Guide to the NEBOSH General Certificate Unit NG2/IG2 Risk Assessment

The NEBOSH General Certificate course is made up of two units:

  • NG1/IG1: Management of Health and Safety.
  • NG2/IG2: Risk assessment.

Below is everything you need to know about how to complete your unit NG2/IG2 risk assessment.

What is the NEBOSH General Certificate Unit NG2/IG2 risk assessment?

Unit NG2/IG2 is the practical assessment of the NEBOSH General Certificate. It tests your ability to apply your learning in the real world. You’re required to produce a risk assessment of your workplace that identifies a range of hazards. The risk assessment must be suitable and sufficient.

The learning outcome

By the end of the unit, you’ll be able to:

Do a general risk assessment in your workplace, profiling and prioritising risks, inspecting the workplace, recognising a range of common hazards, evaluating risks and (taking account of current controls) recommending further control measures and planning actions.

The risk assessment is split into 4 stages, each with its marking criteria which need to be met:

  1. Description of organisation and methodology.
  2. Risk assessment.
  3. Action plan.
  4. Review and communication.

The assessment criteria

Produce a risk assessment of a workplace that considers a wide range of identified hazards (drawn from elements 5-11 of the NG/IG syllabus) and meets best practice standards ‘suitable and sufficient’.

You need to complete a risk assessment of your workplace. Identifying sensible and proportionate measures to control the risks. The level of details should be proportionate to the level of risk.

When do you complete the unit NG2/IG2 risk assessment?

You can choose a submission date that suits you. You can view upcoming NEBOSH General Certificate Risk Assessment submission dates here.

The assessment will test your understanding of elements 5-11, but you’ll still need to follow the risk assessment process from NG1/IG1 elements e.g. the Element 3.

As you work through the course materials, you should think about how the knowledge apply to your own workplace and make notes as to how you can refer to them in your risk assessment.

How long should it take to complete the NEBOSH General Certificate risk assessment?

You can take as long as you need on your risk assessment. NEBOSH recommend you take around three hours to complete all four stages of the assessment. You might need to take more time to produce a suitable and sufficient risk assessment. Please submit your final risk assessment report by the submission date you’ve registered against.

What are the pass marks for the unit NG2/IG2 risk assessment?

It is a pass or referral (fail). There is a marking criterion for each of the four stages. You must achieve a pass in each of the four stages to achieve a pass for the overall unit. A referral (fail) in any of the four stages will result in a referral for the whole assessment.

Getting started with your NEBOSH Certificate Risk Assessment

Register for your practical exam

You must be registered against an exam date to submit your risk assessment. Simply fill in the Exam Booking Form on our webpage to register for your NG2/IG2 assessment.

Choose a workplace

You can carry out the risk assessment in your own workplace or any workplace of your choice. Your workplace should be large enough to provide a sufficient range of hazard categories and hazards.

Read the NEBOSH risk assessment guidance

NEBOSH has detailed guidance on how you should tackle your risk assessment as well as a sample report. We’ve stripped them down in this blog, but can you download the originals.



Please download and keep these documents handy and refer to them as you go along. You should check each section of your risk assessment against the marking criteria to make sure you’ve included everything that is required to pass.

We recommend that you review the Unit NG2/IG2: Risk assessment – Guidance and information for learners and Learning Partners before you start your study so that it will add to your understanding as you go.

The stages of the risk assessment 

There are several states to this assessment as shown below:

Stage 1: Description of Organisation and Methodology 

You must use the standard risk assessment form supplied by NEBOSH in its online Assessment Pack.

Description of the organisation (approximately 150 to 200 words)

The first step is to give a clear and concise description of your chosen organisation (normally the organisation you work for, but it doesn’t have to be).

Your workplace should be large enough to provide a sufficient range of hazard categories/hazards. But you also need to make the risk assessment manageable and consider the time and resources available to you. For example, you might want to look at the whole organisation or just a specific department or division. If the organisation is very large and complex, then focus on one part of the organisation or specific activities or processes.

You can hide the name and location of your organisation if you like (for confidentiality) by using false details, but everything else needs to be factual.

The marking criteria state you will need to include the following in your description:

  1. The name of the organisation.
  2. Site location – you don’t need to give the full address, just the general location e.g., Manchester.
  3. How many workers are employed by the organisation?
  4. A general description of the organisation. This must include products manufactured or services provided, and the types of activities undertaken.
  5. A description of the area included in the risk assessment.
  6. Any other relevant information, such as who has the day-to-day responsibility for health and safety in your organisation. If you feel like there’s nothing relevant, then you can leave this point out.

Remember: your assessment is going to be marked by an examiner appointed by NEBOSH. the examiner will need a clear description of your organisation to allow them to judge whether your risk assessment is suitable and sufficient. The description of the organisation should be detailed enough to ‘paint a picture’ for the examiner (who may not be familiar with your industry) to allow them to understand what your organisation does. If you provide an unclear or incomplete description, this could affect the marking of the risk assessment.

The methodology used (approximately 200 words)

You are required to explain how you carried out the risk assessment (your methodology).

You will need to include:

  • The sources of information that you consulted.
  • Who you spoke to.
  • How you identified the hazards (How you identified what is already being done; how you identified any additional controls/actions that may be required).

Make sure that you include all of the information that is requested in the NEBOSH assessment form.

This section will help demonstrate the learner has tried to do it properly by gathering evidence widely and systematically. It shows the effort that is made to find out the significant risks, so would normally cover things such as visiting the HSE website for practical guidance on hazards and controls, reviewing the accident and ill-health records, physical inspection, consulting the HSE website for relevant guidance, consulting with those who do the activities, looking at Health and Safety procedures, etc.

 Stage 2: Risk assessment

Your risk assessment must include details on the information requested in each column (column 1 to column 6).

Important note: please ensure that ALL columns are completed with realistic information. If you have nothing to include, for example under additional controls/actions, please put N/A or similar, do not leave the column blank, otherwise, you’ll fail. The NG2/IG2 example on the NEBOSH website shows examples of where N/A (or similar) must be used.

Column 1: Hazard category and hazard

You must find and record at least 10 different hazards that are taken from at least 5 different hazard categories. For the avoidance of doubt, hazard categories for this assessment are the topic headings for Elements 5 – 11 of the NG/IG syllabus as shown in Table 1 in NEBOSH’s NG2/IG2 Risk assessment Guide below:

There are a total of 20 hazard categories. Please remember you must pick your hazards from 5 or more of the hazard categories defined by NEBOSH. Many learners fail by ignoring this simple point. If you include any hazard categories which is not listed in Table 1 in NEBOSH’s NG2/IG2 Risk assessment Guide, you’ll fail. If you only include 9 hazards from 6 hazard categories, or include 10 hazards but don’t state the hazard category; then you’ll fail.

As you complete the first column of the form, remember to put the hazard category first and the hazard second. For the hazard, identifying the specific activity or area where it exists. For example: ‘excessive dust from chemical blending activities’ would be an acceptable description of Hazard.

Column 2: Who might be harmed and how?

After identified hazard category and hazard, you need to identify who might be harmed and how for each of the specific hazards that have been identified in column 1.

‘Exposure to noise can cause damage to worker’s hearing’ is not an acceptable description because it didn’t provide sufficient details on how the hazards can cause harm and the example of injury.

‘Prolonged uncontrolled exposure to noise at 80+dB in the assembly workshop can, over time, cause Noise-induced hearing loss (NIHL)’ would be an acceptable description as it indicates how the hazards can cause harm with sufficient details by specifying the hazardous noise level and the unsafe condition and indicates the consequence/example of injury. 

Column 3-4: What are you already doing? and What further controls/actions are required?

Columns 3 and 4 work together. If your organisation is already doing enough to control the risk, there will be a lot of controls listed in column 3 but very few (if any) in column 4 (you might even just note that no further action is necessary). On the other hand, if you have very few controls in place, column 3 will contain very little and column 4 will contain a lot more. Both of these scenarios are fine because they are realistic.

You can get an idea of the level of details required and the way that columns 3 and 4 work together, please see the example included in the NEBOSH assessment pack.

Your controls (combination of existing and planned further controls) must be sensible and proportionate (i.e. generally reflect good practice guidance and would reduce risk to acceptable levels).

Your risk assessment must be suitable and sufficient.

Column 5: Timescales for further actions to be completed and Responsible person’s job title

The last two steps in completing the Part 2 risk assessment form are to allocate a time scale and a responsible person to each additional control measure identified in column 4.

The time scale is lengths of time, not deadline dates. Do not write ‘as soon as possible’.

You must be specific here in column 5. Words such as ‘As required’ will be marked ‘Not Met’.

Column 6: Responsibilities

You must use the responsible person’s job title when you are allocating responsibilities for each of the further controls.

Stage 3: Prioritise 3 actions with justification

You must prioritise your actions and give a justification for why you think these are the highest priority/most urgent actions.

You must pick the 3 highest priority/most urgent actions needing attention. These actions can be associated with the same or different hazards/ hazard categories.

Please note: all the three actions must come from column 4 in Part 2 of the risk assessment form: ‘What further controls/actions are required?’, you cannot introduce new actions which are not included in your column 4 in Part 2 of the risk assessment form. Otherwise, you’ll fail.

Moral, general legal and financial arguments for all actions (300-350 words).

The legal arguments must cover duties that would apply to all work situations such as the duties under the over-arching legislation – Health and Safety at Work etc. Act 1974 for NG2, or the duties under the Occupational Safety and Health Convention (C155) and the Occupational Safety and Health Recommendation, 1981 (No. 164) for IG2.

Specific legal arguments (100-150 words)

Likelihood AND severity (75-150 words)

Consideration of the likelihood AND severity (taking account of current control measures) of injury, ill-health or harm occurring. You should consider:

  • The types of injury, ill-health, or harm likely to occur.
  • The number of workers at risk.
  • How often the activity is carried out and how widespread the risk is. For example, does the same threat exist in other parts/branches/divisions/sites of the organisation?

Effectiveness of each action (100 to 150 words).

Here you must describe:

  • the intended impact of each action.
  • justification for the timescale that you indicate in your risk assessment for the action.
  • whether you think the action will fully control the risk.

Learners need to demonstrate that risk assessment translates to action. The examiner does not have to agree with the selection of 3 actions. It is the justification that is more important.

State 4: Review, communicate and check

The final part of the assessment is where you show your ability to communicate your recommendations to the relevant person. To meet the marking criteria, you must include:

  1. A realistic review date for the risk assessment and why you have chosen that review date (50-100 words).
  2. An indication of how the findings of the risk assessment are to be communicated (100 to 150 words). Think about whether it will be verbal or written, timeframes, methods (email, noticeboards, intranet), and who need to know the information.
  3. An indication of how you will follow up on the risk assessment to check that the actions have been carried out. (100 to 150 words).

If you miss any of these pointers in your communication review, then you’ll fail.

A usual mistake from learners is not to give a reason for the review date. Remember, even one ‘Not Met’ means a referral and so be careful.

How to submit your assessment

You need to send your completed forms to your learning provider by email by your chosen submission deadline. They’ll send your assessment to NEBOSH for marking by NEBOSH approved examiner.

Remember to check that your name and learner number are written on all parts of the form that you submit in the footer area.

NEBOSH has provided a worked example of Unit NG2 Practical Assessment Pack which gives you an idea of the amount of detail that is required and what a good risk assessment report looks like. You can download the exam at the NEBOSH webpage:

NEBOSH General Certificate NG2/IG2 Risk Assessment Results

NEBOSH will email you your results within 50 days of your chosen submission date. Provided you’ve passed your NG1/IG1 Open Book Exam, you’ll receive a hard copy certificate in the post within 12 weeks. In case you failed the NG2/IG2, you will receive an email with the examiner’s feedback indicating where you ‘Not Met’ with detailed descriptions. You can revise your existing risk assessment by adding the examiner’s feedback and resubmit.

NEBOSH General Certificate Practical Risk Assessment Resources

NEBOSH advise that you discuss your approach with your tutor after reading this guide. They can give you advice on whether you are ‘heading in the right direction’ – for example, you can have comments on whether you have chosen a suitable workplace or situation that will give enough scope to be able to tackle this assessment properly.

You can’t submit drafts of your work to your tutor as they are not allowed to pre-mark or comment on specific details.

NEBOSH have a range of resources to help you with your risk assessment, including a sample risk assessment report. You should read them all carefully before you start your risk assessment and refer to them regularly along the way:



Good luck with your practical assessment!

Get answers to your questions and help with choosing the right course for you & your team.

+44 (0)1484 937128


How to choose what NEBOSH Qualification is right for you? (2021)
Who is the NEBOSH General Certificate for?