What is a risk matrix?

A risk matrix is a grid with severity on one axis and likelihood on the other. Each hazard is placed in the cell for its two ratings, and the cell's color shows its risk band, from low to very high. It is also called a risk assessment matrix, a probability and impact matrix or a heat map.

How do you calculate a risk matrix score?

Rate the severity of the worst credible outcome and the likelihood of that outcome, each on the same scale, then multiply them. On a 5x5 matrix, severity 5 and likelihood 3 give a score of 15 out of 25. The score's band, set by your risk policy, says what to do next.

What is a 5x5 risk matrix?

A grid with five severity levels and five likelihood levels, so scores run from 1 to 25 across 25 cells. Only 14 different scores can occur, because the score is a product of two whole numbers from 1 to 5. A 5x5 grid spreads hazards out more than a 3x3, which puts many different hazards in the same few cells.

What are the risk levels in a 5x5 risk matrix?

They depend on your policy. A common banding, used by the free template and this calculator, is low 1 to 4, medium 5 to 9, high 10 to 16 and very high 20 to 25. Scores of 17, 18 and 19 cannot occur on a 5x5 grid. Low has 8 of the 25 cells, medium 7, high 7 and very high 3.

What is the difference between a 3x3, 4x4 and 5x5 risk matrix?

The number of levels on each scale. A 3x3 grid has 9 cells and scores up to 9, which is quick for a toolbox talk but puts very different hazards in one cell. A 5x5 grid has 25 cells and scores up to 25, so it separates hazards better but needs a written scale so people score alike. A 4x4 sits between them.

Is a risk score of 15 high?

On a 5x5 matrix with the common banding of low to 4, medium to 9, high to 16, yes: 15 is high, which means reduce the risk before the work goes on or run it with temporary controls and a manager's approval. With a different banding it could fall elsewhere, so check your risk policy.

Does a risk matrix come from a standard?

The method does: IEC 31010:2019, the companion to ISO 31000 on risk assessment techniques, describes the consequence and likelihood matrix. No standard fixes the scales or the bands. Each company sets them in its risk policy and should write down what each level means.

What are the limits of a risk matrix?

Very different hazards can share a score, a fatal but rare hazard can land in the same band as a frequent cut, and people read words like possible and likely differently. L. A. Cox Jr. set these problems out in 2008. Use a written scale, score as a group, and read the severity as well as the score.

Should severity change after controls?

Usually not. Most controls lower the likelihood that the harm happens. Severity drops only when the control changes the hazard itself, such as less energy, a lower working height, a guard that keeps hands out of the tool, or a smaller quantity of a chemical. Score what the control really changes.

Free tool

Risk matrix calculator

A risk matrix ranks a hazard by multiplying how severe its harm could be by how likely that harm is, and places the score in a band that says what to do. Pick a 3x3, 4x4 or 5x5 grid, score the hazard with today's controls and again after further controls, and set the bands to match your own risk policy.

Risk scoreequalsseverity × likelihood

Highest scoreequalsgrid size × grid size (9, 16 or 25)

Bandequalslow up to the low limit, then medium, high and very high above the high limit

Changeequalsscore after controls − score before

Reductionequalsscore before − score after divided by score before

This is the consequence and likelihood matrix that IEC 31010:2019 describes as a risk analysis technique. The standard does not set the bands; your risk policy does. The 5x5 default here is the banding the free risk assessment matrix template prints, so the sheet and the calculator agree.

Matrix

Grid size

Use the size your risk policy uses. Changing it resets the banding.

The hazard with today's controls

Severity

Fatality or permanent disability. Loss of the equipment or area.

Likelihood

Could happen here; has happened in this industry.

After further controls (optional)

Severity after

Fatality or permanent disability. Loss of the equipment or area.

Likelihood after

Not expected to happen in the life of the task.

Banding (set it to your risk policy)

Low: scores up to

Medium: up to

High: up to

Very high is every score above it, up to 25.

Pre-filled with the press brake example (illustrative). No standard fixes the bands: the 5 x 5 default is the one the free risk assessment matrix template prints.

Risk score

15 · High

Severity 5 × likelihood 3 = 15 of 25. Reduce before the work goes on, or with temporary controls and a manager's approval.

After further controls

5 · Medium

5 × 1 = 5

Change

−10

67% lower

The same score of 15 also comes from severity 3 × likelihood 5. Two very different hazards can tie, so read the severity as well as the score.

Your 5 × 5 risk matrix

Each cell shows severity × likelihood in its band color. Select a cell to score the hazard there. The outlined marker is today's score, the filled one the score after further controls.

B: before further controls. A: after.

The banding and what to do at each band

Risk bands, the scores in each, the share of the grid and the action
Band	Scores on this grid	Cells	What to do
Low	1, 2, 3, 4	8 of 25	Accept with the controls in place. Review when the task changes.
Medium	5, 6, 8, 9	7 of 25	Reduce where you reasonably can. The supervisor agrees the controls and a date.
High	10, 12, 15, 16	7 of 25	Reduce before the work goes on, or with temporary controls and a manager's approval.
Very high	20, 25	3 of 25	Stop. Do not start or carry on until the risk is reduced.

The band, not the number, decides the action. Scores that cannot occur on the grid, such as 17 to 19 on a 5 × 5, belong to no cell.

Next step

Want to track this every week?

Bring this result to a 45-minute demo and we will show where it fits in LeanSuite's Safety Improvement.

Book a 45-minute demo Or click through the interactive demo

Before you pick a cell

Scoring a hazard

Severity. The worst credible outcome of the hazard, not the worst imaginable. If everything is a 5, nothing stands out. The scale words under each choice say what each level means.

Likelihood. How likely that outcome is with the controls in place today. Ask what has happened on this line, at this plant and in the industry.

Score as a group. The operator who does the task, the supervisor and someone from maintenance or safety. One person's 3 is another's 4; agreeing in the room is what makes scores comparable between areas.

Score again after the further control. What does the new control really change? A guard lowers the likelihood. A sign rarely moves it at all.

Set the bands once. Use the banding in your risk policy and keep it for every assessment, or the scores of two areas cannot be compared.

Worked example

Illustrative numbers, not a benchmark

A fabrication shop's press brake. The operator bends small brackets and holds them close to the tooling. Today the controls are a foot pedal and a written rule to keep fingers clear. The team scores the hazard on the 5x5 grid with the template's banding: low up to 4, medium up to 9, high up to 16.

1Severity 5 (catastrophic): a crushed finger is a permanent disability. Likelihood 3 (possible): it has happened on press brakes in this industry.
2Score: 5 × 3 = 15 out of 25. Check it the other way: 15 ÷ 5 = 3.
3Band: 15 is above the medium limit of 9 and not above the high limit of 16, so it is high. Reduce before the work goes on.
4A tie: severity 3 × likelihood 5 also scores 15. Same number, a very different hazard, which is why the team writes the severity next to the score.
5Further control: a light curtain that stops the ram when a hand enters the zone, an engineering control. The fingers can still be crushed if it fails, so severity stays 5. Likelihood falls to 1 (rare). Score after: 5 × 1 = 5, medium.
6Change: 5 − 15 = −10, a reduction of 10 ÷ 15 = 67%.

Before: 15, high. After the light curtain: 5, medium. Severity stays at 5, so the press brake stays on the review list, with a check of the light curtain at the start of each shift. The calculator above is filled in with this example. The scores are illustrative.

3x3, 4x4 and 5x5 risk matrices compared

A bigger grid separates hazards better and asks more of the people scoring. These are the calculator's starting bands. The 5x5 one is the template's; the 3x3 and 4x4 ones are a starting point of the same shape, not a standard.

Default banding and cells in each band for 3x3, 4x4 and 5x5 risk matrices
Grid	Low	Medium	High	Very high
3x3, scores 1 to 9	1 to 2, 3 cells	3 to 4, 3 cells	6 to 9, 3 cells	None
4x4, scores 1 to 16	1 to 3, 5 cells	4 to 6, 5 cells	8 to 9, 3 cells	12 to 16, 3 cells
5x5, scores 1 to 25	1 to 4, 8 cells	5 to 9, 7 cells	10 to 16, 7 cells	20 to 25, 3 cells

Use a 3x3 where people score on the spot, such as a pre-task check before a one-off job. Use a 5x5 for the written risk assessment of an area or a machine, where the team has time to agree each rating against the scale.

The 5x5 severity and likelihood scales

The same words as the template. Replace them with your company's if it has its own.

5x5 severity and likelihood scale
Level	Severity: the worst credible outcome	Likelihood of that outcome
1	Negligible: no injury, or first aid only	Rare: not expected in the life of the task
2	Minor: medical treatment, no lost time	Unlikely: has happened elsewhere
3	Moderate: lost time or restricted work	Possible: has happened in this industry
4	Major: serious injury, hospital stay or long-term harm	Likely: has happened here
5	Catastrophic: fatality or permanent disability	Almost certain: happens regularly

Where a risk matrix misleads

L. A. Cox Jr. set out the weaknesses in "What's Wrong with Risk Matrices?" (Risk Analysis, 2008). Three of them show up on every plant floor.

Ties. 5 × 3 and 3 × 5 both score 15. One is a rare amputation, the other a frequent strain. The score alone cannot tell them apart.

Coarse cells. A 5x5 grid has 25 cells but only 14 different scores. Two hazards in one cell can differ a great deal, and a hazard on the edge of a band can jump a whole band with one point of likelihood.

Words read differently. Possible to one supervisor is likely to another. A written scale with examples from your own plant, and scoring as a group, is the fix.

Two habits help. Read the severity next to the score, and send any hazard at the top severity to a manager whatever its band. And never add scores together: three medium risks do not make a high one.

Mistakes when using a risk matrix

Scoring with the new control already in. Score today's controls first, then the further control. Otherwise there is no before to compare.
Lowering the severity with PPE. Gloves and glasses reduce harm only when worn and in good condition. In the example, the light curtain kept severity at 5.
A different banding in every area. A 12 is only high everywhere if everyone uses the same limits.
Treating the score as the answer. The score ranks the hazards. The work is the control that follows, chosen from the hierarchy of controls.
Never scoring again. Without the after score nobody can show that the action worked. The risk assessment guide covers when to review.

Embed this calculator

Teaching this, or writing about it? Paste this code into your site, course page or intranet and the calculator works right there. It is free, with no sign-up.

<iframe src="https://www.theleansuite.com/tools/risk-matrix-calculator/embed" title="Risk matrix calculator by LeanSuite" width="100%" height="2300" style="border:0;max-width:1000px" loading="lazy" allow="clipboard-write"></iframe>
<p style="font:13px/1.4 sans-serif"><a href="https://www.theleansuite.com/tools/risk-matrix-calculator">Risk matrix calculator</a> by LeanSuite</p>

How LeanSuite helps

LeanSuite does not score risks for you. In Safety Improvement, risk assessments are among the marketplace safety templates, anyone on the floor reports a hazard as a tag by scanning the QR code on a machine or area, every action has an owner and a due date with delays flagged, and a floor-plan heat map shows where hazards cluster.

See Safety Improvement

FAQ

Risk matrix calculator: common questions

A risk matrix is a grid with severity on one axis and likelihood on the other. Each hazard is placed in the cell for its two ratings, and the cell's color shows its risk band, from low to very high. It is also called a risk assessment matrix, a probability and impact matrix or a heat map.
Rate the severity of the worst credible outcome and the likelihood of that outcome, each on the same scale, then multiply them. On a 5x5 matrix, severity 5 and likelihood 3 give a score of 15 out of 25. The score's band, set by your risk policy, says what to do next.
A grid with five severity levels and five likelihood levels, so scores run from 1 to 25 across 25 cells. Only 14 different scores can occur, because the score is a product of two whole numbers from 1 to 5. A 5x5 grid spreads hazards out more than a 3x3, which puts many different hazards in the same few cells.
They depend on your policy. A common banding, used by the free template and this calculator, is low 1 to 4, medium 5 to 9, high 10 to 16 and very high 20 to 25. Scores of 17, 18 and 19 cannot occur on a 5x5 grid. Low has 8 of the 25 cells, medium 7, high 7 and very high 3.
The number of levels on each scale. A 3x3 grid has 9 cells and scores up to 9, which is quick for a toolbox talk but puts very different hazards in one cell. A 5x5 grid has 25 cells and scores up to 25, so it separates hazards better but needs a written scale so people score alike. A 4x4 sits between them.
On a 5x5 matrix with the common banding of low to 4, medium to 9, high to 16, yes: 15 is high, which means reduce the risk before the work goes on or run it with temporary controls and a manager's approval. With a different banding it could fall elsewhere, so check your risk policy.
The method does: IEC 31010:2019, the companion to ISO 31000 on risk assessment techniques, describes the consequence and likelihood matrix. No standard fixes the scales or the bands. Each company sets them in its risk policy and should write down what each level means.
Very different hazards can share a score, a fatal but rare hazard can land in the same band as a frequent cut, and people read words like possible and likely differently. L. A. Cox Jr. set these problems out in 2008. Use a written scale, score as a group, and read the severity as well as the score.
Usually not. Most controls lower the likelihood that the harm happens. Severity drops only when the control changes the hazard itself, such as less energy, a lower working height, a guard that keeps hands out of the tool, or a smaller quantity of a chemical. Score what the control really changes.

More free lean tools

All tools

Pass it on

We want LeanSuite to be the best place on the internet for lean help. If this was useful, send it to someone on your team or in your network who needs it.