How does a 5x5 risk matrix work?
Updated · UK law and HSE guidance
Short answer
A 5x5 risk matrix rates likelihood from 1 to 5 and severity from 1 to 5, then usually multiplies them to produce a score from 1 to 25. The scoring labels and action bands are not fixed by UK law, so define them clearly and use them consistently.
| Likelihood scale | 1 to 5 |
|---|---|
| Severity scale | 1 to 5 |
| Typical calculation | Likelihood × severity |
| Possible score range | 1 to 25 |
| Statutory scoring bands | None |
| Purpose | Prioritise and communicate risk, not prove compliance |
How the score is produced
Select the most credible severity of harm and the likelihood of that outcome under the conditions being assessed. Multiplying the two ratings gives a convenient ranking score. For example, likelihood 3 and severity 4 produces 12. Organisations commonly group scores into action bands, but the thresholds and colours must be defined locally because there is no universal statutory scheme.
- Describe every number in words
- Rate the specific harm scenario, not the hazard in isolation
- Use the same definitions across comparable assessments
Inherent and residual risk
An initial or inherent rating estimates risk before the proposed additional controls; a residual rating estimates risk after them. State which controls are assumed, otherwise the numbers cannot be interpreted. A low residual score does not excuse failure to adopt a reasonably practicable control. Equally, multiplying ordinal categories does not create a precise probability or predict how many incidents will occur.
- Do not lower a rating until a control is implemented
- Record action owners and completion dates separately
- Escalate catastrophic outcomes even when likelihood is judged low
Use the matrix as an aid, not the decision
HSE describes risk matrices as convenient for ranking and presenting qualitative or semi-quantitative assessments. A 5x5 matrix offers more discrimination than a 3x3 matrix, but extra cells do not guarantee better judgement. Base controls on legal duties, authoritative guidance, worker knowledge and the hierarchy of control. Review assumptions when conditions change. SitePaper can generate a 5x5 assessment with defined ratings for competent review.
- Explain unusual or high-consequence judgements
- Avoid arguing over one point when an obvious control is available
- Check that different assessors apply categories consistently
Step by step
- Define the scales. Write clear descriptions for likelihood levels 1–5 and severity levels 1–5.
- Describe the scenario. Identify who may suffer what specific harm and under which conditions.
- Rate current risk. Choose likelihood and severity using evidence and the controls already in place.
- Select further controls. Apply legal requirements and the hierarchy of control, not the score alone.
- Rate and review residual risk. Re-rate only after controls are implemented and review the assumptions.
Sources
This guide summarises UK law and HSE guidance for small businesses. It is not legal advice; check the sources and your own circumstances.