Every job has hazards, and not every hazard needs the same attention. A loose cable on the floor and an unguarded roof edge are both risks, but nobody would deal with them in the same way. A risk matrix helps you tell them apart in about a minute.
Pick the likelihood and the severity below, and the calculator will give you a score and a colour-coded rating.
What is a risk matrix?
A risk matrix is a simple grid that scores a risk by putting two things together: how likely it is to happen, and how bad it would be if it did. The 5×5 version is the one most people use. Each side of the grid runs from 1 to 5, which gives 25 boxes. Every box has a score and a colour.
People like it because it is quick, visual and easy to explain to a team. You do not need to be a specialist to read it, and that is why it shows up in almost every risk assessment form.
The risk matrix formula
Risk score = Likelihood x Severity
Both numbers run from 1 to 5, so the lowest score is 1 and the highest is 25. The higher the score, the sooner you need to act.
The likelihood scale
- 1 – Rare: it could happen, but only in very unusual conditions
- 2 – Unlikely: it has happened somewhere, but not often
- 3 – Possible: it could happen at some point
- 4 – Likely: it has happened here before and could easily happen again
- 5 – Almost certain: you expect it to happen, maybe more than once
The severity scale
- 1 – Negligible: no injury, or first aid only
- 2 – Minor: an injury that needs basic medical treatment, with little or no time lost
- 3 – Moderate: an injury with time away from work or restricted duties
- 4 – Major: a serious injury, such as a broken bone or lasting damage
- 5 – Catastrophic: a death, or several people seriously hurt
How to read your score
Most companies group the 25 scores into four bands. A common split looks like this:
- 1 to 4 (green, low): accept the risk, and keep an eye on it
- 5 to 9 (yellow, medium): add controls where it is reasonable to do so
- 10 to 16 (orange, high): act soon, and do not start the work until controls are in place
- 17 to 25 (red, extreme): stop the work until the risk is brought down
These bands are a common starting point, not a law. If your company or client has its own matrix, use theirs and keep the same colours and cut-off points every time.
Worked example
A team will repair a roof. The edge has no guard rail. Falling is not very likely on any given day, but it could happen, so likelihood is 3. A fall from that height could kill someone, so severity is 5.
Risk score = 3 x 5 = 15, which is high.
Now take a loose cable across a walkway. People step over it all day, so likelihood is 4. A trip would most likely cause a bruise or a sprain, so severity is 2.
Risk score = 4 x 2 = 8, which is medium.
The cable trips people more often, yet the roof edge goes first, because the worst result is far more serious. That is the whole point of a matrix: it stops you from fixing the easy thing and ignoring the dangerous one.
Step by step
- Write down the hazard and who could be harmed.
- Choose the likelihood from 1 to 5, based on the controls you have today.
- Choose the severity from 1 to 5, based on the realistic worst result.
- Multiply the two numbers.
- Check the colour band and decide what to do.
- Write the score on your risk assessment form.
Who should score the risk?
Do not score alone at a desk if you can avoid it. The people who do the job every day know where things go wrong. A supervisor, a worker and a safety officer in the same room will give a much better score than one person guessing. If two people disagree, talk it through until you find out why. The argument often shows a hazard that one of them had missed.
What to do after you get a score
A score on its own changes nothing. Its job is to tell you what to fix first. Start with the red and orange items. Look for ways to remove the hazard completely, then to replace it with something safer, then to guard it, and only then to rely on rules and protective equipment.
After you add controls, score the risk again. The new number is your residual risk, and our residual risk calculator shows how much the risk came down.
Limits of a risk matrix
- The scores are a judgement, so two people can reach different answers.
- Different boxes can give the same score. A 5 x 2 and a 2 x 5 are both 10, but they are not the same kind of risk.
- It works best for single hazards, not for a long chain of events.
- Any risk with a severity of 5 deserves attention, even when the likelihood looks low.
For machines and processes, you may also want the RPN calculator, which adds a third factor: how easy the problem is to detect.
Common mistakes
- Scoring the best case instead of the realistic worst case
- Scoring with the controls you hope to add, not the ones in place today
- Changing the bands or colours from one assessment to the next
- Letting one person score everything alone
- Filling in the form once and never looking at it again
Using it with near miss reports
Near misses are a good source of hazards to score. If a load slips and lands where no one is standing, that is a free warning. Score it, fix it, and share what you did. The near miss frequency rate shows whether people are reporting enough, and the accident pyramid calculator shows how small events relate to serious ones.
Frequently asked questions
What is a 5×5 risk matrix?
It is a grid with five levels of likelihood and five levels of severity. Multiply the two and you get a score from 1 to 25.
What is a good risk score?
Lower is better. Scores in the green band are generally acceptable, while red scores need action before work goes on.
What is the difference between likelihood and severity?
Likelihood is how often the harm could happen. Severity is how serious the harm would be.
Can I use a 3×3 or 4×4 matrix instead?
Yes. The method is the same, only with fewer levels. Use the size your company or client asks for.
How often should I review a risk assessment?
Review it when the job, the place or the people change, after any incident or near miss, and at least once a year.
Learn this properly
Risk assessment methods like the risk matrix are covered in NEBOSH, IOSH and OSHA courses. ISH Institutes teaches these in Peshawar. Chat with us on WhatsApp and we will help you pick the right course.