NEBOSH doesn't specify a minimum number, but in practice, most successful submissions include between ten and twenty well-developed hazards. Quality consistently outweighs quantity — a thorough analysis of twelve hazards will score higher than a superficial list of thirty.

Q: Can I use a workplace I don't currently work in?

Yes, NEBOSH allows you to use any suitable real workplace, including one arranged specifically for the assessment. However, you need genuine familiarity with the environment. If you're using an arranged workplace, spend enough time there to conduct a meaningful walkthrough and, where possible, speak with workers and supervisors about the activities and any existing controls.

Q: How should I handle a hazard where no controls currently exist?

Document the absence of controls honestly and reflect it in your risk evaluation — the likelihood score will typically be higher where no controls are present. Then recommend appropriate controls working from the top of the hierarchy downward. Examiners are not looking for a perfect workplace; they're looking for an accurate assessment and proportionate recommendations. Acknowledging control gaps and addressing them systematically is exactly what a competent HSE professional should do.