BOSH SO2 common mistakes
BOSH SO2 · Understand the traps and how to avoid them.
Citing 'reasonably practicable' as a blanket defence without showing the two-part test (likelihood/severity of harm weighed against cost, time and trouble of control measures), and without noting that the burden of proving it lies on the duty holder.
Candidates memorise the phrase from the Health and Safety at Work etc. Act 1974 and treat it as a slogan, forgetting it is a structured legal test that must be applied to the specific risk. They also confuse it with 'reasonable care' or 'best practice'.
What to do instead
Practise writing the test out in a sentence: gross disproportion between sacrifice and risk. For any scenario, state the risk level, the control available, its cost and feasibility, then conclude whether the sacrifice is grossly disproportionate. Note explicitly that the duty holder must demonstrate this, not the regulator.
Treating the Management of Health and Safety at Work Regulations 1999 risk assessment as a one-off document to be produced for inspection, rather than a live process with recorded significant findings, a review trigger, and communication to those affected.
Exam questions often present a completed assessment and ask what is missing; candidates focus on hazard identification and skip suitability, recording, review and communication. Many candidates come from workplaces where assessments are tick-box exercises.
What to do instead
For every risk assessment question, run a checklist: suitable and sufficient, significant findings recorded, identified population (including young workers, pregnant workers, contractors, visitors), controls proportionate, residual risk stated, review date and triggers, communicated and understood. Answer the question asked but name the missing element explicitly.
Applying the hierarchy of control in name only, jumping straight to PPE or training as the primary control when elimination, substitution, engineering controls or administrative controls are feasible.
PPE is familiar and easy to describe, and candidates conflate 'training' with a control rather than a support to controls. The hierarchy is often memorised as a list rather than as a decision sequence.
What to do instead
For any control question, work down the hierarchy in order and justify why each higher-level option is or is not reasonably practicable before reaching PPE. Position PPE and training as last-line and supplementary, and state the limitations (PPE depends on correct fit, use and maintenance; training does not remove the hazard).
Confusing RIDDOR reporting categories and thresholds, for example reporting all over-three-day injuries as 'specified injuries', or failing to report dangerous occurrences and occupational diseases, or getting the responsible person and reporting timescales wrong.
The categories overlap in candidates' minds and the reporting deadline (without delay; written report within 10 days) is often misremembered. Candidates also forget that over-seven-day injuries require a report while over-three-day injuries must be recorded.
What to do instead
Build a one-page decision tree: death, specified injury, over-seven-day incapacitation, reportable occupational disease, dangerous occurrence. For each, note who reports, by when and how. Drill the distinction between recording (over three days) and reporting (over seven days) until it is automatic.
Writing incident investigation answers that stop at 'human error' or 'lack of awareness' as the root cause, without examining underlying management, design, procurement or organisational factors.
Immediate causes are visible in the scenario and easy to describe; latent failures require reasoning about systems. Candidates also confuse root cause analysis with blame allocation.
What to do instead
Always structure the answer through immediate causes, underlying causes and root causes, using a recognised method (for example the '5 whys' or a causal tree). Explicitly test whether the finding is a behaviour, a condition or a management-system failure, and propose corrective actions at each level, including verification of effectiveness.
Describing emergency procedures only as 'evacuate and call the fire brigade', omitting the emergency plan elements: roles and responsibilities, alarm and detection, escape routes and assembly points, roll call and accounting for visitors and contractors, disabled persons' evacuation, first aid, spill and environmental response, business continuity, and testing and review.
Candidates default to fire evacuation because it is the most familiar scenario, and under-answer when the question involves chemical release, medical emergency or severe weather.
What to do instead
Prepare a generic emergency-plan skeleton that applies to any scenario, then tailor it. Always include detection and warning, response actions, evacuation or shelter-in-place decision, accounting for people, communication with emergency services, mutual aid, recovery and post-incident review, plus a testing and exercise schedule.
Treating monitoring, auditing and performance measurement as interchangeable, and offering only lagging indicators such as accident frequency or lost-time injury rates.
The terms are used loosely in workplaces and candidates do not distinguish active (proactive) monitoring of controls from reactive monitoring of failures, nor audit against a standard from routine inspection.
What to do instead
For each term, state the purpose, who does it, what is examined and what output results. Pair every lagging indicator with proactive ones such as inspection completion, close-out times, near-miss reporting rates, training currency and exposure monitoring results. Explain how findings feed back into the management system review.
Handling contractors and the supply chain as a procurement formality, without addressing selection and pre-qualification, exchange of risk information, coordination of shared risks, supervision, permit-to-work interfaces and post-contract performance review.
Candidates focus on the contract document and miss the ongoing duty to coordinate and cooperate, and the fact that both client and contractor carry duties.
What to do instead
Answer contractor questions as a lifecycle: specification and selection, pre-qualification of competence and resources, exchange of information about hazards and controls, coordination and supervision on site, monitoring, incident reporting arrangements, and performance review at completion. Name the specific interface risks in the scenario.
Missing the psychosocial dimension of workplace hazards, or addressing stress and mental health only through individual support such as counselling, without assessing work design factors like workload, control, role clarity, change management, bullying and fatigue.
Candidates associate 'hazard' with physical agents and treat wellbeing as a welfare issue rather than a risk management issue with organisational causes.
What to do instead
Include psychosocial hazards in the hazard identification step and apply the hierarchy of control at the organisational level: work design, staffing and scheduling, management of change, clear roles, and reporting routes for bullying and harassment. Position individual support as secondary and describe how effectiveness is monitored.
Discussing environmental and sustainability considerations as an afterthought, without linking them to the same risk management process: aspects and impacts, legal and other requirements, pollution prevention, waste and resource use, energy and carbon, and the relationship to health and safety controls.
Candidates study environmental topics separately from safety and do not see the shared management-system structure, so they cannot answer integrated questions about, for example, a chemical spill that is both a safety and an environmental event.
What to do instead
Learn the environmental management system cycle in parallel with the safety one: identify aspects and impacts, set objectives, implement controls, monitor and measure, evaluate compliance, review. For scenario questions, state both the safety and environmental consequence of the same event and the controls that address both.