& 
A risk matrix is a simple grid that combines how likely something is to happen with how bad it would be, giving a score that helps you decide what to tackle first. The most common is the 5×5 matrix, with likelihood and severity each scored from 1 to 5.
The scales
| Score | Likelihood | Severity |
|---|---|---|
| 1 | Rare: could happen only in exceptional circumstances | Minor: no injury or a minor injury needing no treatment |
| 2 | Unlikely: could happen but not expected | First aid injury |
| 3 | Possible: might happen occasionally | Lost time injury, or injury needing medical treatment |
| 4 | Likely: will probably happen at some point | Major injury, such as a fracture, or serious ill health |
| 5 | Almost certain: expected to happen | Fatality or permanent disability |
The 5×5 matrix
| Likelihood by severity | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 Almost certain | 5 | 10 | 15 | 20 | 25 |
| 4 Likely | 4 | 8 | 12 | 16 | 20 |
| 3 Possible | 3 | 6 | 9 | 12 | 15 |
| 2 Unlikely | 2 | 4 | 6 | 8 | 10 |
| 1 Rare | 1 | 2 | 3 | 4 | 5 |
Risk bands and what to do
| Score | Rating | Typical response |
|---|---|---|
| 1 to 4 | Low | Acceptable. Maintain controls and review. |
| 5 to 9 | Medium | Improve controls where reasonably practicable. |
| 10 to 16 | High | Act promptly. Do not start new work until the risk is reduced. |
| 17 to 25 | Very high | Stop. Do not continue until the risk is reduced. |
Bands vary between organisations. What matters is that everyone uses the same definitions, so scores mean the same thing across teams.
How to use it well
- Score the risk with the controls already in place, not the worst case with no controls at all.
- Score again after the further actions, to show how much difference they make.
- Use the realistic worst outcome for severity, not the most extreme imaginable one.
- Agree scores as a team, involving people who do the work.
- Use the score to prioritise, not as an excuse to do nothing about “low” risks that are easy to fix.
3×3 or 5×5?
A 3×3 matrix (low, medium, high) is quicker and works well for small businesses and simple tasks. A 5×5 matrix gives more resolution, which helps when comparing many risks or tracking improvement. Choose one and use it consistently.
The limits of a risk matrix
- Scores are judgements, not measurements, so two people can score the same risk differently.
- High-severity, low-likelihood risks, such as a fatal fall, can score as “medium” and be overlooked.
- Multiplying scores can hide important differences between risks with the same number.
- A matrix does not replace the legal test: reducing risk so far as is reasonably practicable.
Our free risk assessment template includes this matrix and scoring guide, and our guide to hazard and risk explains the two terms the matrix is built on.
Training that helps
NEBOSH Managing Risks covers risk assessment methods, including how to use risk matrices properly. The NEBOSH National General Certificate and IOSH Managing Safely both include risk assessment, and our risk assessment eLearning is a quick introduction.
Frequently asked questions
What is a 5×5 risk matrix?
A grid that scores likelihood and severity from 1 to 5 each and multiplies them, giving a risk score from 1 to 25.
What is a high risk score on a 5×5 matrix?
Bands vary, but scores of 10 to 16 are commonly rated high and 17 to 25 very high.
Should you score risk before or after controls?
Score with existing controls in place, then again after any further action, to show the residual risk.
Is a risk matrix a legal requirement?
No. It is a tool to help prioritise. The legal duty is to assess risks and control them so far as is reasonably practicable.
Read the source
HSE guidance on risk assessment, including INDG163; the Management of Health and Safety at Work Regulations 1999, regulation 3; and BS 31100 and ISO 31000 on risk management principles. Facts checked on 6 October 2026.
Find a date that works
Every course, every centre, with live availability and prices.
On your site or ours, and group rates on request.
