NEBOSH Incident Investigation study plan

Define the four purposes of incident investigation and distinguish them from blame-finding or disciplinary processes

Map the full investigation lifecycle from incident notification through report sign-off and corrective action close-out

Classify incidents by type (injury, near miss, dangerous occurrence, property damage, environmental release) and state the reporting threshold for each

Draft an incident notification flowchart for a fictional organisation, showing who is informed, how quickly, and what interim action is triggered

Apply the immediate versus underlying (root) cause distinction to at least ten short incident scenarios

Use a structured causation model to trace a chain of events from initiating cause to consequence

Explain how human, technical and organisational factors interact in a single incident

Identify the limitations of linear causation models when applied to complex socio-technical systems

Select an appropriate investigation technique (timeline, 5 Whys, fault tree, Ishikawa, barrier analysis, TRIPOD-style) for a given incident scale and complexity

Construct a fault tree for a simple top event and identify minimal cut sets by hand

Build an Ishikawa diagram that separates causes across at least six categories

Justify in writing why one technique was chosen over two alternatives for the same incident

Plan an evidence-gathering strategy that covers physical, documentary, electronic, photographic and witness evidence

Describe chain-of-custody and preservation requirements for physical evidence and site security

Draft a witness interview plan using open, probing and closed questions in the correct sequence

Recognise common interview pitfalls such as leading questions, presupposition and premature conclusion

Analyse documentary evidence such as permits, risk assessments, maintenance logs and training records to identify gaps

Interpret human factors concepts including error types, violation types, workload, fatigue and situation awareness

Assess how safety culture and management system weaknesses manifest in incident evidence

Evaluate the reliability of witness statements and reconcile conflicting accounts

Distinguish immediate corrective actions from long-term preventive actions and rank them by hierarchy of control

Write SMART corrective actions with named owners and realistic completion dates

Evaluate proposed actions for unintended consequences and for the risk of displacing the problem elsewhere

Explain how investigation findings feed back into risk assessment, training and management review

Structure an investigation report to a recognised format covering summary, scope, method, findings, causes, conclusions and recommendations

Write findings that separate established fact from inference and opinion

Present statistical incident data in a way that supports trend identification without overstating causation

Apply legal and ethical considerations including confidentiality, data protection and privilege

Recall definitions, models, techniques and legal points across all four domains under timed conditions

Complete at least two full-length practice papers and mark them against the command words used

Diagnose your three weakest sub-topics from practice results and re-study each one

Rehearse structuring long-form answers to command words such as describe, explain, analyse and evaluate