Risk Matrix

A risk matrix is a grid used to rate risk by combining two factors: the likelihood that a hazard will cause harm and the severity of that harm. Each hazard is placed in a cell of the grid, and the cell's score or color shows whether the risk is low, medium or high. Risk matrices are also called risk assessment matrices or likelihood and consequence matrices.

Risk matrices matter because safety teams rarely have the time or money to fix every hazard at once. A matrix gives a simple, consistent way to compare very different hazards, decide which need action first and show leaders where the biggest risks are.

What Is a Risk Matrix?

A risk matrix has likelihood on one axis and severity on the other. The point where they meet gives a risk rating. It is one of the most common tools used in a risk assessment and a job hazard analysis, and it appears in many safety management systems and industry standards. The international risk assessment techniques standard IEC 31010 describes the consequence and likelihood matrix as a common screening tool, and the U.S. Department of Defense's system safety standard, MIL-STD-882E, uses a risk assessment matrix with four severity categories and six probability levels.

3x3 vs. 5x5 Risk Matrices

• 3x3 matrix: three likelihood levels (unlikely, possible, likely) and three severity levels (minor, moderate, major). Simple and quick, and useful for toolbox talks and field-level assessments, but it offers limited detail.
• 4x4 matrix: a middle option that removes the neutral midpoint, so assessors must choose a direction.
• 5x5 matrix: five levels on each axis, giving 25 cells. It is the most common format in workplace safety because it separates hazards more finely without becoming hard to use.

Likelihood and Severity Scales

A matrix only works if everyone uses the same definitions. A typical 5x5 scale might look like this:

Likelihood

• 1 Rare: could happen only in exceptional circumstances.
• 2 Unlikely: could happen but is not expected.
• 3 Possible: might happen at some point.
• 4 Likely: will probably happen in most circumstances.
• 5 Almost certain: expected to happen regularly.

Severity

• 1 Insignificant: no injury or first aid only.
• 2 Minor: medical treatment, no lost time.
• 3 Moderate: restricted work or lost-time injury.
• 4 Major: serious injury such as an amputation or fracture, or permanent impairment.
• 5 Catastrophic: fatality or multiple serious injuries.

Where possible, attach examples or frequencies to each level, such as "once a year at this site", so different assessors reach similar ratings.

Risk Scoring and Color Bands

In a 5x5 matrix, the risk score is often calculated as likelihood multiplied by severity, giving a score from 1 to 25. Scores are grouped into color bands with required responses. One common example:

• Green, low (1-4): acceptable with existing controls. Monitor.
• Yellow, medium (5-9): reduce where practicable. Assign actions with deadlines.
• Orange, high (10-16): priority action required. Senior approval needed to continue.
• Red, extreme (20-25): stop or do not start the work until risk is reduced.

Bands and actions vary by organization. Many companies also set a rule that any hazard with catastrophic severity requires management review, no matter how unlikely it is rated.

Limitations of Risk Matrices

Risk matrices are useful but imperfect. Researchers, notably Tony Cox in a 2008 paper in the journal Risk Analysis, have shown that matrices can rank risks inconsistently. Common problems include:

• Subjectivity: two people can rate the same hazard differently.
• Range compression: very different risks can land in the same cell.
• Multiplication effects: a rare but fatal hazard may score the same as a frequent minor one.
• False precision: numbers can suggest more accuracy than the data supports.

Use the matrix to support judgment, not replace it, and use more detailed methods for complex or high-consequence hazards.

How to Use a Risk Matrix Step by Step

1. Define the scales. Agree on written definitions for each likelihood and severity level.
2. Identify hazards. List the hazards for the task, area or process.
3. Rate severity. Rate the most credible serious outcome, not the best case.
4. Rate likelihood. Consider exposure frequency, history, near misses and the strength of existing controls.
5. Score and band. Find the cell, record the score and note the required response.
6. Add controls. Apply the hierarchy of controls to higher-risk items.
7. Re-rate residual risk. Score the hazard again with the new controls to confirm the risk is acceptable.
8. Review. Reassess after incidents, changes or at set intervals.

Common Mistakes to Avoid

• Using undefined scales, so ratings depend on who is holding the pen.
• Reducing severity because PPE is worn, when the possible injury is unchanged.
• Rating only the most likely outcome and missing low-probability, high-severity events.
• Treating the matrix score as the final answer instead of a prompt for action.
• Rating risk once and never revisiting it.

How SMS360 Helps

SMS360's Risk Assessment module lets teams rate hazards by likelihood and severity, record controls and capture initial and residual risk ratings. Actions for higher-risk items can be assigned and tracked through Actions Management, and Analytics & Reports help leaders see where high risks are concentrated.

Frequently Asked Questions

Is a 5x5 risk matrix better than a 3x3?

A 5x5 matrix gives finer distinctions between hazards and is the most common choice in workplace safety. A 3x3 matrix is simpler and can work well for quick field assessments. The best choice is the one your teams can apply consistently.

Does OSHA require a risk matrix?

No OSHA standard requires a risk matrix. OSHA's Recommended Practices for Safety and Health Programs encourage employers to identify, assess and prioritize hazards, and a matrix is one common way to do that.

Should severity be rated with or without PPE?

Rate severity based on the credible worst outcome. PPE and most other controls mainly reduce likelihood, so severity usually stays the same between initial and residual ratings unless the control reduces the energy or quantity involved.

What is the difference between a risk matrix and a risk register?

A risk matrix is the scoring tool. A risk register is the list of identified risks, their ratings, owners and controls. Most risk registers use a matrix to score each entry.