Stax

…

Tools

Risk Matrix Calculator — 3×3, 4×4, 5×5 Risk Assessment

Calculate risk scores with a colour-coded 3×3, 4×4 or 5×5 risk matrix (likelihood × consequence). Get the risk band, recommended action and a matrix grid.

Last updated:

L \\ CC1C2C3C4C5
L112345
L2246810
L33691215
L448121620
L5510152025
Click a cell to select it as the initial risk. L = Likelihood, C = Consequence.

Was this tool useful?

Use the tool above and you can rate it here.

What is a Risk Matrix?

A risk matrix is a visual tool used in workplace health and safety (WHS) risk assessment to combine two dimensions of a risk scenario: the likelihood (or probability) that a harmful event will occur, and the consequence (or severity) of harm if it does occur. By multiplying these two indices, the matrix produces a risk score that maps to a risk band — Low, Medium, High, or Extreme — each with corresponding recommended management actions and timeframes.

Risk matrices are used across virtually every industry: construction, mining, healthcare, manufacturing, oil and gas, infrastructure, and corporate environments. A likelihood × consequence matrix is a common technique, described in ISO/IEC 31010, which supports the ISO 31000:2018 Risk Management Guidelines. ISO 31000 itself does not prescribe a matrix or scores.

5×5 Risk Matrix Descriptors

The 5×5 matrix provides the finest granularity of the three sizes:

  • Likelihood: 1 = Rare, 2 = Unlikely, 3 = Possible, 4 = Likely, 5 = Almost Certain
  • Consequence: 1 = Insignificant, 2 = Minor, 3 = Moderate, 4 = Major, 5 = Catastrophic

Risk bands for 5×5: Scores 1–3 = Low (Green); 4–6 = Medium (Yellow); 8–12 = High (Orange); 15–25 = Extreme (Red). The 3×3 matrix has only Low, Medium and a single High / Extreme band.

Risk Band Actions and Timeframes (this tool's defaults)

  • Low: Manage by routine procedures. No additional treatment required. Periodic monitoring.
  • Medium: Designate responsibility and monitor. Review within one month.
  • High: Senior management attention required. Implement additional controls. Act within one week.
  • Extreme: Stop work if possible. Act immediately. Notify senior management before proceeding.

How to Use This Calculator

  • Select the matrix size (3×3, 4×4, or 5×5) appropriate for your assessment
  • Use the dropdown selectors or click directly on the matrix grid to select likelihood and consequence
  • Read the risk score, band, colour, and recommended action
  • Optionally enable residual risk to compare initial vs post-control risk levels

Residual Risk Assessment

After identifying the initial (inherent) risk level, the next step in the risk management process is to identify and implement controls following the hierarchy: elimination, substitution, engineering controls, administrative controls, then PPE. Once controls are in place, reassess the risk using the residual likelihood and residual consequence to confirm the risk has been reduced to an acceptable level (typically Low or Medium for most tasks).

Limitations of Qualitative Risk Assessment

Qualitative risk matrices provide a structured, rapid assessment tool but have inherent limitations. Different assessors often assign different likelihood and consequence ratings to the same scenario (see Cox, 2008, "What's wrong with risk matrices?", Risk Analysis 28(2)). Risk scores should not be aggregated across different hazard types (a score of 12 from a minor health hazard does not equal a score of 12 from a catastrophic safety risk). For major hazard facilities, critical infrastructure, and high-consequence environments, quantitative risk assessment (QRA) techniques such as fault tree analysis, bow-tie analysis, and probabilistic risk assessment are commonly used.

Frequently asked questions

What is a risk matrix?
A risk matrix (also called a risk assessment matrix or probability-impact matrix) is a tool for qualitatively evaluating risk by combining the likelihood (probability) that a hazard event will occur with the consequence (severity) of that event. The two scores are multiplied to give a risk rating which falls into a risk band (e.g., Low, Medium, High, Extreme) with recommended management actions.
What is ISO 31000 and how does it relate to risk matrices?
ISO 31000:2018 is the international standard for risk management. It does not mandate a specific matrix size or scoring system but provides the framework for systematic risk identification, analysis, and evaluation. AS ISO 31000:2018 is the Australian adoption of the international standard. The bands, scores and timeframes in this calculator are the tool's own defaults, not requirements of ISO 31000; a likelihood × consequence matrix is a common technique, described for example in ISO/IEC 31010.
How do I choose between a 3×3, 4×4, and 5×5 matrix?
Use a 3×3 matrix for quick, informal risk screening where you need a simple Low/Medium/High classification. Use a 4×4 matrix for moderate complexity — it adds differentiation without the full detail of a 5×5. Use a 5×5 matrix for systematic assessments where fine discrimination between risk levels is important. More rows and columns do not necessarily mean more accuracy — qualitative risk assessment always involves significant judgment.
What is residual risk?
Residual risk is the remaining risk after control measures have been applied. For example, a task may have an initial (inherent) risk of High before controls, but after implementing engineering controls, administrative procedures, and PPE, the residual risk may be reduced to Low or Medium. This calculator lets you enter both initial and residual likelihood/consequence to compare them side by side.
What should I do for each risk band?
Low (Green): Manage by routine procedures — no additional treatment required, monitor periodically. Medium (Yellow): Manage with monitoring — designate responsibility, review within one month. High (Orange): Senior management attention — implement additional controls, act within one week. Extreme (Red): Stop work if possible, act immediately, notify senior management before proceeding. These actions and timeframes are this tool's default guidance, not requirements of a standard.
What are the limitations of qualitative risk assessment?
Qualitative risk matrices have well-documented limitations: they can give false precision, different people rating the same hazard often produce different scores, risk scores from different hazard types cannot be meaningfully compared or aggregated, and the matrix can mask important nuance. They should be used for prioritisation and communication rather than as a substitute for quantitative analysis for high-consequence risks. For major hazard facilities, more detailed methods such as quantitative risk assessment are commonly used.

Related tools