Table of Contents
How to use a risk matrix (with a free 5×5 template)
A practical guide to rating and prioritising WHS risks, with a free Excel template
A risk matrix is the most common tool Australian workplaces use to assess risk. It turns two questions, how likely is it, and how bad could it be, into a rating that helps you decide which risks to deal with first.
This guide explains how a 5×5 risk matrix works, walks through a worked example, covers what WHS law does and doesn't require, and gives you a free template you can use straight away.
What is a risk matrix?
A risk matrix (also called a risk assessment matrix or hazard matrix) is a grid. One axis rates the likelihood that harm will occur. The other rates the consequence, meaning how severe the harm would be. Where the two meet, you get a risk rating, usually Low, Medium, High or Extreme.
The most widely used version in Australia is the 5×5 matrix, with five levels of likelihood and five levels of consequence. Some businesses use a 3×3 or 4×4 matrix. Fewer levels are quicker to use but less precise, while a 5×5 gives enough range to separate a minor cut from a fatality without becoming complicated.
The likelihood scale
How likely is it that the harm will happen, taking into account the controls already in place?
- Rare: may happen only in exceptional circumstances.
- Unlikely: could happen at some time, but isn't expected.
- Possible: might happen at some time.
- Likely: will probably happen in most circumstances.
- Almost certain: is expected to happen in most circumstances, or happens regularly.
The consequence scale
If it did happen, what is the most likely serious outcome?
- Insignificant: no injury, or first aid only.
- Minor: an injury needing medical treatment, with no lost time.
- Moderate: an injury causing lost time, or a short-term illness.
- Major: a serious injury or illness, such as hospital admission or permanent impairment.
- Catastrophic: death, or a permanent disabling injury or illness.
These descriptions are a starting point. Adjust them so they make sense for your business, then use them consistently. A risk matrix is only useful if two people assessing the same hazard would reach a similar rating.
Reading the rating
Multiply the likelihood score by the consequence score to get a number from 1 to 25, then convert it to a rating:
- Low (1–3): manage through routine procedures and review periodically.
- Medium (4–6): act within a set timeframe, make sure a supervisor is aware, and monitor the controls.
- High (8–12): act promptly. Senior management attention is needed, and new work shouldn't start until further controls are in place.
- Extreme (15–25): stop the work, or don't start it, until the risk is reduced. Escalate immediately.
The action you attach to each rating should reflect your business. What matters is that everyone knows what a High or Extreme rating triggers, and who has to be told.
How to use a risk matrix, step by step
1. Identify the hazard
Be specific. "Forklifts" is a hazard category. "A forklift striking a pedestrian at the loading dock" is something you can assess. Walk the workplace, look at incident and near-miss reports, and talk to the workers who do the job.
2. Note the controls already in place
Record what is already there, such as guarding, procedures, training or PPE. You are rating the risk as it actually is today.
3. Rate the consequence
Ask what the most likely serious outcome would be, not the absolute worst case you can imagine and not the best case. If the realistic outcome of a fall from a 3-metre mezzanine is a serious injury, that is Major, even though a fatality is possible.
4. Rate the likelihood
Ask how likely that outcome is with the current controls. Use evidence where you can: your own incident history, industry data, and what workers tell you about how the job is really done.
5. Read off the rating and decide what to do
Find the rating on the matrix and apply the action for that band. Then work through the hierarchy of controls to decide what further controls are needed, starting with elimination, then substitution, isolation and engineering controls, and only then procedures and PPE.
6. Re-rate the residual risk
Once you have chosen further controls, rate the risk again assuming they are in place. This residual rating shows whether the new controls are enough, and gives you something to check against later.
Worked example: forklifts at a loading dock
A distribution business has forklifts loading trucks at a dock that pedestrians also walk through. Current controls are licensed operators and speed limit signs.
- Consequence: a forklift striking a person could cause a crush injury. The realistic serious outcome is Major (4).
- Likelihood: with only signs and licensing, and pedestrians sharing the space, it is Possible (3).
- Rating: 4 × 3 = 12, which is High. Senior management needs to act promptly.
Further controls, working down the hierarchy:
- physical barriers separating the pedestrian walkway from the forklift route (isolation)
- a designated loading zone that pedestrians can't enter while forklifts operate (isolation)
- blue spot lights and proximity sensors on forklifts (engineering)
- an updated traffic management plan and induction for drivers and visitors (administrative)
With these in place, the consequence if a collision did occur is still Major (4), but the likelihood drops to Rare (1). The residual rating is 4 × 1 = 4, which is Medium: acceptable for now, with the controls monitored and reviewed.
Notice that the consequence didn't change. Most controls reduce how likely harm is, not how bad it would be. Only eliminating the hazard, or substituting something less dangerous, usually changes the consequence.
Does WHS law require a risk matrix?
No. The model WHS laws, which apply in every state and territory except Victoria, don't require you to use a risk matrix or any particular risk assessment method. Victoria's Occupational Health and Safety Act 2004 doesn't either.
What the law does require, under section 17 of the model WHS Act, is that you eliminate risks so far as is reasonably practicable and, where that isn't possible, minimise them so far as is reasonably practicable. A risk assessment is one way of working out how to do that. Safe Work Australia's model Code of Practice, How to manage work health and safety risks, notes that a risk assessment isn't always needed. For example, if the hazard and its controls are already well known and documented in a regulation, a code of practice or industry guidance, you can simply put those controls in place.
This is the most important point about risk matrices: a low rating doesn't make a risk legally acceptable. If there is a reasonably practicable way to eliminate or reduce a risk, you are expected to use it, whatever colour the box is. The matrix helps you prioritise and communicate. It doesn't decide what is reasonably practicable.
That responsibility sits with the PCBU (see what is a PCBU?), and directors and senior managers have a personal duty to make sure risk management processes are in place and actually working. See officer due diligence under the WHS Act.
Assess and control risks with confidence
Common mistakes with risk matrices
- Undefined scales. If "Possible" and "Likely" mean different things to different people, the ratings become guesswork. Write the definitions down and agree on them.
- Rating the worst imaginable case every time. If everything is Catastrophic, the matrix can't help you prioritise. Rate the most likely serious outcome.
- Rating risks alone at a desk. The workers who do the job know how it is really done. You also have a legal duty to consult them on identifying hazards and deciding on controls.
- Underrating high-consequence, low-likelihood events. A fatality that is "rare" can still land in a Medium box. Don't let that hide risks that deserve attention, especially where a fatal outcome is possible.
- Treating the rating as the outcome. The goal isn't a coloured box. It is a set of controls that are in place, working and reviewed.
- Filing it and forgetting it. Review your assessments after incidents and near misses, when something changes, and when workers raise concerns.
Free 5×5 risk matrix template
Our free Excel template includes:
- a 5×5 risk matrix with likelihood and consequence descriptions you can edit
- a risk register with drop-downs that calculates the risk rating automatically, before and after further controls
- a column for the hierarchy of controls level of each new control, plus owner, due date and status
- a worked example, and instructions on one page
It works in Microsoft Excel, Google Sheets and LibreOffice.
Download the free 5×5 risk matrix template (Excel)
The template is general guidance. Adapt it to your business and check the laws, regulations and codes of practice that apply in your state or territory. This article isn't legal advice.
