Stax
Tools

Risk Matrix Calculator

Calculate risk scores with a colour-coded 3×3, 4×4 or 5×5 risk matrix. Based on ISO 31000.

L \\ CC1C2C3C4C5
L112345
L2246810
L33691215
L448121620
L5510152025
Click a cell to select it as the initial risk. L = Likelihood, C = Consequence.

What is a Risk Matrix?

A risk matrix is a visual tool used in workplace health and safety (WHS) risk assessment to combine two dimensions of a risk scenario: the likelihood (or probability) that a harmful event will occur, and the consequence (or severity) of harm if it does occur. By multiplying these two indices, the matrix produces a risk score that maps to a risk band — Low, Medium, High, or Extreme — each with corresponding recommended management actions and timeframes.

Risk matrices are used across virtually every industry: construction, mining, healthcare, manufacturing, oil and gas, infrastructure, and corporate environments. They are embedded in AS/NZS ISO 31000:2018 (Risk Management Guidelines), the model WHS Regulations, and thousands of safety management systems worldwide.

5×5 Risk Matrix Descriptors

The 5×5 matrix provides the finest granularity and is most appropriate for formal WHS risk assessments:

  • Likelihood: 1 = Rare, 2 = Unlikely, 3 = Possible, 4 = Likely, 5 = Almost Certain
  • Consequence: 1 = Insignificant, 2 = Minor, 3 = Moderate, 4 = Major, 5 = Catastrophic

Risk bands for 5×5: Scores 1–3 = Low (Green); 4–6 = Medium (Yellow); 8–12 = High (Orange); 15–25 = Extreme (Red). Note that certain score combinations (e.g., score 7) may straddle bands — the matrix assigns these based on the closest band threshold.

Risk Band Actions and Timeframes

  • Low: Manage by routine procedures. No additional treatment required. Periodic monitoring.
  • Medium: Designate responsibility and implement additional controls. Review within one month.
  • High: Senior management attention required. Implement urgent additional controls. Act within one week.
  • Extreme: Stop or suspend the activity if possible. Immediate action required before work proceeds. Notify senior management and regulator if applicable.

How to Use This Calculator

  • Select the matrix size (3×3, 4×4, or 5×5) appropriate for your assessment
  • Use the dropdown selectors or click directly on the matrix grid to select likelihood and consequence
  • Read the risk score, band, colour, and recommended action
  • Optionally enable residual risk to compare initial vs post-control risk levels

Residual Risk Assessment

After identifying the initial (inherent) risk level, the next step in the risk management process is to identify and implement controls following the hierarchy: elimination, substitution, engineering controls, administrative controls, then PPE. Once controls are in place, reassess the risk using the residual likelihood and residual consequence to confirm the risk has been reduced to an acceptable level (typically Low or Medium for most tasks).

Limitations of Qualitative Risk Assessment

Qualitative risk matrices provide a structured, rapid assessment tool but have inherent limitations. Research has shown that different assessors often assign very different likelihood and consequence ratings to identical scenarios. Risk scores should not be aggregated across different hazard types (a score of 12 from a minor health hazard does not equal a score of 12 from a catastrophic safety risk). For major hazard facilities, critical infrastructure, and high-consequence environments, quantitative risk assessment (QRA) techniques such as fault tree analysis, bow-tie analysis, and probabilistic risk assessment are required.

คำถามที่พบบ่อย

What is a risk matrix?
A risk matrix (also called a risk assessment matrix or probability-impact matrix) is a tool for qualitatively evaluating risk by combining the likelihood (probability) that a hazard event will occur with the consequence (severity) of that event. The two scores are multiplied to give a risk rating which falls into a risk band (Low, Medium, High, Extreme) with recommended management actions.
What is ISO 31000 and how does it relate to risk matrices?
ISO 31000:2018 is the international standard for risk management. It does not mandate a specific matrix size or scoring system but provides the framework for systematic risk identification, analysis, and evaluation. AS/NZS ISO 31000 (adopted in Australia/New Zealand) aligns with the international standard. The 5×5 matrix used in this calculator follows the likelihood and consequence descriptors commonly used in Australian WHS risk assessment practice.
How do I choose between a 3×3, 4×4, and 5×5 matrix?
Use a 3×3 matrix for quick, informal risk screening where you need a simple Low/Medium/High classification. Use a 4×4 matrix for moderate complexity. Use a 5×5 matrix (most common in formal WHS risk assessments) for systematic assessments where fine discrimination between risk levels is important. More rows and columns do not necessarily mean more accuracy — qualitative risk assessment always involves significant judgment.
What is residual risk?
Residual risk is the remaining risk after control measures have been applied. For example, a task may have an initial (inherent) risk of High before controls, but after implementing engineering controls, administrative procedures, and PPE, the residual risk may be reduced to Low or Medium. This calculator lets you enter both initial and residual likelihood/consequence to compare them side by side.
What should I do for each risk band?
Low (Green): Manage by routine procedures — no additional treatment required, monitor periodically. Medium (Yellow): Manage with monitoring — designate responsibility, review within one month, implement additional controls if practicable. High (Orange): Senior management attention — implement additional controls, review within one week, consider whether the task can proceed. Extreme (Red): Stop or suspend the activity if possible — immediate action required, notify senior management, implement urgent controls before proceeding.
What are the limitations of qualitative risk assessment?
Qualitative risk matrices have well-documented limitations: they can give false precision, different people rating the same hazard often produce different scores, risk scores from different hazard types cannot be meaningfully compared or aggregated, and the matrix can mask important nuance. They should be used for prioritisation and communication rather than as a substitute for quantitative analysis for high-consequence risks.

เครื่องมือที่เกี่ยวข้อง