A risk matrix combines judgements about likelihood and severity to help prioritise action. A 5 × 5 grid is one option; 3 × 3 and 4 × 4 grids are also used. This page explains an illustrative scoring system and its limitations. There is no single legally prescribed UK matrix.
The matrix is a tool, not a method. It's part of step three of the risk assessment process — the evaluation step — and supports decisions about which hazards need urgent action and which can wait. It doesn't replace the judgement that good assessment depends on, and it isn't legally required. The Management of Health and Safety at Work Regulations 1999 require a "suitable and sufficient" assessment; they don't prescribe how the scoring should be done.
Why use a matrix at all
A matrix can support communication and comparison when users share clear definitions. It does not guarantee that different assessors will give the same score or that the resulting order of priorities is correct. Consider the hazard, controls and legal requirements alongside any number.
The thing the matrix is not good at is producing a precise estimate of harm. We'll come back to that.
The 5x5 matrix
In this 5 × 5 example, each axis has five levels. Multiplying the two ratings produces a score from 1 to 25. Colours can help communicate action categories, but the definitions and thresholds are local conventions rather than national legal standards.
The grid has 25 cells. This page uses example bands of 1–4, 5–9, 10–16 and 17–25. Other organisations use different bands, and not every whole number is a possible product of two integers from one to five.
Defining the likelihood axis
The labels on the likelihood axis are less important than what they mean in practice. Common UK conventions use five levels with names like Rare, Unlikely, Possible, Likely, and Almost Certain — but the names matter less than the descriptions an organisation attaches to them.
Rare (1)
The hazard could cause harm only in exceptional circumstances. Reasonable controls are already in place. You wouldn't expect this to happen in the working lifetime of the equipment or process.
Unlikely (2)
Conceivable but not expected. Most controls are effective. Realistically, you might see this happen once in many years.
Possible (3)
In this illustrative scale, the event is credible under the defined conditions. Set a common time period and exposure basis before assigning a label; “once a year” means different things for one task and for an entire workforce.
Likely (4)
Expected to happen unless additional controls are put in place. Existing controls are partial. Could be expected to occur multiple times a year.
Almost Certain (5)
In this illustrative scale, the event is expected under the defined conditions. Consider actual exposure and control performance; the label should not be assigned solely from the absence of a particular control.
The trick to consistent scoring is to anchor the levels in real frequency or probability — actual time periods or actual exposure rates — rather than just feel. "Once a year across this site" gives a more consistent answer than "unlikely" on its own.
Defining the severity axis
The severity axis describes how bad the harm would be if it occurred. For health and safety, the levels usually map to injury severity outcomes.
Insignificant (1)
No injury, or first-aid level only. No lost time. A minor cut treated with a plaster.
Minor (2)
Injury requiring more than first aid but no lasting effect. Sprained wrist, mild cut needing stitches, a day off work.
Moderate (3)
Injury with a substantial temporary effect, such as a significant fracture. This is an example severity label. RIDDOR reportability depends on the reporting rules, not the score or band.
Major (4)
Serious harm with lasting effects, such as permanent loss of function. Hospital admission for seven days is not itself a general RIDDOR reporting threshold.
Severe (5)
Fatal injury, permanent and life-changing disability, or harm to multiple people simultaneously.
For non-injury harm — health damage, occupational disease, mental ill-health — the same five levels apply but the outcomes look different. A short period of work-related stress might score 2. A persistent musculoskeletal disorder that ends a career might score 4. A fatal asbestos-related disease scores 5 even though the harm appears decades after exposure.
Calculating and reading the score
The arithmetic is simple. Likelihood × Severity. A possible (3) chance of a major (4) injury scores 12. A rare (1) chance of a severe (5) outcome scores 5.
This example uses four bands; they are prompts for decisions, not automatic declarations of legal acceptability:
Low (1–4 in this example): green
Check that required controls and relevant good practice are in place. Maintain and monitor effective precautions. A low score does not excuse an unmet legal requirement or an obvious practicable improvement.
Medium (5–9 in this example): amber
Examine the existing controls, uncertainty and further action needed. Set an appropriate priority and deadline; no part of this band automatically justifies leaving a known deficiency unresolved.
High (10–16 in this example): orange
Controls are inadequate. Specific further action is needed. Work may need to be paused or modified until controls are improved.
Critical (17–25 in this example): red
Stop the activity. Significant remediation needed before work resumes.
Band boundaries are conventions. Apply them consistently, but ensure that severe consequences and uncertain controls receive proper consideration even where a multiplication produces a lower score.
When to use 3x3 or 4x4 instead
For very simple operations, a 3x3 matrix is often more honest about the precision of the underlying judgements. Three likelihood levels (Unlikely, Possible, Likely) and three severity levels (Minor, Serious, Major) produce a 9-cell grid that's easier to use, harder to overcomplicate, and just as useful for low-complexity workplaces.
A 4x4 sits in between, with four severity levels that are sometimes easier to distinguish than five.
Choose a method proportionate to the task and the evidence available. A 5 × 5 matrix can be useful, but it is not a universal default, and a straightforward assessment may not need numerical scoring at all.
The limitations every assessor should know about
The matrix has real limitations. Knowing them is part of using it responsibly.
Subjectivity, dressed as precision
The categories are judgements, not precise measurements of probability or harm. Multiplying ordinal ratings produces an index for discussion; a score of 12 is not a measured quantity or necessarily twice the risk of 6.
Range compression
Different combinations can produce the same score despite needing different precautions. For example, rare × severe gives 5 in this scheme, which is in the medium band. Review serious consequences directly rather than letting a lower product obscure them.
The medium-band trap
Hazards that land in the amber band tend to stay in the amber band because they're "tolerable" without being urgent. Years pass, the action column shows the same outstanding item, and the matrix has effectively endorsed inaction. Good assessors revisit amber items deliberately rather than accepting them as the steady state.
Hidden assumptions about controls
The likelihood score reflects whatever controls are already in place. If a worker says "we tape the floor up properly so slipping is unlikely", the score might be 2 — but only as long as the floor actually gets taped. The matrix doesn't capture the fragility of the controls; the assessment narrative has to.
Mathematical objections
Published research has identified problems with ordinal matrices, including ranking and resolution limitations. Treat the grid as a decision aid and document the reasoning, assumptions and controls behind the rating.
None of this means the matrix is useless. It means it should be used as a prompt for judgement rather than a substitute for it.
A worked example
A small printing workshop assesses the risk of a worker being injured by the cutting blade on a guillotine that's used daily.
Illustrative example: a guillotine has appropriate front and rear safeguarding, a suitable control system, maintenance and trained operators. A competent assessment verifies that these safeguards meet the machine’s requirements before considering a rating. Two-hand controls alone are not sufficient protection.
The severity if it did go wrong is significant. The blade could cause severe lacerations or amputation. Severity: major (4).
Using the example ratings only: 2 × 4 = 8, in this page’s medium band. This arithmetic does not establish that the machine is adequately safeguarded.
The assessor must check the machine-specific safeguarding requirements, inspection and maintenance, operating practices and foreseeable misuse. Any required improvement must be implemented; the score cannot justify rejecting safeguards on cost grounds without applying the relevant legal duties.
The useful result is the documented assessment of controls and actions. A matrix score alone does not establish a defensible or legally compliant outcome.
Where the matrix fits in the wider method
The matrix is one input to the five-step risk assessment process. It sits inside step three (evaluate the risks and decide on precautions) and supports the prioritisation of any further actions identified in step four (record findings and implement). It doesn't replace the hierarchy of control — even a low-scored hazard might justify engineering controls if the engineering is cheap and reliable, and a high-scored hazard isn't dispatched just by adding PPE.
For complex or technical assessments — especially those covered by specific regulations like COSHH, the Manual Handling Operations Regulations or the Regulatory Reform (Fire Safety) Order 2005 — the matrix sits alongside the regulation-specific tools rather than replacing them.
If you're carrying out assessments routinely and your matrix conventions aren't yet documented, that's worth fixing. The single biggest improvement we see in organisations is when likelihood and severity get anchored in concrete, organisation-specific descriptions rather than generic adjectives. The investment shows up in better consistency between assessors and better defensibility when something goes wrong. Formal Risk Assessment Training covers both the matrix itself and the underlying method.
Frequently asked questions
Is a 5x5 risk matrix legally required in the UK?
No. The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient assessment of risk but don't specify a particular scoring method. The 5x5 matrix is widely used because it's reasonably consistent and easy to communicate, not because the law mandates it.
What's the difference between likelihood and severity?
Likelihood is how probable it is that the hazard will actually cause harm, given the controls already in place. Severity is how bad the harm would be if it did occur. Both are estimates; multiplying them gives the risk score.
Can I use a 3x3 matrix instead?
Yes. A 3x3 matrix is often a better fit for simple operations because it doesn't pretend to more precision than the underlying judgements can support. Some HSE-published example assessments use a simplified risk rating rather than a numerical matrix at all.
Do I have to use the same matrix conventions across the whole organisation?
Not legally, but it's strongly recommended. Different scoring conventions on different sites mean that the same hazard could rank differently in different reports, which makes prioritisation across the organisation harder and exposes inconsistencies in any inspection.
What are the main limitations of a risk matrix?
The big four are subjectivity in scoring, range compression that pushes most hazards into a narrow band, the tendency for medium-band items to stay medium-band indefinitely, and the matrix's blindness to how fragile the controls behind the likelihood estimate actually are. The matrix is a prompt for judgement; it's not a calculation of harm.
Related guides
- The 5 steps of risk assessment explained
- Risk assessment examples: three worked examples for UK workplaces
- Who can carry out a risk assessment? The competence question explained
Sources & references
- HSE — Steps needed to manage risk
- Management Regulations, regulation 3
- HSE — Safe use of power-operated paper-cutting guillotines
- HSE — RIDDOR reportable incidents
- Original research — Problems with risk matrices using ordinal scales
Make sure your team can score and act on workplace risks with confidence.
Explore the Risk Assessment Training course →
Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.