Almost everyone who sits IOSH Managing Safely finds the same thing: the risk-assessment material is the spine of the whole course. It is Module 2, it feeds Module 3, it comes up repeatedly in the question paper, and it is the entire basis of the practical project you have to complete afterwards. Get risk assessment straight and the rest of the course falls into place. This guide explains the five steps, the hazard-versus-risk distinction that trips people up, how likelihood and severity combine into a risk rating, and what the markers are actually looking for in your project.
The short answer
A risk assessment is a careful examination of what in your work could cause harm, so you can decide whether you have done enough to prevent it. On IOSH Managing Safely you work through it in five steps — identify the hazards, decide who might be harmed and how, evaluate the risks and decide on controls, record your significant findings, then review and update. A hazard is anything with the potential to cause harm; the risk is the chance that it actually harms someone, combined with how serious that harm would be.
- Course structure seven modules, typically delivered over three to four days
- Assessment part 1 a multi-format question paper — around 30 questions in 45 minutes, marked out of 60
- Pass mark (paper) 36 out of 60
- Assessment part 2 a practical risk assessment of your own workplace, submitted after the course
- To be certified you must pass both parts
- Awarded by IOSH, through an accredited training provider
Exact marking criteria and submission deadlines are set by IOSH and applied by your training provider, so confirm both with whoever is delivering your course before you start writing the project.
Hazard is not the same as risk
This distinction underpins the entire course, and the question paper tests it deliberately.
A hazard is a thing or a condition with the potential to cause harm: a trailing cable, a chemical, a moving blade, noise, working at height. It exists whether or not anyone is near it.
A risk is about exposure and consequence: how likely it is that the hazard actually harms someone, and how bad that harm would be. A drum of solvent sealed in a locked store is a serious hazard carrying very little risk. Decant it into an open tray in an unventilated room and the hazard has not changed at all — the risk has changed enormously.
A quick exam heuristic: if the question stem describes a thing that could hurt someone, that is the hazard. If it describes the chance and seriousness of harm happening, that is the risk.
Likelihood × severity
Risk is judged from two components. Likelihood is the probability that someone is actually harmed. Severity is how serious that harm would be, from a minor cut to a fatality. Most risk-rating matrices multiply the two — risk = likelihood × severity — to give a number you can rank against other risks.
Treat that number as a guide to priority, not as a precise truth. Its real job is to tell you which risks to tackle first, and to make your reasoning visible to somebody else. A rating of 12 does not mean a risk is exactly twice as bad as one rated 6; it means it should get your attention sooner.
The five steps, worked through
The five-step method is the framework the course teaches and the framework the regulator uses. The Health and Safety Executive sets out the same shape in its own current guidance on steps needed to manage risk.
1. Identify the hazards
Walk the job as it is actually done, not as the procedure says it is done. Talk to the people doing it — they know the workarounds. Then supplement what you saw: check accident and near-miss records, read manufacturers' instructions and safety data sheets, and think about hazards that build up slowly rather than striking suddenly (noise, vibration, dust, repetitive handling, stress).
2. Decide who might be harmed, and how
Not just the operator. Think about maintenance staff, cleaners, contractors, delivery drivers, visitors and members of the public. Then think about who is at greater risk than average: new and young workers, new or expectant mothers, lone workers, people with disabilities, and anyone unfamiliar with the site. "How" matters as much as "who" — describing the actual injury mechanism forces you to be specific.
3. Evaluate the risks and decide on controls
Rate what you found, then reduce it so far as is reasonably practicable, working down the hierarchy of control rather than jumping to the bottom of it:
- Eliminate — remove the hazard completely; automate or stop doing the hazardous task
- Substitute — swap it for something safer that achieves the same outcome
- Engineering controls — guard it, enclose it, extract it, isolate people from it
- Administrative controls — safe systems of work, permits, training, signage, job rotation
- PPE — personal protective equipment, last of all
PPE sits at the bottom for a reason worth remembering: it protects only the person wearing it, only when it is worn, only when it fits and only when it is maintained. It depends entirely on human compliance, which is exactly what the higher controls do not.
4. Record your significant findings
If you employ five or more people you must record the significant findings — the hazards, who might be harmed and how, and what you are doing about it. Below five employees the record is not legally required, but the assessment still is.
5. Review and update
There is no fixed legal review cycle. Review when something changes: new equipment, new substances, a new process, a new or altered workplace, an accident or near-miss, or a concern raised by staff. An annual look is common practice, but a change trigger matters far more than a date in the diary.
Test yourself on the risk-assessment module
PassNova's IOSH Managing Safely bank covers all seven modules with exam-style questions and a clear explanation on every answer. Try the free 15-question taster first — no card needed.
The legal framework you need to know
Module 4 (Understanding Responsibilities) is where the law comes in, and a handful of provisions account for most of the marks.
- Health and Safety at Work etc. Act 1974 — the main UK framework. Section 2 places the general duty on the employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. Section 7 places a duty on employees to take reasonable care for themselves and others, and to co-operate with the employer.
- Management of Health and Safety at Work Regulations 1999 — the source of the explicit duty to carry out a suitable and sufficient risk assessment, and to appoint competent people to help you comply.
- RIDDOR — requires specified injuries, over-seven-day absences, certain occupational diseases and dangerous occurrences to be reported.
- The HSE is the regulator: it inspects, investigates and enforces.
The phrase "so far as is reasonably practicable" is worth understanding properly rather than memorising. It means weighing the risk against the time, trouble and cost of controlling it — and the balance is deliberately weighted towards safety. Cost alone is not a defence for leaving a serious risk uncontrolled.
The practical project: what markers want
The second half of the assessment asks you to carry out a real risk assessment in your own workplace and submit it. It catches people out because it is not a test of recall — it is a test of whether you can apply the method to a real situation.
Four things separate a comfortable pass from a resubmission:
- Pick hazards that are genuinely not well controlled. Choosing something already managed perfectly leaves you nothing sensible to write in the "further action" column.
- Be specific about the harm. "Could get hurt" earns little. "Fingers drawn into unguarded in-running nip, causing crush or amputation injury" shows you understand the mechanism.
- Separate existing controls from further action. Markers want to see what is already in place, your rating with those controls, and what more you propose — with a named owner and a target date.
- Show the hierarchy in your thinking. If every proposed control is "provide PPE" and "give training", you have not demonstrated the hierarchy. Say why elimination or engineering controls are not reasonably practicable here, then justify what you have chosen.
You can use IOSH's standard form or your employer's own, as long as it captures the same information. Check the deadline with your provider — the project is usually due within a short window after the course ends, and it is a common reason for certificates being delayed.
What else the paper covers
Risk assessment is the biggest single theme, but the question paper draws on all seven modules. Two areas reliably catch people out:
Investigating incidents. The purpose of an investigation is to learn — to establish what happened and why, so causes can be addressed and recurrence prevented. It is not to allocate blame. A near-miss is an event that could have caused harm but did not, and it matters precisely because it is free evidence that a control has failed.
Measuring performance. Know the difference between leading and lagging indicators. Leading indicators are forward-looking and predictive — inspections, audits, near-miss reports, training completion, safety conversations. Lagging indicators measure what has already gone wrong — injury rates, lost-time incidents, accident frequency. A programme that only counts injuries is measuring its failures after the fact.
Six timed mocks, 200 questions, all seven modules
Full question bank, an AI study tutor and a 20-page downloadable study guide come with PassNova Premium — £4.99/month with a 7-day free trial.
Frequently asked questions
What are the five steps of risk assessment in IOSH Managing Safely?
Identify the hazards; decide who might be harmed and how; evaluate the risks and decide on controls; record your significant findings; and review and update. The Health and Safety Executive frames the same process in the same five stages.
What does a risk assessment enable you to do?
It lets you decide whether the precautions you already have are enough, and what more is reasonably practicable. It converts a vague sense that something is dangerous into a ranked, recorded, actionable list — with owners and dates — that you can review when things change.
What is the difference between a hazard and a hazardous event?
A hazard is the source of potential harm — the chemical, the height, the moving part. A hazardous event is the occurrence that releases that potential and exposes someone to it: the spill, the fall, the guard being removed while the machine runs. The hazard is the "what"; the hazardous event is the "what happens".
How many questions are in the IOSH Managing Safely exam?
Around 30, in a mix of formats — multiple choice, multiple response, true/false and short written answers — taken under exam conditions in about 45 minutes. The paper is marked out of 60 and the pass mark is 36. You must also pass the practical risk-assessment project.
Do I have to record every risk assessment?
You must record your significant findings if you employ five or more people. Below that threshold there is no legal duty to write it down, but the duty to carry out the assessment still applies — and a written record is the only practical way to show what you decided and why.
How often should a risk assessment be reviewed?
There is no fixed statutory interval. Review whenever something material changes — new equipment, substances, processes, people or premises — and after any accident or near-miss. Many organisations also set a routine annual review as a backstop.
Preparing for the assessment
Three habits do most of the work. First, learn the method as a sequence, not a list — if you can explain why "who might be harmed" comes before "evaluate the risk", you will not lose marks to shuffled-order questions. Second, practise applying it to scenarios rather than reciting definitions; the paper is scenario-heavy and rewards judgement. Third, practise writing short answers, because part of the paper is not multiple choice and a one-word answer to a "state two reasons" question scores half marks at best.
PassNova's IOSH Managing Safely practice questions cover all seven modules with an explanation on every answer, plus six timed mocks. The first 15 questions are free to try without an account. If you are also working towards a broader qualification, the same approach applies to NEBOSH General Certificate — and if your route into health and safety runs through construction, CSCS and SMSTS practice is free on PassNova with no sign-up at all.
One point of clarity: PassNova is a practice and revision site. We are not an IOSH-accredited training provider and we do not award the certificate — you sit the course and the assessment through an accredited provider. Our job is to make sure that when you do, the material already feels familiar. For the official course details, book through a provider listed on the IOSH website.