Skip to main content
    QHSEtech
    All templatesRisk Assessment · 2 pages · Updated 25 September 2026

    5×5 Risk Assessment Matrix Template

    Two-page 5×5 matrix: likelihood and severity scales with written definitions, four score bands with the action each triggers, and a risk register with existing controls, residual score, owner and review date.

    What's Inside

    1. 5×5 risk matrix — likelihood (1 Rare to 5 Almost certain) × severity (1 Negligible to 5 Catastrophic), scores 1 to 25
    2. Risk score bands — 1-4 Low: monitor, routine review · 5-9 Moderate: additional controls preferred · 10-15 High: controls required before proceeding · 16-25 Extreme: stop work, executive sign-off required
    3. Likelihood and severity definitions — from Rare (less than once in 10 years) to Almost certain (monthly or more), and from Negligible (no injury) to Catastrophic (fatality or multiple injuries)
    4. Risk register — number, risk description, existing controls, L, S, score, residual, owner, review date

    What requires or shapes this record

    The duty is to assess risk, record what matters and review it. No regulation cited here prescribes a 5×5 grid or these bands; they are a convention, and the definitions are what make one person's 12 mean the same as another's.

    • Management of Health and Safety at Work Regulations 1999, reg. 3

      Regulation 3(1) requires a suitable and sufficient assessment of the risks to employees and to others affected by the work. Regulation 3(3) requires a review when there is reason to suspect it is no longer valid or there has been a significant change. Regulation 3(6) requires employers with five or more employees to record the significant findings and any group identified as especially at risk.

    • HSE, Managing risks and risk assessment at work, part 2: Steps needed to manage risk

      HSE's steps frame the assessment as how likely harm is and how serious it could be, then ask you to record the hazards, who might be harmed and how, and what you are doing to control the risks. It says to review controls after changes to staff, processes, substances or equipment and after accidents or near misses, and not to rely purely on paperwork.

    • ISO 45001:2018, clause 6.1.2

      In a certified system the register is one way to evidence clause 6.1.2 (hazard identification and assessment of risks and opportunities).

    • ISO 31000:2018

      ISO 31000 is titled "Risk management — Guidelines", so it is guidance rather than certifiable requirements, and ISO lists the 2018 edition as to be revised. Read the printed PDF's "ISO 31000 aligned" line in that light.

    Each source checked on 25 September 2026. Not legal advice; check the text in force for your site.

    Field by field

    Likelihood definitions
    Why: Frequencies (once in 10 years, once a year, monthly) anchor the score.
    Common mistake: Not saying whether the frequency is per task, per person or per site. A daily task and a yearly one land in different rows for the same hazard.
    Severity definitions
    Why: Tied to injury outcomes (first aid, medical treatment, lost time, fatality), the same words the incident report uses, so incidents can test your scores.
    Common mistake: Scoring the most likely outcome on one row and the worst credible outcome on the next.
    Score and band
    Why: L × S gives 1 to 25; the band says what must happen.
    Common mistake: Treating equal scores as equal risks: 5 × 1 and 1 × 5 are both 5. The template has no rule that severity 5 is never below High; if you want one, write it on the sheet.
    Existing controls
    Why: Only what is in place today.
    Common mistake: Listing planned controls here, which understates the current risk.
    Residual
    Why: The score once the additional controls are working.
    Common mistake: A lower residual with no new control named beside it.
    Owner
    Why: A person who can make the control happen.
    Common mistake: A department or a job family.
    Review
    Why: A date, plus the triggers in regulation 3(3).
    Common mistake: An annual date only, ignoring the change or incident that should reopen the row.

    Worked example

    IllustrativeThree register rows for a warehouse (invented site)

    RiskExisting controlsL × SResidual with added controlOwner / review
    Pedestrian struck by a reach truck at aisle endsPainted walkways, 8 km/h speed limit3 × 5 = 15 HighFixed barriers at aisle ends and blue-spot warning lights: 2 × 5 = 10 HighWarehouse manager · after barriers are fitted, then 12 months
    Back injury lifting 25 kg sacks at goods-inTwo-person lift rule4 × 3 = 12 HighVacuum tube lifter: 2 × 3 = 6 ModerateGoods-in lead · 6 months
    Slip on condensation at the freezer doorWeekly floor check3 × 2 = 6 ModerateDoor heater strip and daily check: 2 × 2 = 4 LowFacilities · 12 months

    Row 1 stays High because severity cannot fall below 5 while people and trucks share the aisle; only separating them lowers it. The band's action, controls before proceeding, is met by the barriers being in place, not by the number falling.

    When a spreadsheet stops being enough

    A matrix in a spreadsheet stays consistent while one person scores it. Once several sites score against the same definitions, the register needs locked definitions, a history of every score change and a trigger that reopens a row when an incident or change touches it, which are the review conditions of regulation 3(3).

    Software adds those links: an incident tied to the risk it realised, an action tied to the control that was promised, and a review date that sends a reminder. Ask whether the matrix size and bands are configurable, and what happens to historic scores when you change them.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related guides