Risk Matrix: Building & Scoring a 5x5 Risk Assessment Matrix

A risk matrix earns its place on one job: telling you which risk to deal with first. It fails when it is asked to do anything else, such as prove a site is safe or decide whether a control is good enough. This guide is for the safety manager building or fixing a matrix, and for the facilities manager who has to use one to rate contractor work across a portfolio.

The examples come from a hospital campus in property and facilities management and a linehaul depot in transport and logistics. They are illustrations, not customers. A 5x5 matrix with the scales, scored grid, and action key below is free as a CSV to open in a spreadsheet.

What Is a Risk Matrix?

A risk matrix is a grid. One axis rates how likely it is that someone is harmed; the other rates how badly. Where the two ratings meet is a cell, and the cell carries a band, usually low, medium, high, or extreme, and each band carries an action and a deadline. A 5x5 matrix has five levels on each axis and 25 cells.

It is a shortcut for a judgement Safe Work Australia's risk code describes in plain words. A risk assessment, the code says, can help a business decide how severe a risk is, whether the existing controls are working, what to do about it, and how urgently.¹ The matrix answers the first and the last of those. It does not answer the middle two, and that is where most misuse starts.

Does Australian WHS Law Require a Risk Matrix?

No. The word "matrix" does not appear in the model WHS Act, the model WHS Regulations, or the November 2024 risk code, measured on 29 October 2026.¹²³ What the law does require is that risks be eliminated so far as is reasonably practicable, and minimised so far as is reasonably practicable where eliminating them is not reasonably practicable.²

The two axes of a matrix mirror the law, though. Section 18 of the model WHS Act lists what goes into deciding what is reasonably practicable, and the first two matters are the likelihood of the hazard or risk occurring and the degree of harm that might result.² A matrix is a way of writing those two down consistently. The rest of section 18 is not on the grid at all: what you know, or ought reasonably to know, about the hazard and the ways to control it; what ways of controlling it are available and how suitable they are; and, only after that, the cost, including whether it is grossly disproportionate to the risk.

The code is also clear that not every hazard needs scoring. Where a hazard and its controls are well known and well established, the formal assessment step is not required, and where the law requires a hazard to be controlled a specific way, a risk assessment is not required either, but that requirement must be complied with.¹ Some high-risk work is the other way round. The code says a risk assessment is mandatory under the WHS Regulations for certain activities, such as entry into confined spaces, diving work, and live electrical work.¹

How to Build a 5x5 Risk Matrix, With a Free Template.

Four steps: borrow the likelihood scale, write your own consequence scale, score and band the grid, then tie every band to an action. Do it once for the whole business and keep it.

Step 1: Take the Likelihood Scale From the Code.

The risk code offers five ratings, and they make a ready-made axis.¹

Rating	Code's description	Score (ours)
Certain to occur	Expected to occur in most circumstances	5
Very likely	Will probably occur in most circumstances	4
Possible	Might occur occasionally	3
Unlikely	Could happen at some time	2
Rare	May happen only in exceptional circumstances	1

To pick a rating, the code's questions are the right ones: how often the task is done, how often and how close people get to the hazard, and whether it has happened before, at your workplace or anywhere else.¹ "Has it happened anywhere else" is the one that stops a rater marking a forklift strike as rare because the site has been lucky.

Step 2: Write the Consequence Scale in Your Own Words.

Here the code gives questions, not levels: could the hazard cause death, serious injury, illness, or only first aid injuries; how many people could be harmed, inside and outside the workplace; could one failure lead to others; could a small event escalate.¹ So the five consequence levels are yours to define. A workable set for WHS risk:

Level	Description	Score
Catastrophic	Death, or permanent disabling injury or illness, to one or more people	5
Major	Serious injury or illness needing hospital treatment	4
Moderate	Injury needing medical treatment and time off work	3
Minor	First aid injury, back at work the same shift	2
Insignificant	No injury, or a near miss	1

Write the descriptions in outcomes a supervisor can picture, not in percentages or dollar figures. Rate the most likely serious outcome, not the worst imaginable one, or every row lands in the top line.

Step 3: Score the Grid, Then Band It.

Multiply likelihood by consequence for a score from 1 to 25, then group the scores into bands. Our suggested banding is below; set your own cut-offs, but write them down.

Likelihood / Consequence	Insignificant 1	Minor 2	Moderate 3	Major 4	Catastrophic 5
Certain to occur 5	5 Medium	10 High	15 High	20 Extreme	25 Extreme
Very likely 4	4 Low	8 Medium	12 High	16 High	20 Extreme
Possible 3	3 Low	6 Medium	9 Medium	12 High	15 Extreme
Unlikely 2	2 Low	4 Low	6 Medium	8 Medium	10 High
Rare 1	1 Low	2 Low	3 Low	4 Medium	5 High

Look at the right-hand column. Pure arithmetic would put "rare, catastrophic" at 5, a medium, the same as "certain, insignificant". This grid overrides that in the two right-hand columns: no catastrophic cell is banded below high, no major cell below medium, and possible catastrophic is extreme. This override is our rule, not the code's. It follows the code's advice on choosing controls: where a hazard could cause death, serious injury, or illness, more emphasis should go on controls that eliminate or reduce the level of harm than on those that reduce its likelihood.¹ A matrix that lets a fatal outcome hide in a medium cell works against that.

Step 4: Tie Every Band to an Action & a Deadline.

A band with no action attached is decoration. The code says a risk assessment can help you decide what action to take and how urgently, so say both in the key.¹ The code's own worked example sets the tone: it rates an unguarded bakery mixer as very likely to cause serious injuries, calls that high risk, and says the mixer must not be used again until the risk has been controlled.¹ Our suggested key applies to the rating with the controls actually in place: before work starts, that is the initial rating; once the controls are in, it is the residual rating.

• Extreme. Stop the work or do not start it. Controls in place and signed off by a senior manager before anyone proceeds.
• High. Do not start, or stop, until a senior manager has approved the controls for this job the same day. Further controls within days, not weeks, with a named owner.
• Medium. Controls reviewed and improved within a set period, such as a month, with a named owner.
• Low. Managed by routine procedures and reviewed on the normal cycle, and sooner if a control fails, the work changes, or an incident occurs.

Where Risk Matrices Go Wrong.

The same four faults turn up in almost every register that leans on a matrix.

The score becomes the decision. A risk banded low still has to be eliminated or minimised so far as is reasonably practicable. A low score is a reason to schedule the work later, not a reason to skip a cheap guardrail. The matrix ranks; the hierarchy of controls decides, and our guide to the hierarchy of controls covers that order level by level.

Only one score is kept. If the register shows only the score after controls, nobody can see that the controls are doing the work, or what happens if one fails.

Different raters, different scores. Two supervisors at two sites will put the same task in different cells unless they have rated some together. Calibrate by having two people score the same ten risks separately and discussing every disagreement.

The cell hides the reasoning. "12, High" tells an auditor nothing. A short note on why the likelihood is "very likely", such as "pickers in the aisle on every replenishment", is what makes the rating defensible.

What Is the Difference Between Initial & Residual Risk?

Initial risk, sometimes called inherent risk, is the rating before any controls, or with only the controls already in place when the hazard was found. Residual risk is the rating after the controls you are relying on. The code asks whether existing controls are effective as part of the assessment, and its risk register template carries both the level of risk and how effective the current controls are, side by side.¹

Keep both. The gap between them shows what each control is worth, which is the first thing to look at when a control fails or a contractor asks to do the job a different way. A residual score that sits in the same cell as the initial one means the controls are not changing the risk, and the hierarchy needs another pass.

A Worked Example: Rating Contractor Work at a Hospital & a Depot.

The facilities manager at a hospital campus rates the contractor jobs on the quarterly schedule with the maintenance contractors who do them. Three rows show how the matrix sorts them.

Job	Initial rating	Main controls	Residual rating
Electrician upgrading a switchboard in the main plant room	Possible, Catastrophic: 15 Extreme	Work done de-energised, isolation locked by the electrician, test before touch, licence checked	Rare, Catastrophic: 5 High
HVAC technician changing filters in a ceiling space above a ward	Possible, Major: 12 High	Mobile platform in place of a ladder, ward manager told, ceiling access permit	Unlikely, Moderate: 6 Medium
Cleaning contractor stripping floors in outpatients after hours	Very likely, Minor: 8 Medium	Water-based stripper in place of a solvent product, wet floor barriers, area closed	Unlikely, Minor: 4 Low

The switchboard row is the lesson. Controls drop the likelihood a long way, but the consequence of a missed isolation is still death, so the residual band stays high and the job keeps its permit, a senior manager's same-day approval of the controls, and a check of the electrician's licence on the day. Our guide to lockout tagout covers that isolation step in full.

At a linehaul depot the same grid sorts a tyre fitter working on a trailer in the yard (possible, major, with a wheel chock and exclusion zone bringing it to unlikely, major) above a roller door technician working on a door with its power locked off (unlikely, major, down to rare, major). The fitter's job is the one the yard supervisor checks first.

Using the Matrix to Decide How Hard to Check a Contractor.

The band is also a sensible way to set how much evidence a contractor's job needs, and across a property portfolio it keeps that decision the same at every building. Low and medium work can run on the contractor's standard documents and the site induction, with two exceptions the law sets whatever the band: high risk construction work needs a safe work method statement before it starts, and a worker doing high risk work that needs a licence must show written evidence of it first.³ Work whose residual band is high or extreme warrants a reviewed safe work method statement, a permit, and a check of every licence on the crew before they start. Our SWMS review checklist covers what to look for in the statement itself.

How ComplyFlow Uses a Risk Matrix.

In ComplyFlow's risk register, each risk is assessed on a risk matrix to give an initial risk score, controls are assigned, and the risk owner or assessor sets a residual risk score based on how effective those controls are.⁴ When the likelihood or consequence of a risk changes, the initial rating is updated by choosing a new cell on the matrix, and the initial risk cannot be set lower than the residual risk at any site.⁵ A consolidated view shows each risk across every site where it is present, with the highest residual risk shown.⁴

Calibrate the Matrix on 10 Real Risks.

Before rolling a matrix out, take 10 risks from last year's incident reports and near misses and have two people rate each one separately. Every cell where they disagree is a description that needs rewriting. Then check the right-hand column: if anything that could kill someone sits in a low or medium band, change the banding before anyone uses it.

The risk matrix template has both scales, the scored grid, and the action key ready to edit. To see initial and residual ratings kept side by side across every site and contractor, book a demo and bring the risk your sites rate differently.