What Is a Risk Assessment Matrix and How Do You Use One?

A risk assessment matrix is a tool that plots the likelihood of a hazard causing harm against the severity of that harm, to produce a risk rating such as Low, Medium, High or Extreme. It's used to prioritise which risks need controlling first — not to measure risk with scientific precision.

What is a risk assessment matrix?

A risk (assessment) matrix is a grid, typically 5x5, with likelihood levels running down one axis and consequence (severity) levels running across the other. Where a row and column intersect, you get a risk rating — often colour-coded from green (low) to red (extreme or severe).

It's a qualitative decision-support tool. You're not calculating an exact probability of harm; you're making a structured judgement call so that different hazards across a site can be compared and prioritised consistently, and so that higher-rated risks get controlled — and reviewed — before lower-rated ones.

Safe Work Australia's Model Code of Practice: How to Manage Work Health and Safety Risks (updated November 2024) frames this as the second step in the risk management process, after hazard identification: "the level of risk will increase as the likelihood of harm and its severity increases." Notably, the Code doesn't hand down one fixed matrix for every workplace to copy — it describes the process of rating likelihood and consequence and leaves the specific scale to be set for the context. That's a deliberate choice, and it matters: a matrix built for a chemical plant handling flammable solvents needs different consequence definitions than one built for an office fit-out. For the difference between the hazard itself and the risk it creates, see our companion piece, hazard vs risk: the difference explained.

How do you build a 5x5 risk matrix?

Start by defining your likelihood levels and your consequence levels in plain, specific language — vague labels like "sometimes" or "bad" produce inconsistent ratings across different assessors. WorkSafe Victoria publishes a complete worked example that's a useful starting template. Its five likelihood levels are:

Likelihood	Definition
Almost certain	Expected to occur in most circumstances
Likely	Will probably occur in most circumstances
Moderate	Given time, likely to occur
Unlikely	More likely not to occur under normal conditions
Rare	May only occur in exceptional circumstances

And its five consequence (severity) levels:

Consequence	Definition
Insignificant	Injury or illness needing first aid only
Minor	Injury likely to result in incapacity up to 7 days
Moderate	Injury likely to result in incapacity of 7+ days
Major	A fatality or total and permanent disability
Catastrophic	Multiple fatalities

Cross-multiplying those gives the 5x5 grid, with four risk levels — Severe, Significant, Moderate and Low — each carrying a specific action:

Likelihood ↓ / Consequence →	Insignificant	Minor	Moderate	Major	Catastrophic
Almost certain	Significant	Significant	Severe	Severe	Severe
Likely	Moderate	Significant	Significant	Severe	Severe
Moderate	Low	Moderate	Significant	Severe	Severe
Unlikely	Low	Low	Moderate	Significant	Significant
Rare	Low	Low	Moderate	Significant	Significant

• Severe — stop the activity and rectify immediately
• Significant — rectify with urgency
• Moderate — actively look for opportunities to further reduce the risk
• Low — manage through routine procedures and continuous improvement

Worth noting: Safe Work Australia's own Code uses slightly different likelihood wording — Certain to occur, Very likely, Possible, Unlikely, Rare — for the same idea. Neither version is "more correct." The point of building your own matrix is calibrating it to your actual operation, then applying it consistently. If you're documenting this in a JSEA or SWMS, see JSEA vs SWMS in Victoria for how the matrix output feeds into that paperwork.

Worked example: applying the matrix to a manufacturing hazard

Hazard: an exposed nip point on a conveyor feed roller. Operators periodically clear jams by hand while the conveyor is running, because stopping and isolating takes time out of the shift.

Step 1 — rate consequence. A hand drawn into an unguarded nip point can cause crush injuries or partial amputation — this meets the "Major" definition (potential for permanent disability).

Step 2 — rate likelihood. Jam-clearing happens routinely across shifts, and there's no engineering control stopping hand contact — this sits at "Likely."

Step 3 — read the matrix. Likely × Major = Severe. Under the action guide above, that means stop the activity and rectify immediately — not "raise it at the next meeting."

Step 4 — control it, then re-rate. Installing a fixed guard with an interlock (so the conveyor can't run with the guard open) removes the pathway to contact. Likelihood drops to "Rare." But the potential consequence if the interlock ever failed or was bypassed is still "Major" — so the re-rated risk is Rare × Major = Significant, not Low. That's the correct outcome, and it's a useful check on a common mistake: teams sometimes downgrade straight to "Low" after adding one control, when the matrix is telling you further verification — interlock testing, a procedure ban on manual clearing, or a fully enclosed feed design — is still warranted. This is exactly the logic behind the hierarchy of controls: eliminating the exposure (redesign so no one needs to reach in) beats relying on a single engineering control, which beats an admin rule alone. For the guarding obligations behind this specific hazard, see machine guarding requirements for Victorian manufacturers.

What are the limitations of a risk assessment matrix?

A risk matrix is a prioritisation tool, not a measurement instrument — and that limitation is documented, not just anecdotal. In a widely-cited 2008 paper in the journal Risk Analysis, Tony Cox showed that typical risk matrices "can correctly and unambiguously compare only a small fraction (e.g., less than 10%) of randomly selected pairs of hazards" (Cox, "What's Wrong with Risk Matrices?", Risk Analysis 28(2), 2008). His core findings, worth knowing before you lean on a matrix for a big decision:

• Compression loses information. Squeezing a continuous range of probabilities and severities into five buckets each means genuinely different risks can land in the same cell.
• Ranking can invert. Where likelihood and severity are negatively correlated, a matrix can rate a lower quantitative risk higher than a more serious one — the opposite of what you want from a prioritisation tool.
• Resource allocation needs more than a colour. A "Severe" rating tells you to act urgently; it doesn't tell you which of several severe-rated risks to fix first, or how much to spend — that still needs judgement or quantitative analysis underneath it.
• Inputs are subjective. Two competent assessors can rate the same hazard differently, because "Likely" and "Major" are judgement calls, not measurements.

None of that makes the matrix useless — Safe Work Australia and WorkSafe Victoria both still recommend it as the standard qualitative method for most workplace risk assessments. It just means a matrix rating is a starting point for deciding what to fix first, not a defensible substitute for engineering judgement, incident data or a documented rationale — especially for your highest-consequence hazards. When something does go wrong, the investigation that follows should test whether the original rating held up; see how to investigate a workplace incident properly.

FAQ

What's the difference between a hazard and a risk in a risk matrix? The hazard is the thing with the potential to cause harm (the exposed nip point); the risk is the likelihood and consequence of that harm actually occurring, which is what the matrix rates. See hazard vs risk: the difference explained for the full distinction.

What do the colours on a risk matrix mean? Colour-coding (typically green through red) is a visual shortcut for the rating in each cell — WorkSafe Victoria's example runs green (Low) through yellow/orange (Moderate/Significant) to red (Severe) — so higher-rated risks are immediately visible on a register or heat map.

Is a 5x5 matrix better than a 3x3 matrix? Not automatically. A 5x5 gives more granularity for distinguishing risks, but only if your likelihood and consequence definitions are precise enough to use that granularity consistently — a vaguely defined 5x5 matrix isn't more accurate than a well-defined 3x3 one.

Can a risk matrix give a low rating to something that's actually high risk? Yes — this is one of the documented weaknesses identified by Cox (2008) in Risk Analysis. It happens most often when likelihood and consequence are correlated in ways the matrix can't capture, or when assessors underestimate how often a hazard is actually encountered.

Do Victorian manufacturers have to use WorkSafe Victoria's exact matrix? No. There's no single mandated matrix under Victorian OHS law — what matters is that you use a documented, consistently applied method to assess and prioritise risks. WorkSafe Victoria's and Safe Work Australia's published examples are credible starting templates to adapt.

If you're not confident your current risk register reflects what's actually happening on your floor, Ardmor runs practical safety audits for Victorian manufacturers that stress-test your risk assessments against real operating conditions, not just the paperwork. Book an audit to find out where your ratings and your real-world exposure have drifted apart.

This article is general information for manufacturers, not professional advice. Last updated: 20 September 2026.