Assessing risk using a risk matrix approach
What is risk assessment?
Risk assessment is the process of estimating and communicating workplace safety
risk, and deciding whether this risk is acceptable.
The main reasons for conducting a risk assessment for any hazard are to:
use the risk assessment to prioritise the risk control activities
use the risk assessment as a guide as to how the risk is to be controlled
justify the control activities based on the level of risk reduction.
A risk assessment must be undertaken considering the following factors that may be
contributing to the risk:
the work premises and working environment (including the layout and condition)
the number of people and how frequently those people could be exposed to risk
the capability, skill, experience and age of people ordinarily undertaking the work
the systems of work being used
the range of reasonably foreseeable conditions
the number and type of workplace and/or industry incidents.
OHS information available that is relevant to the particular hazard including:
OHS information provided by a supplier of any plant, equipment or substance
material safety data sheets (MSDS) for any hazardous substance
the label of any hazardous substance
results of any biological monitoring
results of any atmospheric monitoring
information contained in any specialised OHS reports provided or available
information about previous injuries, illness and dangerous incidents
standards, code of practice and guidelines.
Conducting a risk assessment involves making a value judgement based on this
information and any available evidence within the workplace and industry. This may
include numbers of current and past incidents, severity of injuries from the identified
hazard, lost work time from injuries and number of people involved in incidents.
Specific information such as environmental measurements of hazards, eg noise
levels, dust levels, Legionella, and comparisons made between the workplace
measurement and the legally required measurement can also assist in the risk
assessment process.
1
The risk matrix
Risk matrixes are available from state/territory WorkCover authorities or the Risk
Management Standard: AS/NZS 4360:2004. You may also find that other state
authorities or event and industry associations may have developed sample matrixes.
The risk matrix records the level of risk which is determined by the relationship
between the likelihood of an incident occurring from the hazard, and the
consequence caused by the hazard. This is recorded as either a numerical or
alphabetical code. The relationship between likelihood and consequence determines
how dangerous the hazard is.
The level of risk or code that is determined is referred to as a risk priority rating. This
priority rating allows employers to prioritise the hazards identified to ensure that the
hazards with high potential of creating an incident are eliminated or controlled first.
Controlling a hazard may involve inspections, investigations and/or monitoring control
activities with managers, supervisors and work teams involved as appropriate
depending on the circumstances.
A hazard posing a low level of risk should not automatically be assessed as
acceptable. If there is a means of further reducing or eliminating this risk then this
must be done.
Risk matrixes, while staying true to the OHS authorities design, can be and are often
modified to suit a particular work environment or work task.
Modified risk matrixes can be reviewed within industry specific standards, codes of
practice, guidance notes and fact sheets from the state/territory OHS authorities or
risk management policies and procedures from event associations or companies.
2
Sample risk matrix (example 1)
This risk matrix has been designed and adapted from the Australia/New Zealand
Standard for Risk Management: AS/NZS 4360:2004. The risk priority rating on this
matrix is represented by an alphabetical code as the key below outlines.
Consequences
Severe Major Medium Minor Negligible
Likelihood
(1) (2) (3) (4) (5)
Almost certain
E H H M M
(A)
Likely
H H M M L
(B)
Possible
H M M L L
(C)
Unlikely
M M L L T
(D)
Rare
M L L T T
(E)
Key to the risk rating
E Extreme risk — Immediate action required; this level of risk needs detailed research
and planning by senior management.
H High risk — Action plan is required as soon as practicable by senior management.
M Moderate risk — Action plan is required by Area/Department Manager.
L Low risk — Managed by routine procedures and employees under supervision.
T Trivial risk — Unlikely to need specific application of resources.
The numbers and letters associated with the criteria for ‘likelihood’ and
‘consequences’ reflect accuracy in the rating. For example a risk rating may be “H”
but does that represent — ‘possible and severe’ or ‘likely and severe’ or ‘likely or
major’ etc. It is a way of explaining the reasoning behind the risk priority rating. It also
recognises that there are a few versions of the same rating just with different criteria
being assessed.
3
Sample risk matrix (example 2)
This risk matrix has a risk priority rating represented by a numerical code as the key
below outlines.
How likely is it to be that bad?
++ Very likely + Likely = Unlikely – Very unlikely
How severely
could it hurt could happen could happen could happen may happen but
someone or anytime at some time but very rarely probably wont
how ill could it
make someone?
Kill or cause
permanent 1 1 2 3
disability or ill
health
Long term
illness or 1 2 3 4
serious injury
Medical
attention and 2 3 4 5
several days off
work
First aid needed
3 4 5 6
Key to the risk rating
1 and 2 The hazard has a high risk of creating an incident. It requires immediate
executive management attention to rectify the hazard. Control action must be
immediately implemented before working in the area or carrying out the work
process.
3 and 4 The hazard has a moderate risk of creating an incident. It requires
management attention in a reasonable timeframe to prevent or reduce the
likelihood and severity of an incident. Control action of a short term nature would
need to be taken immediately so that work could still be carried out with further
long term action taken to ensure that the hazard was fully controlled.
5 and 6 The hazard has a low risk of creating an incident. It requires supervisor and
employee attention in a reasonable timeframe to prevent or reduce the likelihood
and severity of an incident.
4
Using the risk assessment matrix
A risk matrix identifies the relationship between the likelihood of an incident occurring
from the hazard, and the consequence caused by the hazard. This should still be the
case even with a modified matrix. Regardless of the matrix used the risk rating for a
particular hazard should still reflect the same outcome. Following are examples of
risk assessments of a range of hazards. They are recorded as either a numerical or
alphabetical code.
Hazard assessed: Operation of a fork lift at an event (alphabetical code)
To accurately assess this hazard and its potential associated risks consideration has
been given to:
the specific use of the fork lift
the number of people in the area of the fork lift use
the design and set-up of the event area in which the fork lift is used
experience of and licence requirements for people operating fork lift
regulatory and operational requirements of the fork lift.
Consequences
Severe Major Medium Minor Negligible
Likelihood
(1) (2) (3) (4) (5)
Almost certain
E H H M M
(A)
Likely
H H M M L
(B)
Possible
H M M L L
(C)
Unlikely
M M L L T
(D)
Rare
M L L T T
(E)
Risk rating = E
Extreme risk — Immediate action is required; detailed research and planning by
senior management.
5
Acting on the risk rating
In this example the risk rating priority of E requires immediate action and detailed
research and planning by senior management to rectify the hazard. The action must
be developed before the activity is undertaken.
In this risk assessment particular consideration has been given to the number of
other people who will potentially be in the vicinity during the operation of the fork lift.
It is important to remember that risk assessments on the same or similar hazards can
differ if there are used in different work environments. For example, an assessment
of fork lift operations within a warehouse where access by people is limited may
record a risk rating of H.
Hazard assessed: Operation of a fork lift at an event (numerical code)
How likely is it to be that bad?
++ Very likely + Likely = Unlikely – Very unlikely
How severely
could it hurt could happen could happen could happen may happen but
someone or anytime at some time but very rarely probably wont
how ill could it
make someone?
Kill or cause
permanent 1 1 2 3
disability or ill
health
Long term
illness or 1 2 3 4
serious injury
Medical
attention and 2 3 4 5
several days off
work
First aid needed
3 4 5 6
Risk rating = 1
The hazard has a high risk of creating an incident. It requires immediate
executive management attention to rectify the hazard. Control action must be
immediately implemented before working in the area or carrying out the work
process.
6
Acting on the risk rating
A risk rating priority level of 1 requires immediate executive management attention to
rectify the hazard. Control action would need to be immediately implemented before
working in the area or using the fork lift. This may include ensuring that all operators
are currently licensed, checking that the fork lift is in good working order and/or
barricading the area where the fork lift is being used so as to avoid an excess of
pedestrian traffic.
Hazard assessed: Leads lying around on stage (alphabetical code)
To accurately assess this hazard and its potential associated risks consideration has
been given to:
the layout of the stage area
the number of people on stage at any one time
the number and type of leads of leads (voltage, coverings)
experience of the stage crew and artists
regulatory and operational requirements of electrical leads.
Consequences
Severe Major Medium Minor Negligible
Likelihood
(1) (2) (3) (4) (5)
Almost certain
E H H M M
(A)
Likely
H H M M L
(B)
Possible
H M M L L
(C)
Unlikely
M M L L T
(D)
Rare
M L L T T
(E)
Risk rating = M
Moderate risk — Action plan is required by Area/Department Manager.
7
Acting on the risk rating
In this example the risk rating priority of M requires an action plan to be developed
prior to stage preparation being carried out to either eliminate or reduce the risk of
tripping and falling.
Hazard assessed: Heat exhaustion (numerical code)
To accurately assess this hazard and its potential associated risks consideration has
been given to:
the supply of and access to shaded areas
the number of people working in the outdoors or in a high heat areas
the number and type of cooling facilities provided
the length of shifts for workers and length of exposure to heat
type of clothing provided for workers
the type of work undertaken.
How likely is it to be that bad?
++ Very likely + Likely = Unlikely – Very unlikely
How severely
could it hurt could happen could happen could happen may happen but
someone or anytime at some time but very rarely probably wont
how ill could it
make someone?
Kill or cause
permanent 1 1 2 3
disability or ill
health
Long term
illness or 1 2 3 4
serious injury
Medical
attention and 2 3 4 5
several days off
work
First aid needed
3 4 5 6
Risk rating = 5
The hazard has a low risk of creating an incident. It requires supervisor and
employee attention in a reasonable timeframe to prevent or reduce the likelihood and
severity of an incident.
8
Acting on the risk rating
A risk rating priority level of 5 records the hazard as a low risk of creating an incident.
It requires supervisors and employees attention in the form of monitoring work
conditions and personnel and/or their own physical state to prevent or reduce the
likelihood and severity of an incident.
Control actions would still need to be implemented when setting up the work area
such as providing sufficient shading, rotating shifts to avoid lengthy period in hot
areas etc. Also as temperatures can fluctuate continual monitoring during the event is
required.
Recording risk priority ratings
Once the risk matrix has been used to identify the risk priority rating, it must be
recorded. Once the risk rating has been assessed, control measures can be
determined.
The following event hazards have been risk assessed to demonstrate the recording
format using both formats.
Hazard Safety risk Possible outcomes Risk Risk
rating rating
People working at Falling Death
height to install rigging Climbing equipment Permanent injury
and equipment
E 1
failure
Use of fork lift with Person being hit by Death
other people in the vehicle Permanent injury
event area
E 1
Exhaust fumes from Exhaust build-up Exhaust inhalation
exhibition display, eg Crowd crush Death or Injury
cars
H 2
Boxes left in main Trip hazard Medical attention
doorway required
M 4
Wet floor from spilled Slips and falls First aid
liquid Burns if liquid is corrosive L 5
The accuracy of the risk priority ratings will depend on the workplace situation and is
only offered as guide.
