A 5x5 risk matrix scores each hazard by multiplying two numbers, each from 1 to 5: how likely the harm is, and how bad it would be. The score, from 1 to 25, falls into one of four bands. Low is 1 to 4, Medium 5 to 9, High 10 to 16 and Critical 17 to 25. Score every hazard twice, once as you found it and once with your controls in place. One rule overrides the arithmetic: a hazard that could kill or cause a life-changing injury never sits below High.
For the rest of your risk assessment, see how to write a risk assessment.
Does the Law Require a Risk Matrix?
No. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make "a suitable and sufficient assessment" of the risks. A self-employed person whose work is construction work, or could put others at risk, has the same duty. The regulation does not say how to judge the risk. It names no matrix, no scale and no score.
HSE's guidance on managing risk asks you to "decide how likely it is that someone could be harmed and how serious it could be". HSE calls that "assessing the level of risk". Its own risk assessment template has no score column.
A matrix is a way of showing that judgement. It makes you judge likelihood and severity separately, puts the judgement where a reviewer can check it, and ranks the hazards so the worst get attention first. Clients and principal contractors often expect scores before and after controls, so you will probably use one anyway.
How to Score Likelihood
Likelihood is how probable the harm is on this job, with these people, in this place, as things actually stand.
| Score | Likelihood | What it means on the job |
|---|---|---|
| 1 | Rare | It would take an unusual chain of failures. |
| 2 | Unlikely | It could happen, but you would not expect it on this job. |
| 3 | Possible | It has happened on work like this before. |
| 4 | Likely | You would expect it to happen at some point on this job. |
| 5 | Almost certain | It will happen if the work goes ahead as it is. |
Three things move the number. How often the task is done and for how long: a ladder used once is not a ladder used all day. How many people are near it. And what is actually in place, not what should be.
Do not score from luck. "We have never had an accident" says little about the next job.
Likelihood is the hardest number to get right, because it is a judgement. If two people on the job would pick different numbers, talk it through and write down why you chose yours.
How to Score Severity
Severity is the worst outcome you could credibly expect if the harm happens. That is neither the most likely outcome nor the worst you can imagine.
| Score | Severity | What it means |
|---|---|---|
| 1 | Negligible | First aid on site, no time lost. |
| 2 | Minor | Treatment needed, back at work within days. |
| 3 | Moderate | A reportable injury, more than seven days lost, such as a back strain that keeps someone off work for over a week. |
| 4 | Major | A serious or permanent injury of a kind specified under RIDDOR, such as a broken arm, leg or wrist, or a serious burn. |
| 5 | Catastrophic | A fatality, or a life-changing injury. |
Reportable means it must be reported under RIDDOR, the injury reporting regulations.
Decide severity from what the harm would be, never from how likely it is. A fall through a fragile roof light could kill, however unlikely you think it is. That makes it a 5, Catastrophic.
Credible rules out the freak case. For a trip over a lead on a level floor, a fair worst case is a fall that breaks a wrist or ankle: a 4, because RIDDOR specifies any fracture other than to a finger, thumb or toe. A fatal fall is the freak case.
Ill health counts too. Dust, fume and noise do their harm slowly. Score the harm they can do over time, not how anyone feels at the end of the shift. Permanent hearing loss from noise, or lung disease from dust, is Major or worse, never Negligible.
How to Read a 5x5 Risk Matrix
Likelihood runs up the side and severity along the bottom. Each cell holds the score for that pair, with the safe corner bottom left and the danger top right. In this guide a score is always written likelihood first: 3 x 5 means Possible and Catastrophic.
| Band | Scores | What it means for the work, scored after controls |
|---|---|---|
| Low | 1 to 4 | Keep the controls in place, and add any cheap one you have missed. |
| Medium | 5 to 9 | Work can go ahead with the controls listed. Add any further control that is reasonably practicable. |
| High | 10 to 16, and the 1 x 5 cell | Needs additional controls or closer supervision before work starts. It goes into the method statement as a hold point, a planned check before work carries on. |
| Critical | 17 to 25 | Do not start until the risk has been brought down. |
Only 14 scores are possible. They are 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20 and 25. A score of 7, 14 or 18 means the multiplication is wrong.
The same score can mean very different risks. 5 x 1 and 1 x 5 both make 5. The first is a cut that is almost certain and needs a plaster. The second is a rare event that could kill. That is why the 1 x 5 cell is High, not Medium: a hazard with a severity of 5 never sits below High. It is the only cell where the band is not simply the arithmetic. HSE's workplace transport guidance counts among the higher risks "accidents that, however unlikely, could cause serious harm".
Critical needs both numbers high. Only three cells are Critical: 4 x 5, 5 x 4 and 5 x 5. To get there, the harm must be Major or Catastrophic, and Likely or worse.
The pair matters more than the total. "3 x 5 = 15, High" tells a reviewer how you got there. "15" on its own hides whether the problem is likelihood or severity, and so which control would help.
Scoring Before and After Controls
Before controls is the job as you found it, with only what is already there. After controls, often called the residual risk, is the job with every control in your assessment in place.
Controls almost always work on likelihood. Edge protection, an isolation, a barrier and a second person all make the harm less likely to happen. They do not make it less bad when it does. If severity drops after controls, ask what changed. Severity only drops when the hazard itself gets smaller, such as a lower working height or a less harmful product.
Score the controls you will have on the day. If the van does not carry a cable detector, the score cannot assume one.
Be careful with Rare. A control that depends on people doing the right thing every time, such as wearing hearing protection, keeping walkways clear or lifting properly, rarely gets a hazard down to 1. Unlikely, 2, is usually the honest score.
If a line is still High after controls, it needs more controls or closer supervision before work starts, and a hold point in the method statement. If it is still Critical, do not start. A hazard with a severity of 5 stays High however low you get its likelihood, which keeps it supervised and visible on the page.
If the job changes on the day, score the affected lines again. That check is part of a dynamic risk assessment.
Worked Examples
Two examples, not real cases.
Example 1: Carrying Plasterboard on a Shop Fit-Out
A two-person fit-out firm is boarding the walls of an empty shop unit. Full sheets of plasterboard arrive at the front door and are carried by hand to the back of the unit.
- Hazard: carrying full sheets. Back and shoulder injury to both fitters.
- Before controls: likelihood 4 (Likely) x severity 3 (Moderate) = 12, High. With every sheet carried by hand, an injury with time off work is to be expected at some point.
- Controls: delivery booked to the rear door, close to where the boards go. A board trolley for every move across the floor. Two people to every full sheet. Stacks raised off the floor so nobody lifts from ground level.
- After controls: likelihood 2 (Unlikely) x severity 3 (Moderate) = 6, Medium.
Likelihood stops at 2 because the trolley and the two-person lift still depend on both fitters using them every time. Severity stays at 3 because a bad lift does the same damage as before; it is just less likely to happen. Medium is acceptable with the controls listed, so the work goes ahead.
Example 2: Deliveries During an Event Build
A small production crew is building a stage in a venue. Vans deliver kit to a loading bay that the crew also crosses to reach the stage door.
- Hazard: a reversing van striking a member of the crew in the loading bay.
- Before controls: likelihood 3 (Possible) x severity 5 (Catastrophic) = 15, High. People and reversing vans share the bay, and anyone struck could be killed.
- Controls: a barrier separating the walkway to the stage door from the bay. Deliveries at set times. Nobody else in the bay while a vehicle moves. A trained signaller for every reverse, standing in a safe position out of the van's path where the driver can see them.
- After controls: likelihood 1 (Rare) x severity 5 (Catastrophic) = 5, held at High.
Rare is defensible here because the barrier physically keeps the crew out of the van's path, the only person in the bay during a reverse is a signaller standing clear of it, and the barrier, the signaller and the rule would all have to fail together. Severity stays at 5, because the van is no lighter. The line stays High, so it goes into the method statement as a hold point: no vehicle moves until the signaller has confirmed the bay is clear.
When a Client Uses a Different Matrix
Some principal contractors and clients have their own matrix. It may be a 3x3 or a 4x4, put severity up the side, or draw the bands at different scores. A 12 on one matrix is not a 12 on another.
If the client's form has a matrix, use theirs. Read its descriptors and band cut-offs first, then score each hazard afresh against them. Do not convert numbers from one matrix to another. What carries across is the judgement: how likely, how bad, and what the controls change.
Common Scoring Mistakes
- Adding instead of multiplying. 3 + 4 is 7, a score the grid cannot produce. 3 x 4 is 12, High.
- A total with no pair. "12" could be 3 x 4 or 4 x 3. Write both numbers.
- A score copied from the last job. The same task on a different site, with different people, can score differently. Score it again.
- A lower score with nothing behind it. If the score after controls is lower, the controls column must say why.
- Treating the band as the decision. A Low score never excuses skipping a cheap control. The legal standard, as HSE explains it, is to do everything "reasonably practicable", which means "balancing the level of risk against the measures needed to control the real risk in terms of money, time or trouble".
Frequently asked questions
Is a risk matrix a legal requirement in the UK?
No. The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient risk assessment, and they do not say how the risk must be judged. A matrix is a common way to show your judgement of likelihood and severity. Clients and principal contractors often expect to see scores, so you will probably use one.
How do you calculate a risk score on a 5x5 matrix?
Multiply likelihood by severity, each scored from 1 to 5. Likely (4) times Moderate (3) is 12. The result runs from 1 to 25 and falls in a band: Low 1 to 4, Medium 5 to 9, High 10 to 16 and Critical 17 to 25. A hazard with a severity of 5 is never banded below High.
What do the colours on a risk matrix mean?
They mark the bands. A common four-band scheme uses green for Low, yellow for Medium, orange for High and red for Critical. Colours and cut-offs vary between matrices, so check the key on the one you are using. The band sets the least you need to do.
What is the difference between initial and residual risk?
Initial risk is the score for a hazard as you found it, before your controls. Residual risk is the score with your controls in place. Controls usually lower the likelihood, not the severity, so a residual score normally keeps the same severity with a lower likelihood.
What is an acceptable risk score?
No number is acceptable on its own. The legal test is whether you have done everything reasonably practicable to protect people. Where Low is 1 to 4 and Medium 5 to 9, a Low or Medium score after controls means the work can go ahead with the controls listed, as long as no reasonably practicable control has been left out. A High score needs more controls or closer supervision before work starts. A Critical score means do not start.
Is a 5x5 risk matrix better than a 3x3?
Neither is better in itself. A 5x5 has more steps, so it can show what a control actually changed, which a 3x3 can blur. A 3x3 is quicker and can suit simple jobs. If a client's form uses a particular matrix, use theirs. What matters most is that every point on each scale has a written meaning.