NEBOSH Incident Investigation common mistakes
NEBOSH Incident Investigation · Understand the traps and how to avoid them.
Writing the investigation report as a chronological narrative of what happened ('at 09:15 the operator arrived, at 09:20 he started the machine...') instead of separating the sequence of events from the analysis of causation.
Candidates confuse 'investigation' with 'description' and believe a detailed timeline demonstrates competence, so they spend the answer on storytelling and run out of space before reaching causal analysis and recommendations.
What to do instead
Structure every long answer as: (1) brief factual sequence, (2) immediate and underlying causes, (3) root/underlying failings in the management system, (4) recommendations mapped one-to-one to the causes. Keep the timeline to a few lines and label the sections explicitly.
Offering a single cause ('the worker was careless') rather than distinguishing immediate causes (unsafe acts/conditions) from underlying/root causes (failures in supervision, training, planning, maintenance, culture).
Candidates stop at the most visible cause and do not know or remember the multi-level causal model expected at this level; blaming the individual is also the intuitive answer in everyday reasoning.
What to do instead
Always apply a causal framework explicitly, e.g. immediate cause → underlying cause → root cause, or a technique such as 5 Whys or fault tree. For each level, write at least one line, and finish by asking 'why did the system allow this?' until you reach a management-system failing.
Recommending only 'retrain the worker' or 'remind staff to be careful' as corrective actions.
It is the quickest action to write and appears to address the cause; candidates do not test whether the action would prevent recurrence or whether it addresses the root cause.
What to do instead
Test each recommendation against the hierarchy of control and against the specific cause it is meant to remove. Replace person-focused actions with engineering or system controls (guard, interlock, permit-to-work, planned maintenance, design change) and justify why the action prevents recurrence.
Confusing the purpose of an investigation with that of a disciplinary or blame-finding exercise, and writing answers that focus on identifying who was at fault.
Candidates bring workplace assumptions that investigations exist to apportion blame, and exam scenarios featuring human error invite this framing.
What to do instead
State the purpose explicitly at the start of relevant answers: to establish what happened, why it happened and what needs to change to prevent recurrence, not to allocate blame. Then show how a no-blame, fact-finding approach improves the quality of evidence and cooperation.
Describing evidence collection vaguely ('collect all evidence') without naming categories, sources, or the need to preserve and secure evidence first.
Candidates know evidence matters but have not memorised a structured classification, so they produce generic statements that earn little credit.
What to do instead
Use a fixed checklist: people (witness statements, interviews), positions/conditions (scene photographs, sketches, measurements), parts (failed components, samples for lab analysis), paperwork (permits, training records, maintenance logs, risk assessments, CCTV). Add the practical points: secure the scene, prevent loss or contamination, record contemporaneously, maintain chain of custody.
Writing interview answers that describe only what to ask, omitting how to conduct the interview (location, timing, rapport, open questions, avoiding leading questions, recording the account, separating witnesses).
Candidates treat interviewing as a list of factual questions and underestimate the procedural and human-factor aspects that carry marks.
What to do instead
Cover both: preparation (review evidence first, choose a neutral private location, interview soon after the event, one witness at a time) and conduct (explain purpose, reassure about no-blame intent, use open questions then probe, avoid leading or judgmental language, record and read back the statement, allow the witness to add information).
Listing investigation techniques by name (fault tree, event tree, MORT, Ishikawa, 5 Whys, TRIPOD) without explaining when each is appropriate, what it produces, or its limitations.
Candidates memorise names close to the exam and cannot recall the underlying mechanics, so they cannot expand when the question asks for application to a scenario.
What to do instead
For each technique learn three things: what it is used for (e.g. fault tree for a specific undesired top event and combinations of failures; Ishikawa for brainstorming cause categories; 5 Whys for simple linear causation), the inputs/outputs (diagram, causal factors, barriers), and its limitation (time-consuming, needs expertise, poor for complex interactions). Practise applying one to a short scenario.
Ignoring the distinction between the statutory reporting duty and the internal investigation, or stating reporting criteria without the key thresholds and timescales.
Candidates mix up 'what must be reported to the regulator' with 'what must be investigated internally', and half-remember the qualifying criteria.
What to do instead
Learn the reporting framework relevant to your jurisdiction (e.g. in Great Britain, RIDDOR: deaths, specified injuries, over-seven-day injuries, dangerous occurrences, reportable diseases; reporting without delay and written report within 10 days). Then state clearly that internal investigation goes beyond the statutory minimum and explain why (prevention, learning, legal defence).
Failing to address human and organisational factors explicitly - writing about 'human error' as a cause rather than analysing the error type, the conditions that produced it, and the organisational influences.
Human factors is a large, technical area and candidates reduce it to a label because they cannot recall a usable structure under exam pressure.
What to do instead
Use a simple structure: the individual (competence, fatigue, stress, perception, attention), the task (workload, complexity, procedures, interface design), the organisation (culture, supervision, pressure, resources, communication). Classify errors as slips/lapses, mistakes or violations, and link each to the conditions that made it likely.
Presenting recommendations without owners, timescales, priorities, or a means of checking effectiveness, and without acknowledging that some actions may be interim.
Candidates treat the recommendation list as the end of the answer and do not think about implementation, which is what distinguishes a competent action plan.
What to do instead
For each recommendation give: the action, the responsible person, target date, priority (immediate/interim vs longer-term), and how completion and effectiveness will be verified (audit, re-inspection, monitoring of leading indicators). Add a short line on communicating findings and lessons learned to the wider workforce.