How to use a 5×5 risk matrix without letting the score replace judgement

What the matrix does

A typical 5×5 model assigns one value to likelihood and another to severity, then combines them to produce a band such as low, medium, high or very high. Organisations should define what each value and band means so different assessors are not using the same numbers in different ways.

The matrix helps compare priorities and communicate why further action is required. It is not a substitute for identifying hazards, understanding exposure or selecting effective controls.

Initial and residual risk

Initial risk should be scored using the organisation's stated convention—commonly before additional controls, although some systems score with existing controls. Residual risk is the expected position after the specified controls are implemented and working.

Be explicit about the convention. Otherwise two people may record different scores while believing they assessed the same situation. Never lower the residual score merely because a control has been written down; the control must be suitable, available and implemented.

Common scoring errors

Scoring problems often reveal a deeper assessment problem.

• Using vague severity labels without defining the outcome being assessed.
• Reducing severity when a control only reduces likelihood.
• Ignoring frequency, duration or the number of people exposed.
• Choosing the desired residual band first and working backwards.
• Treating two hazards with the same number as if they need the same controls.
• Allowing a low score to hide a specific regulatory or client requirement.

Use the score as a prompt for action

Define what each risk band requires: for example, whether work is prohibited, further controls are mandatory, management authorisation is required or routine monitoring is sufficient. Record who owns the action and when it must be completed.

Where uncertainty is material, investigate rather than disguising it with a precise-looking number. The legal and practical objective is to eliminate or adequately control the risk, not to achieve a preferred colour on a matrix.