NEBOSH PSM common mistakes
NEBOSH PSM · Understand the traps and how to avoid them.
When asked who owns process safety, candidates answer that it sits with the HSE/safety manager or the process engineer rather than describing visible leadership accountability from senior management down through line managers.
Candidates default to a conventional occupational-safety mental model where safety is 'the safety department's job', because that framing is familiar from general workplace safety and feels like the responsible answer.
What to do instead
Train the distinction explicitly: process safety leadership is a line-management accountability, demonstrated through visible commitment, resource provision, setting expectations and holding people to account; the safety function advises and assures but does not own the risk. Practise phrasing answers as 'senior leaders set policy and provide resources; line managers own the hazards in their plant; the safety team supports and audits'.
Candidates treat 'safety culture' as a single generic attitude and cannot distinguish the elements that make it up (e.g. leadership commitment, workforce involvement, learning, reporting and just culture) or describe how each is measured and improved.
Culture is an abstract concept and candidates memorise it as a slogan rather than as a set of observable behaviours and indicators, so under exam pressure they produce vague statements like 'everyone should be safety conscious'.
What to do instead
Learn culture as a structured model: leadership and commitment, policies and procedures, competence, workforce involvement, open reporting and a just culture, and continuous learning. For each element, prepare one concrete indicator (e.g. near-miss reporting rate, attendance at safety meetings, action-close-out times) and one improvement action so answers can be specific.
Candidates describe hazards and risks interchangeably, listing consequences such as 'fire' or 'explosion' as the hazard, and fail to identify the hazard as the inherent property or condition (e.g. flammable liquid, stored energy, incompatible materials).
Everyday language uses the two words loosely, and exam pressure pushes candidates toward dramatic outcomes that feel like they score marks, so the underlying hazard source is never named.
What to do instead
Apply a fixed structure for every scenario: identify the hazard source (material, energy, condition), then the initiating event, then the consequence, then the likelihood and severity that give the risk. Practise rewriting answers so the hazard is stated first and the consequence second, and check each answer names at least one hazard source.
Candidates perform risk assessment qualitatively only, or apply a matrix without defining likelihood and severity criteria, and cannot justify why a control is 'ALARP' or 'tolerable'.
Candidates know the words ALARP and risk matrix but have not internalised how criteria are set or how the assessment feeds decisions, so they produce unanchored ratings with no basis for the judgement.
What to do instead
Prepare a worked example: define severity and likelihood categories, show how a risk rating is derived, then show the hierarchy of control applied and how residual risk is judged against criteria. In answers, always state the criteria used and the reasoning for accepting or rejecting the residual risk rather than just naming ALARP.
When asked about controlling a hazard, candidates jump to procedural and PPE controls and omit inherently safer design and engineering controls, or list controls without linking them to the specific hazard they address.
PPE and procedures are the most visible and easiest controls to recall, and candidates default to them, forgetting that design change and engineering controls rank higher in the hierarchy.
What to do instead
Adopt the hierarchy of control as a checklist: eliminate, substitute, reduce (minimise inventory, moderate conditions), then engineering controls, then administrative and procedural controls, then PPE. For each scenario, deliberately generate at least one inherently safer design option and one engineering control before mentioning procedures or PPE, and state the hazard each control targets.
Candidates describe management of change as a paperwork step and fail to cover the full cycle: identification of change, assessment of hazards and risk, authorisation, implementation, communication and training, update of documentation (drawings, procedures, registers), and post-implementation review.
MoC is often experienced in practice as a form to complete, so candidates reproduce the form rather than the process, and they omit the technical and human follow-through that the exam is testing.
What to do instead
Memorise MoC as a lifecycle and rehearse it against examples: temporary change (e.g. bypass), organisational change, and like-for-like replacement. For each, list the hazard review, approval level, documentation updates, competence and communication needs, and the verification that the change achieved its intent without introducing new risk.
Candidates write operating procedures as vague instructions ('operate carefully', 'monitor the plant') rather than precise, step-by-step actions with defined parameters, limits, responsibilities and responses to deviations.
Candidates confuse describing a task with writing a usable procedure; they have not practised converting a task into discrete steps with measurable acceptance criteria.
What to do instead
Practise drafting a short procedure using a template: purpose and scope, hazards and controls, prerequisites, numbered steps each starting with an action verb, specified parameters with units and limits, hold points requiring verification, and defined actions if a limit is exceeded. Review the draft and remove any step that cannot be verified or measured.
Candidates treat competence as attendance at training and list 'toolbox talks' as the solution, without addressing competence assurance through defined standards, assessment, supervised practice, refresher and revalidation, and records.
Training is the most familiar intervention and is easy to name; candidates have not learned the distinction between training (an input) and demonstrated competence (an outcome).
What to do instead
Answer competence questions with a cycle: define the competence required for the role, select and train, assess against the standard (practical and knowledge), authorise and record, maintain through refresher and revalidation, and monitor performance. Always include how competence is verified and how gaps are closed.
Candidates produce emergency plans that are generic documents, omitting scenario-specific response, defined roles and command structure, communication with neighbours and authorities, muster and accounting for people, and the exercise and review cycle that proves the plan works.
Candidates recall the phrase 'emergency plan' and write a summary of its contents without linking it to identified credible scenarios or to testing, because they have not practised applying it to a specific plant.
What to do instead
Structure answers as: identify credible scenarios from the risk assessment; define response actions and roles for each; specify alarms, communication and interfaces with external agencies; describe evacuation, escape and accounting for personnel; and set out the exercise, drill, review and update cycle. Include how lessons from exercises feed back into the plan.
Candidates describe incident investigation as 'find out what happened and fix it', omitting the systematic method: securing the scene and evidence, gathering witness accounts, establishing the sequence of events and timeline, identifying immediate and root causes (technical, human and organisational), and tracking recommendations to closure with learning shared.
Candidates focus on the immediate technical cause and the corrective action, because that is the visible part of an incident, and they have not internalised the layered causation model or the assurance loop.
What to do instead
Use a fixed investigation framework in every answer: preserve and gather evidence, interview witnesses, build the timeline, apply a causation method (e.g. ask 'why' repeatedly or use a barrier/root-cause model) to reach underlying and root causes including management-system factors, then make recommendations, assign owners and dates, verify implementation, and communicate lessons across the organisation.