Risk Matrix

The risk matrix is used to assess and score every hazard in your risk assessment. It combines severity (how serious the harm could be) and likelihood (how likely it is to happen) to give an overall risk rating.

How the risk matrix works

For each hazard, you assess two factors:

Severity

How serious the harm could be if the hazard causes an incident.

Score	Level	Description
1	Negligible	Minor injury requiring no treatment or first aid only
2	Minor	Injury requiring medical attention but no lost time
3	Moderate	Injury causing lost time or requiring hospital treatment
4	Major	Serious injury, permanent disability, or major health effect
5	Catastrophic	Death or multiple serious injuries

Likelihood

How likely the harm is to occur, considering current conditions and controls in place.

Score	Level	Description
1	Very unlikely	Could happen but only in exceptional circumstances
2	Unlikely	Could happen but is not expected
3	Possible	Might happen at some point
4	Likely	Will probably happen in most circumstances
5	Very likely	Expected to happen regularly or almost certainly

Risk rating

The risk rating is calculated by multiplying severity by likelihood:

Risk = Severity × Likelihood

Rating	Level	Action required
1-4	Low (green)	Manage by routine procedures. Monitor and review.
5-9	Medium (amber)	Specific controls required. Review regularly.
10-15	High (orange)	Significant controls needed. Senior management attention.
16-25	Very high (red)	Work must not proceed until risk is reduced. Immediate action required.

[Screenshot: 5x5 risk matrix grid showing colour-coded risk ratings]

Scoring hazards in your documents

Each hazard in your risk assessment is scored twice:

1. Before controls (inherent risk)

Score the severity and likelihood as if no control measures were in place. This represents the worst-case scenario.

2. After controls (residual risk)

Score the severity and likelihood with your control measures applied. This shows how effective your controls are at reducing the risk.

The difference between the two scores demonstrates the value of your controls. If the residual risk is still high, you need additional or better controls.

Example

Hazard	Before controls	After controls
Falls from 4m scaffold	Severity: 5 × Likelihood: 4 = 20 (very high)	Severity: 5 × Likelihood: 1 = 5 (medium)

In this example, the severity stays at 5 (a fall from 4m is always potentially fatal) but the likelihood drops from 4 to 1 because the controls (edge protection, harness, trained workers, scaffold inspection) make a fall very unlikely.

Note

Severity scores rarely change between before and after controls. Controls reduce the likelihood of harm occurring, not the severity of harm if it does occur. If your severity score is dropping significantly, check whether you are scoring correctly.

Customising the risk matrix

Your organisation can customise the risk matrix in Settings > Organisation > Risk Matrix Configuration:

• Scale — use a 3×3, 4×4, or 5×5 matrix depending on your preference
• Labels — rename the severity and likelihood levels to match your organisation’s terminology
• Colour thresholds — adjust which scores are green, amber, orange, and red
• Descriptions — edit the descriptions for each level

Changes to the risk matrix apply to all new documents. Existing documents retain the matrix settings that were in place when they were created.

Tip

If you are unsure which matrix to use, the default 5×5 matrix follows the widely-used HSE guidance and is appropriate for most organisations.

Common mistakes

• Scoring too low before controls — be honest about the inherent risk. If a fall from 6m could kill someone, the severity is 5 regardless of your controls.
• Reducing severity after controls — controls reduce likelihood, not severity. A hard hat does not make a falling brick less dangerous — it makes a head injury less likely.
• Identical before/after scores — if your scores do not change, your controls are not doing anything. Review whether the controls are appropriate.
• All hazards scored the same — if every hazard has the same risk rating, the assessment is not differentiating between risks. Some hazards should be higher than others.