Most people looking for IOSH Managing Safely notes are in one of two situations: the course is booked and you want to know what is coming, or you have sat the three or four days, your head is full, and the question paper and the project are still ahead of you. These notes cover the whole syllabus module by module, in the order the course teaches it, with the points that actually come up in the assessment pulled out. They are written to be revised from, not read once.
What the course is, in one paragraph
IOSH Managing Safely is the Institution of Occupational Safety and Health's course for managers and supervisors — the people who run teams and make day-to-day decisions about how work gets done. It is deliberately not a technical safety qualification. Nobody expects you to leave as a safety practitioner; they expect you to leave able to spot a hazard, assess a risk, choose a sensible control and understand where your legal duties begin and end. The current version is v5.0, delivered in seven modules.
- Who it is for managers, supervisors and team leaders in any sector
- Structure seven modules, typically three to four days
- Assessment part 1 a question paper — around 30 questions in 45 minutes, marked out of 60
- Pass mark (paper) 36 out of 60
- Assessment part 2 a practical risk assessment of your own workplace, submitted afterwards
- To be certified you must pass both parts
- Certificate validity not dated and does not legally expire; IOSH recommends refresher training
Marking criteria, submission deadlines and the exact paper format are set by IOSH and applied by your training provider — confirm all three with whoever is delivering your course rather than relying on any revision notes, including these.
Module 1: Introducing managing safely
The opening module answers the question the rest of the course depends on: why should a manager care? There are three reasons, and the paper expects you to know all three by name.
The moral, legal and financial case
The moral reason is the simplest and the one examiners treat as primary: people should not be harmed by going to work. Injury and ill health cause suffering to the person and to their family, and no business objective outranks that.
The legal reason is that health and safety duties are statutory, not optional. Breaching them exposes the organisation and named individuals to enforcement, prosecution and, in serious cases, imprisonment.
The financial reason is that accidents are expensive in ways that do not appear on an invoice: absence and sick pay, lost production, recruitment and retraining, higher insurance premiums, damaged equipment, investigation time and reputational harm. Many of these costs are uninsured, which is why the course keeps returning to them.
What a safety management system is
A safety management system is the structure that turns intent into practice. The recognised shape is plan, do, check, act: set a policy and plan, organise and implement it, measure whether it is working, then review and improve. Its components are the policy itself, the organising arrangements, planning and implementation, measuring performance, and reviewing performance and auditing.
A useful exam trick: questions on this often list four things that belong to a safety management system and one that plainly does not — personal productivity targets, sales objectives, and so on. The odd one out is whatever measures business output rather than safety.
Module 2: Assessing risks
This is the spine of the course. It is the module the paper returns to most often, and it is the entire basis of the practical project, so it deserves more space than these notes can give it.
The essentials: a hazard is anything with the potential to cause harm; the risk is the chance it actually harms someone combined with how serious that harm would be. Risk is judged as likelihood × severity. The method has five steps — identify the hazards, decide who might be harmed and how, evaluate the risks and decide on controls, record your significant findings, then review and update.
This module has its own guide. The five steps worked through in full, the hazard-versus-risk distinction the paper deliberately tests, how risk matrices work, and what markers look for in the project.
Read: IOSH Managing Safely risk assessment — the 5 steps explained
Module 3: Controlling risks
Once a risk is assessed you have to do something about it, and the course is firm that some controls are worth far more than others.
The hierarchy of control
Controls are ranked from most to least effective, and you are expected to work down the list rather than jump to the bottom of it:
- Elimination — remove the hazard entirely. The highest level of the hierarchy. Stopping a task being done at all, or automating it so nobody is exposed, eliminates the risk rather than managing it.
- Substitution — replace it with something less dangerous: a water-based solvent instead of a flammable one, a lighter component, a quieter machine.
- Engineering controls — design the risk out or contain it: machine guarding, local exhaust ventilation, interlocks, barriers.
- Administrative controls — change how people work: safe systems of work, permits, training, job rotation, signage, restricting exposure time.
- Personal protective equipment — the last resort.
Why PPE ranks last
This comes up constantly and is worth understanding rather than memorising. PPE is least effective because it does nothing to the hazard itself — it only puts a barrier between the hazard and one person. It depends entirely on user compliance, it can be worn incorrectly, it can fail, it needs maintaining and replacing, and it protects only the wearer while leaving everyone else in the area exposed. Every control above it reduces risk whether or not anyone remembers to do something.
Note also that PPE is not free of downsides: it can restrict movement, vision or communication, and can introduce heat stress. That does not mean avoid it — it means do not treat it as a first answer.
Residual risk
After controls are applied, whatever risk remains is the residual risk. The test is not whether risk reached zero — it rarely can — but whether it has been reduced so far as is reasonably practicable and whether the residual level is acceptable.
Module 4: Understanding responsibilities
The legal module. You are not expected to be a lawyer, but you are expected to know who owes what to whom.
The Health and Safety at Work etc. Act 1974
HSWA 1974 is the primary piece of UK health and safety legislation — the umbrella under which the regulations sit. Its central requirement is that an employer must ensure, so far as is reasonably practicable, the health, safety and welfare at work of employees.
Two details the paper likes:
- Scope. The employer's duty is not limited to employees. It extends to anyone affected by the work — contractors, visitors, members of the public.
- Employee duties. Employees must take reasonable care for their own health and safety and that of others affected by what they do, and must cooperate with the employer so the employer can meet its own duties. Employees also must not interfere with or misuse anything provided for safety.
"So far as is reasonably practicable"
This phrase qualifies most duties and is worth getting right. It means weighing the risk against the time, cost and trouble of controlling it. Where the risk is high, a great deal of cost and effort is expected; where it is trivial, less is. It is not a licence to do nothing because something is inconvenient, and it is not the same as an absolute duty, which must be met regardless of cost.
The Management Regulations
The Management of Health and Safety at Work Regulations 1999 are where the explicit requirement to carry out suitable and sufficient risk assessments comes from, along with requirements to appoint competent persons, provide health and safety information and training, and plan for emergencies. If a question asks which law requires risk assessment, this is usually the answer rather than HSWA itself.
Module 5: Understanding hazards
This module works through hazard categories so you can recognise them systematically rather than by instinct. Learn the categories — questions frequently give an example and ask which type it is.
- Physical — noise, vibration, extremes of temperature, radiation and mechanical forces such as moving machinery or falling objects.
- Chemical — any substance or preparation that can harm health or damage property: solvents, dusts, fumes, gases, corrosives.
- Biological — living organisms that can cause disease, including bacteria, viruses, fungi and blood-borne agents.
- Ergonomic — manual handling, repetitive movement, awkward postures, poorly designed workstations and display screen work.
- Psychosocial — work-related stress, excessive demands, lack of control, bullying and harassment, violence and fatigue from shift patterns.
Location and work-environment hazards
Hazards are not only in substances and machines — the place itself carries them. Slippery or uneven floors, poor lighting, obstructed walkways and fire exits, trailing cables, inadequate ventilation, cluttered storage, working at height, confined spaces and vehicle movement areas are all location hazards, and they account for a large share of real workplace injury.
Chemicals: check before you use
Before working with any chemical, consult its safety data sheet. The SDS tells you the hazards, the workplace exposure limits, the precautions required, the PPE needed, safe storage and handling, and what to do in a spill or an emergency. Under COSHH, exposure to substances hazardous to health must be prevented or, where that is not reasonably practicable, adequately controlled.
Module 6: Investigating incidents
The purpose of an investigation is to identify root causes so the same thing cannot happen again. It is not to allocate blame — and the paper will offer "to identify who was at fault" as a tempting wrong answer. A blame-focused culture suppresses reporting, which removes the information you need.
Near misses
A near miss is an incident that caused no injury but had the potential to. They matter enormously because they reveal hazards and failing controls before somebody is hurt — free information about a weakness you would otherwise only discover through an injury. An organisation with rising near-miss reports is usually improving, not deteriorating.
Layers of cause
A good investigation separates the immediate cause (the unsafe act or condition at the moment of the incident), the underlying causes (why that was possible — missing training, time pressure, poor maintenance) and the root causes (the management-system failures that allowed the underlying causes to persist). Fixing only the immediate cause is the classic mistake.
RIDDOR
The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations require employers to report certain injuries, occupational diseases and dangerous occurrences to the enforcing authority, normally the HSE. Not every accident is reportable; reporting is triggered by defined categories such as specified injuries, incapacitation for more than seven days, certain diagnosed diseases, and dangerous occurrences that could have caused serious harm. Records must also be kept.
Module 7: Measuring performance
The final module asks how you know whether any of the above is working.
Leading and lagging indicators
A lagging indicator is reactive — it measures what has already happened. Injury rates, lost-time accidents, days lost, enforcement notices and insurance claims are all lagging. They are easy to count and genuinely useful, but by the time they move, somebody has already been hurt.
A leading indicator is proactive — it measures activity that predicts future performance, before incidents occur. Completed hazard inspections, safety observations, training completion, near-miss reports, maintenance done on schedule and actions closed out on time are all leading.
Leading indicators are more useful precisely because they let you identify and fix problems before an incident. A safety programme judged only on lagging indicators is steering by the rear-view mirror. In practice you want both.
Active and reactive monitoring
Active monitoring checks that things are being done right — inspections, audits, workplace tours, checking that controls are in place and working. Reactive monitoring examines things that went wrong — incidents, ill health, near misses. Auditing is the deeper, systematic examination of whether the whole management system is adequate, as distinct from routine monitoring.
Environment and waste
Environmental protection appears alongside the safety material, and our question bank covers it as its own topic. Environmental management is the systematic approach to preventing pollution and reducing environmental harm from an organisation's activities.
The main environmental impacts of a typical workplace are waste, emissions to air and water, chemical spills and resource depletion. The Environmental Protection Act underpins UK duties on responsible waste management and pollution prevention, including the duty of care requiring waste to be stored, transferred and disposed of properly through authorised carriers, with documentation. Hazardous waste is waste containing substances that threaten human health or the environment, and it carries stricter handling, storage, documentation and disposal requirements than general waste.
How the assessment works
There are two parts and you must pass both.
The question paper is sat at the end of the taught course — around 30 questions in 45 minutes, marked out of 60 with a pass mark of 36. It rewards understanding the process rather than reciting definitions: expect scenarios where you must identify the hazard, choose the right level of the hierarchy, or say who holds a duty.
The practical risk assessment is completed after the course on a real hazard in your own workplace and submitted to your provider. This is where most people lose marks, usually by choosing a hazard that is too broad, by listing controls without justifying them against the hierarchy, or by not evidencing the "who might be harmed" step properly.
The certificate itself is not dated and does not legally expire. IOSH recommends refresher training to keep knowledge current, and a one-day Managing Safely Refresher exists, but that is best practice rather than a legal deadline.
How to revise from these notes
Reading notes is the weakest form of revision and the one people default to. A better sequence:
- Read one module, then close the page and write down the hierarchy of control from memory. If you cannot, you have not learned it yet. That single list appears in more questions than anything else except risk assessment.
- Practise on questions, not on prose. Answering a question and reading why the other three options are wrong teaches the distinctions the paper tests. Passive rereading does not.
- Pick your project hazard early — while you are still on the course and can ask the tutor whether it is suitably scoped.
- Rehearse the vocabulary. Hazard versus risk, likelihood versus severity, leading versus lagging, immediate versus root cause, active versus reactive monitoring. Every one of those pairs is a question waiting to happen.
Test yourself on all seven modules. PassNova's IOSH Managing Safely practice explains every answer, including why each wrong option is wrong — free to start, no sign-up.
Frequently asked questions
How many modules are in IOSH Managing Safely?
Seven, in version 5.0: introducing managing safely, assessing risks, controlling risks, understanding responsibilities, understanding hazards, investigating incidents and measuring performance. Environmental protection is taught alongside these. Delivery is typically three to four days.
Is there a free IOSH Managing Safely notes PDF?
IOSH's own course book and workbook are copyrighted material supplied by your accredited training provider, and sites offering them as free downloads are distributing them without permission. These notes are our own summary of the syllabus and are free to read. PassNova also publishes a typeset IOSH Managing Safely study guide for Premium members.
What is the pass mark for IOSH Managing Safely?
The question paper is marked out of 60 with a pass mark of 36. You must also pass the practical risk-assessment project to be certified. Confirm the current format with your training provider.
What is the highest level of the hierarchy of control?
Elimination — removing the hazard entirely, for example by stopping a task being done or automating it so nobody is exposed. PPE sits at the bottom because it does not change the hazard and depends on the wearer using it correctly.
What is the difference between a leading and a lagging indicator?
A leading indicator is proactive and measures activity before incidents occur, such as completed inspections or training. A lagging indicator is reactive and measures what has already happened, such as injuries or lost-time accidents.
Does an IOSH Managing Safely certificate expire?
No. The certificate is not dated and does not legally expire. IOSH recommends refresher training to keep knowledge current, and a one-day Managing Safely Refresher is available, but that is guidance rather than a legal requirement.
Is IOSH Managing Safely the same as NEBOSH?
No. IOSH Managing Safely is a short practical course for managers and supervisors. The NEBOSH General Certificate is a substantially longer and more technical qualification aimed at people with a health-and-safety role rather than a general management one.
One point of clarity: PassNova is a practice and revision site. We are not an IOSH-accredited training provider, these notes are our own summary rather than IOSH's course material, and we do not award the certificate — you sit the course and the assessment through an accredited provider. For official course details, book through a provider listed on the IOSH website.