How to Use a 5x5 Risk Assessment Matrix for WHS

A risk assessment matrix is a tool that combines the likelihood of a hazard causing harm with the severity of the consequence to produce a risk rating. The 5x5 matrix is the most widely used format in Australian workplace health and safety because it provides sufficient granularity to differentiate between risks without being overly complex. The matrix uses five levels of likelihood (rare, unlikely, possible, likely, almost certain) and five levels of consequence (insignificant, minor, moderate, major, catastrophic) to produce 25 possible risk ratings.

The resulting risk score determines the priority and urgency of control measures. Risks rated as extreme or high require immediate action and cannot be accepted without controls in place. Risks rated as medium require planned controls within a defined timeframe. Risks rated as low may be acceptable with existing controls but should still be monitored. The matrix is a semi-quantitative tool — it provides a structured framework for decision-making but still relies on professional judgement when assessing likelihood and consequence.

Consistent application of a risk matrix requires clear definitions for each likelihood level that are specific to your workplace context. A common set of definitions for a 5x5 matrix is: Rare (1) — could occur only in exceptional circumstances, has never happened in this workplace or similar workplaces. Unlikely (2) — could occur at some time, has happened in similar workplaces but not here. Possible (3) — might occur at some time, has happened occasionally in this workplace. Likely (4) — will probably occur in most circumstances, has happened several times in this workplace. Almost certain (5) — is expected to occur in most circumstances, happens regularly or is a known issue.

When assessing likelihood, consider the frequency of exposure to the hazard, the number of workers exposed, the duration of exposure, and the effectiveness of existing controls. A hazard that workers encounter every shift has a higher likelihood than one encountered annually. Likelihood should be assessed with current controls in place for the inherent risk rating, and then reassessed with proposed additional controls for the residual risk rating.

Consequence levels describe the worst credible outcome if the hazard causes harm. For a WHS risk matrix, consequences are typically defined in terms of injury or illness severity. Insignificant (1) — first aid treatment only, no time off work, such as a minor cut or bruise. Minor (2) — medical treatment required, short-term time off work (less than one week), such as a sprain or minor burn. Moderate (3) — significant medical treatment, extended time off work (one week to three months), such as a fracture or moderate chemical burn. Major (4) — serious injury or illness requiring hospitalisation, potential long-term impairment, such as amputation, crush injury, or early-stage occupational disease. Catastrophic (5) — death, permanent total disability, or terminal illness such as mesothelioma or silicosis.

For health hazards with long latency periods (such as noise-induced hearing loss, occupational cancers, or chronic respiratory disease), the consequence should reflect the ultimate health outcome rather than the immediate effect of a single exposure. A single day of noise exposure above 85 dB(A) does not cause hearing loss, but the consequence of uncontrolled chronic exposure is permanent hearing loss — a major consequence.

The risk rating is calculated by multiplying the likelihood score by the consequence score: Risk = Likelihood x Consequence. This produces scores ranging from 1 (rare x insignificant) to 25 (almost certain x catastrophic). The scores are then grouped into four risk bands. Low (1 to 4) — acceptable with existing controls, monitor and review. Medium (5 to 9) — manageable with planned controls, implement within a defined timeframe. High (10 to 16) — requires urgent attention, implement controls before work continues or within days. Extreme (17 to 25) — unacceptable, stop work immediately and implement controls before any further exposure.

Apply the matrix twice for each hazard: first to assess the inherent risk (before controls), then to assess the residual risk (after controls). The difference between inherent and residual risk demonstrates the effectiveness of your control measures. If the residual risk remains high or extreme after all reasonably practicable controls have been implemented, the work should not proceed until additional controls are identified. Document both ratings in your risk register along with the specific controls that reduce the risk from the inherent to the residual level.

The most common mistake is inconsistent application of likelihood and consequence definitions across different assessors. Two people assessing the same hazard should arrive at the same or very similar risk rating. This requires clear, written definitions that are specific to your workplace, not generic descriptors copied from a textbook. Conduct calibration workshops where your team assesses the same set of scenarios and compares results to identify and resolve inconsistencies.

Another frequent error is anchoring on the most likely consequence rather than the worst credible consequence. A fall from a ladder could result in a bruise (minor), a fracture (moderate), a spinal injury (major), or death (catastrophic). The risk matrix should use the worst credible consequence — for a fall from three metres onto a hard surface, this is catastrophic. A third mistake is treating the risk matrix as a compliance exercise rather than a decision-making tool. The purpose of the matrix is to prioritise the allocation of resources to the highest risks. If every risk in your register is rated as medium, the matrix is not differentiating effectively and your definitions need recalibrating.