How to make a risk matrix: example with scales, colour zones and worked scores

What is a risk matrix and how do you calculate the risk score?

A risk matrix sets the likelihood that something happens against the effect if it does happen. That effect is also called severity or consequence. Likelihood usually sits on the vertical axis and severity on the horizontal axis. Each cell is a combination, and its colour shows how heavily the risk weighs. That way you see at a glance which risks to tackle first.

Calculating the risk score is simple: likelihood times severity. With a likelihood of 3 and a severity of 4, the score is 12. That result is not a measurement but a structured estimate. The aim is a ranking that tells you where measures are needed first, and that only works if everyone reads the scale in the same way.

3x3, 4x4 or 5x5 risk matrix: which layout suits you?

The number shows how many levels likelihood and severity each have. A larger matrix distinguishes more finely, but also demands stricter definitions. Choose the smallest layout your team can score with consistently, and use the same layout across the whole organisation: a production risk and a purchasing risk are only comparable on the same matrix. These are the three common layouts:

• 3x3: three levels per axis, for example low, medium and high. Suitable for small organisations and a quick first round. Drawback: many risks end up in the middle cell, so there is no real ranking.
• 4x4: four levels per axis. There is no neutral middle cell, so you have to lean towards the light or the heavy side. A good compromise if 3x3 feels too coarse.
• 5x5: five levels per axis, with scores from 1 to 25. Widely used and fine enough to set priorities, but only workable if every level is described precisely.

Defining likelihood and severity so two people score the same

The weakest point of any risk matrix is a scale with only words such as small, moderate and large. Two colleagues read two different things into them. Give every level a description you can check: for likelihood a frequency or an experience from your own company, for severity the concrete consequence for people, the environment, quality or money.

Also record what you are assessing: the most likely consequence or the worst conceivable one. For safety, many organisations choose the realistic worst consequence. Then test the scale with a calibration round: have three or four people score five existing situations independently and discuss the differences. If scores differ by two levels, the description is not sharp enough.

Example of a likelihood scale and a severity scale

Below is an illustrative example of a 5x5 layout. The descriptions and numbers are examples. Adapt them to your company, your sector and your own incident history, and record the choice in your risk policy so that everyone works with the same scale.

• Likelihood 1, very unlikely: rarely occurs in the sector and has never happened here.
• Likelihood 2, unlikely: has happened elsewhere in the sector, not yet here.
• Likelihood 3, possible: has happened here now and then, roughly once every few years.
• Likelihood 4, probable: happens here at least once a year.
• Likelihood 5, very probable: happens here several times a year or almost daily.
• Severity 1, negligible: no injury, no damage, no effect on the customer.
• Severity 2, minor: minor injury treated with first aid, small damage or a complaint that was resolved quickly.
• Severity 3, moderate: injury with absence from work, noticeable damage or delay, a formal complaint.
• Severity 4, serious: serious injury with hospital admission, major damage or loss of an important customer.
• Severity 5, catastrophic: fatality or permanently disabling injury, major environmental damage or a company shutdown.

Colour zones: what do you do at green, yellow, orange and red?

A score means nothing as long as no agreement is attached to it. Link a fixed action, a responsible person and a deadline to each colour. The law does not prescribe a colour scheme, so this is an agreement within your organisation. Align it with your prevention officer or occupational health service. The limits below are illustrative for the 5x5 example.

• Green, score 1 to 4: acceptable. Extra measures are not needed; keep the existing controls in place and reassess the risk in the next round.
• Yellow, score 5 to 9: plan measures. Within an agreed period, for example three months, decide which measures are reasonable and who takes them on.
• Orange, score 10 to 15: take measures quickly. A line manager draws up a plan with an owner and a short deadline, for example within a month, and temporary measures apply until then.
• Red, score 16 to 25: intervene immediately. The work does not start, or stops, until measures have been taken, and management is informed.
• Exception for severity 5: a risk with likelihood 1 and severity 5 scores only 5 (yellow), while a single incident could be fatal. Therefore always have risks with the highest severity reviewed by management or a second assessor, however low the score.

Residual risk after measures and risk acceptance

Assess every risk twice: without extra measures and then with the measures you choose. What remains is the residual risk. A measure lowers the likelihood, the severity or both. Work in the STOP order: first remove or replace the hazard (substitution), then technical measures, then organisational measures and only last personal protective equipment.

Score the residual risk only once the measure is in place, not on the basis of a plan. If the residual risk still falls in orange or red, extra measures are needed or an authorised person decides to accept it knowingly. Record that acceptance with name, date and reason, and set a date to reassess.

A risk score goes out of date. Plan a fixed reassessment, for example yearly, and also reassess after an incident, a near miss, a refurbishment, a new machine or an audit finding. Without that round, the matrix remains a snapshot of the day it was filled in.

Risk matrix or Kinney & Wiruth: what is the difference?

The risk matrix uses two factors: likelihood and severity. The Kinney & Wiruth method adds exposure, meaning how often or how long people are exposed to the hazard. That lets Kinney distinguish better between a hazard someone faces daily and one that rarely arises. The calculation is explained under the term Kinney method.

Choose one method per register and do not switch per risk, otherwise the scores are not comparable. A matrix suits broad use by many people and risks you want to rank quickly. Kinney suits a risk assessment in which the duration of exposure makes a big difference.

Worked example: scoring and rescoring four risks

A company with a warehouse, assembly and lifting work scores four risks using the scales and zones above. All figures are illustrative. For each risk you see the score without extra measures, the measure and the score afterwards. Note that the measures mainly lower the likelihood and that the severity stays the same.

The lifting risk shows why the severity rule matters. Despite the low score of 5, the severity remains 5, so management reviews the residual risk and records the acceptance. The slipping risk stays yellow, which can be acceptable if the line manager records the acceptance with a date and plans a reassessment.

• Cut injury during assembly with a utility knife: likelihood 4, severity 2, score 8 (yellow). Measure: safety knife with a retractable blade and cut-resistant gloves. Afterwards likelihood 2, severity 2, score 4 (green).
• Collision between forklift and pedestrian in the warehouse: likelihood 3, severity 4, score 12 (orange). Measure: separate walkways and a maximum speed. Afterwards likelihood 2, severity 4, score 8 (yellow).
• Employee walks under a suspended load: likelihood 4, severity 5, score 20 (red). Measure: lifting stops until the zone is cordoned off, then a permanent barrier around the lifting zone. Afterwards likelihood 1, severity 5, score 5 (yellow).
• Slipping on a wet floor at the loading door: likelihood 3, severity 3, score 9 (yellow). Measure: drainage and a mat at the door plus a fixed cleaning round. Afterwards likelihood 2, severity 3, score 6 (yellow).

Common mistakes with a risk matrix

Most problems with a risk matrix are not calculation errors but agreements that are missing or not followed. Go through the list below before you put the matrix into use, and for an existing matrix discuss which points apply to you. One agreed correction per point is often enough to make the scores usable again.

• The scale is not defined, so everyone gives moderate or large a different meaning.
• Everything turns yellow: out of caution everyone picks the middle. Ask for a practical example with every score.
• One person scores alone. The people who do the work know likelihood and consequence best.
• There is no reassessment, not even after an incident or change, so scores go out of date.
• The residual risk is filled in on the basis of a plan instead of a measure that actually works.
• No action, owner or deadline is attached to the colours, so a red risk goes unnoticed.
• Rare risks with very serious consequences disappear among the low scores because there is no severity rule.
• Two matrices side by side in the same organisation, so risks cannot be compared.

How BrydgeOne supports this

In the Risks & opportunities module, an administrator sets up the matrix: the size (3×3, 4×4 or 5×5), the names, the score calculation and, per level, the limit and colour. For each risk you record the residual risk, expected or assessed, and a risk acceptance requires justification. Evaluations are kept with their full history and measures become actions in the central action list.

For one concrete task you use the TRA, in which you assess the risk per task step with measures and residual risk. In Risk assessment & action plan you choose measures with the STOP wizard, which flow on to the action list. This gathers evidence for how you address risks and opportunities (clause 6.1 of ISO 9001 and ISO 45001). BrydgeOne helps you collect that evidence; certification is done by a certification body.