The Definition of Risk Matrix

Definition of Risk Matrix

A risk matrix is a grid used to rate risk by plotting how likely an event is against how severe its consequences would be. Each cell in the grid gives a risk level, often color coded as green, yellow, orange and red, or labeled low, medium, high and extreme.

Risk matrices are one of the most common tools used in the analysis step of a risk assessment. They give teams a consistent way to compare very different hazards, such as a chemical splash and a vehicle collision, and decide which ones need action first. IEC 31010, the international guide to risk assessment techniques that supports ISO 31000, includes the consequence and likelihood matrix as one recognized technique.

A risk matrix is a form of qualitative risk assessment. Some organizations add numerical ranges to the categories to make it semi-quantitative.

How a Risk Matrix Is Built

Likelihood scale

The likelihood axis describes how probable it is that harm will occur. Typical categories run from rare or improbable to almost certain or frequent. Good matrices define each category in practical terms, such as "could happen once in the life of the site" or "happens several times a year."

Severity scale

The severity axis describes the worst credible outcome. For safety, categories often range from first aid only, through medical treatment and lost time injury, to permanent disability or fatality. Some organizations add columns for environmental, property and reputational impact.

Risk levels

Each cell combines one likelihood level with one severity level. Some matrices multiply numerical scores, such as 1 to 5 on each axis, to produce a score from 1 to 25. Others simply assign a risk level to each cell. The organization then sets what each level means, such as "stop work until controls are added" for the highest level.

Common sizes

• 3x3: simple and quick, suited to field checks.
• 4x4 or 4x6: used in some industry and military systems.
• 5x5: the most common format in workplace safety programs.

An Established Example: MIL-STD-882E

The US Department of Defense standard practice for system safety, MIL-STD-882E, contains a widely referenced risk assessment matrix. It uses four severity categories (1 Catastrophic, 2 Critical, 3 Marginal and 4 Negligible) and six probability levels (A Frequent, B Probable, C Occasional, D Remote, E Improbable and F Eliminated). The combination gives a risk assessment code, such as 1A or 3C, that maps to a risk level of High, Serious, Medium or Low. Many civilian matrices follow a similar pattern.

Using a Risk Matrix Well

Steps

• Identify the hazard and describe the worst credible outcome, not the worst imaginable one.
• Rate severity and likelihood with the current controls in place, using the defined categories.
• Read the risk level from the matrix and compare it with your acceptance criteria.
• Add controls using the hierarchy of controls and rate the risk again to find the residual risk.
• Record both ratings, for example in a risk register or job hazard analysis.

Good practices

• Write clear definitions for every category so different people rate the same hazard the same way.
• Rate as a group, including people who do the work, to reduce individual bias.
• Treat high-severity hazards seriously even when they seem unlikely. Fatal and life-altering events are often rated low likelihood right up until they happen.
• Use the matrix to support judgment, not to replace it.

Limitations of Risk Matrices

• Subjectivity: likelihood is often a guess, and two teams may rate the same hazard differently.
• Coarse categories: very different risks can land in the same cell, and small changes can move a risk across a boundary.
• Multiplying scores can mislead: a frequent minor injury and a rare fatality can produce the same score even though they need very different responses.
• Single scenario focus: a matrix usually rates one outcome per hazard, even though a hazard can lead to several outcomes.

For complex or high-consequence processes, a matrix is often paired with more detailed methods such as a quantitative risk assessment or a process hazard analysis.

Example of Risk Matrix

A landscaping company used a 5x5 matrix to review its mowing operations. Operating ride-on mowers near a steep pond bank was rated "possible" likelihood and "fatal" severity because of rollover and drowning risk, which placed it in the red zone.

The company marked a no-mow buffer around the pond, switched to string trimmers on the steepest section and required ride-on mowers with rollover protection and seat belts elsewhere. The team re-rated the hazard as "rare" and "major," moving it into the yellow zone, and recorded that rating as the residual risk to be reviewed each season.

Frequently Asked Questions: Risk Matrix

What is a 5x5 risk matrix?

It is a grid with five likelihood levels and five severity levels, giving 25 possible combinations. Scores are often calculated by multiplying the two ratings, from 1 for the lowest risk to 25 for the highest.

Is a risk matrix required by OSHA?

No. OSHA does not require a risk matrix. It is a voluntary tool, although many organizations use one to meet risk assessment requirements in ISO 45001 or their own safety programs.

Should I rate risk before or after controls?

Both. Rating with existing controls shows the current risk, and rating again with proposed controls shows the residual risk. Some organizations also record the inherent risk before any controls.

Can I design my own risk matrix?

Yes. Many organizations tailor the categories and risk levels to their operations. The key is clear definitions, consistent use across the organization and agreed actions for each risk level.