Risk Assessment Matrix: How Risk Ratings Work

A risk assessment matrix is a table that turns two judgements – how bad an outcome could be and how likely it is – into a single risk rating. One axis is consequence (or severity). The other is likelihood (or probability). Where the two meet, the cell gives the rating: usually low, medium, high or extreme, shown in green, yellow, orange and red.

The matrix does not find hazards and it does not control them. Its job is to help you put risks in order, so the worst ones are dealt with first, and to give a consistent answer when different people assess the same thing.

The most common form in Australian workplaces has five levels on each axis.

Consequence

Likelihood

A rating is read as the consequence number with the likelihood letter – 4C, for example – or as a score where the two are multiplied. Many matrices also rate consequence for property, the environment and reputation alongside people, and take the highest.

Putting the two scales together gives the grid. A typical layout, reading the consequence number with the likelihood letter:

Organisations draw the boundaries slightly differently, and that is a legitimate choice – but make it once, write it down, and apply it everywhere. The cells that deserve the most thought are the top-left ones: a catastrophic outcome that is rare is still a fatality risk, and should never be allowed to sit in green.

The colour is an instruction, not a description. A typical scheme:

• Red – high or extreme. Not acceptable. Stop the task, or put controls in place before the work continues. Senior management attention.
• Yellow or orange – medium. Reduce the risk so far as is reasonably practicable. Complete the actions within a set time, often three months.
• Green – low. Keep the existing controls working and check them at each review.

Work health and safety law does not recognise a "tolerable" red. The duty is to eliminate risks so far as is reasonably practicable and, where that is not possible, to minimise them. The matrix tells you where to start.

A useful assessment rates every hazard twice.

Inherent risk is the risk with no controls at all – what the hazard could do. It shows which hazards matter.

Residual risk is the risk that remains with the controls you actually have in place today. It shows whether you have done enough.

The gap between the two is the value of your controls, and the hazards that are still red or yellow after controls are your action plan. Be honest about "in place today": a guard that is in the store room, a procedure nobody has read and a respirator that has never been fit-tested are not controls.

A matrix built around sudden injuries tends to under-rate disease, because nothing visible happens on the day. Three adjustments fix that.

Use the right consequence. Noise-induced hearing loss, occupational asthma, silicosis and occupational cancer are permanent. They belong at consequence 4 or 5, not at 2 because "nobody has been hurt".

Judge likelihood from exposure, not from history. Ask how many people are exposed, how often, for how long, and at what level compared with the workplace exposure standard. Diseases with a latency of ten or twenty years will not appear in your incident records.

Measure where you cannot judge. If it is uncertain whether an exposure standard is exceeded, the WHS Regulations require air monitoring, and for noise an assessment by a competent person. A rating based on measurement is defensible. A rating based on a guess is not.

Hazard: mobile plant – trucks and forklifts sharing a receiving bay with people on foot.

• Inherent risk. Consequence 4 (a pedestrian struck by a forklift suffers permanent injury or worse). Likelihood C (possible). Rating 4C – red.
• Controls found on the walkthrough. Physical barriers between the pedestrian walkway and the forklift route, and high-visibility clothing. No exclusion zone around trucks being unloaded, no reversing alarms checked, no traffic management plan.
• Residual risk. The barriers reduce the likelihood, but the most effective controls are missing. Rating 3C – yellow.
• Action plan. Marked and enforced exclusion zones, a traffic management plan and spotter arrangements – in that order, because physical separation does more than rules.

1. Rating only the residual risk. Everything comes out green and the assessment tells you nothing.
2. Using likelihood to argue the risk away. "It has never happened here" is not evidence that it is rare.
3. Letting PPE and procedures turn a red into a green. Lower-order controls reduce likelihood a little. They do not change how bad the outcome is.
4. Ignoring health effects. Noise-induced hearing loss, occupational asthma and cancer from fume are consequence 4 outcomes. They are routinely rated as 2.
5. Different people, different answers. Without defined scales and a scoring method, two assessors will rate the same hazard two ways. A consistent method – where each control earns a defined credit according to its place in the hierarchy of control – removes the argument.