Skip to main content
    QHSEtech
    All templatesRisk Assessment · 3 pages · Updated 20 October 2026

    5×5 Risk Assessment Matrix Template

    PDF ExcelFree, no email

    Three-page 5×5 likelihood and severity matrix with L × S scoring: example scales and score bands to write over, rating rows with existing controls, an added control, a residual rating, an owner and a review date, then a decision record, review log and sign-off. A matrix rates risks; it does not decide whether a risk is acceptable. For one assessment, not a register, and it does not show that you meet a legal requirement.

    What's inside

    Page 1: the matrix and your scales

    1. Assessment details: title and reference, version and date, the activity, area or process rated, who assessed it, who agreed the scale and the bands and where they are written down, and two choices that keep ratings comparable: what likelihood is counted per (task, person, site, year) and whether severity is the most likely or the worst credible outcome
    2. The 5 × 5 matrix: likelihood 1 to 5 down the side, severity 1 to 5 across, each cell showing its L × S score and the letter of its example band (L, M, H, E) so a black and white copy still reads
    3. Likelihood and severity scales: example labels with an example frequency or outcome for each level (1 Rare to 5 Almost certain, 1 Negligible to 5 Catastrophic), and a box for your own wording
    4. Score bands: the example bands 1 to 4 Low, 5 to 9 Moderate, 10 to 15 High and 16 to 25 Extreme, what each example band says, and a column to write the bands and requirements you use

    Page 2: the rating rows

    1. Risk rating rows: seventeen rows and one example row. Each row has the hazard and risk, the existing controls, L, S and the L × S score, an added control, the residual L, S and score, an owner and a review date

    Page 3: checks, decision and sign-off

    1. Checks before you rely on the ratings: six tick boxes
    2. Decision on the rated risks: the row, its rating, the decision, the basis for it, who decided, the date and the risk register ID if the risk is carried over
    3. Review log: date, reason, reviewer, what changed and the version
    4. Sign-off: assessed, reviewed and approved with signatures, where the form is kept and the next review date

    The scale labels, the frequencies, the outcomes and the score bands are examples, to be written over. A matrix rates risks; it does not decide whether a risk is acceptable.

    What requires or shapes this record

    No source opened for this page prescribes a 5×5 grid, a scoring scale or score bands, and none says that a matrix must be used. What the sources ask for is an assessment of how likely harm is and how serious it could be, controls, a record of the significant findings and a review. In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient risk assessment, a review when it may no longer be valid or something significant changes, and, for an employer with five or more employees, a record of the significant findings. HSE's page asks the same questions in plain words, and the CCOHS fact sheet (Canada) shows two example matrices, says clearly defined parameters make ranking easier, says there is no single method and that a risk matrix is one tool among others. Which rules apply to you depends on your country, sector and contract; only sources for Great Britain and Canada were opened for this page, and this page is general information, not legal advice. The scale labels, the frequencies and the bands on the form are examples of ours: a score on a matrix ranks risks for attention, it does not by itself decide that a risk is acceptable, and none of the sources opened lists the weaknesses of risk matrices, so none are claimed here. ISO standards are paid and their text is not reproduced. ISO 31000:2018, titled Risk management, Guidelines, is listed by ISO as last reviewed and confirmed in 2023 and is guidance on risk management in general; this form does not claim to follow it, and the IEC 31010 standard on risk assessment techniques that ISO lists beside it was not read.

    • Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), regulation 3 (Great Britain, legislation.gov.uk, opened 20 October 2026)

      Regulation 3(1) requires an employer to make a suitable and sufficient assessment of the risks to its employees and to others affected by its undertaking, for the purpose of identifying the measures it needs to take to comply with the relevant statutory provisions. Regulation 3(3) requires the assessment to be reviewed if there is reason to suspect it is no longer valid or there has been a significant change in what it relates to, and to be changed where the review requires it. Regulation 3(6) requires an employer with five or more employees to record the significant findings of the assessment and any group of its employees identified as especially at risk. The regulation names no matrix, scale or score band, so the grid and the bands on this form are not taken from it. The page lists no known outstanding changes to the section. These regulations apply in Great Britain; other countries differ.

    • HSE, Managing risks and risk assessment at work, 2. Steps needed to manage risk (Great Britain; the page shows "Updated 2026-10-16")

      HSE lists five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. To assess the risks it says to decide how likely it is that someone could be harmed and how serious it could be, and to decide who might be harmed and how, what you are already doing to control the risks, what further action you need to take, who needs to carry out the action and when it is needed by. It says you are not expected to eliminate all risks but must do everything reasonably practicable, which it explains as balancing the level of risk against the measures needed in money, time or trouble. An employer of five or more must record the significant findings. Controls are to be reviewed to check they work, and also if they may no longer be effective, if staff, a process, substances or equipment change, if workers have spotted problems or after accidents or near misses, and the record is to be updated. It adds that paperwork should not be the main priority. The page does not mention a matrix or a scale. The columns for existing controls, added control, owner and review date follow these questions in our own wording.

    • CCOHS, Hazard and Risk: Risk Assessment (OSH Answers, Canada; fact sheet last revised 2025-03-12, page dated 2026-09-17)

      The Canadian Centre for Occupational Health and Safety describes risk assessment as identifying hazards, assessing their risk and prioritising them by the likelihood and severity of harm, and says risk can in general be expressed as probability times severity. It says assessments with clearly defined parameters for probability and severity make it easier to decide which hazards to address first, that there is no one simple or single way to determine risk and no single method for all situations, that ranking requires knowledge of the work and, most importantly, objective judgment, and that for simple situations a checklist or a risk matrix can be helpful. It gives two example matrices: a three by three qualitative one, and a five by five semi-quantitative one whose cells run from 1 to 25 and are labelled Low, Moderate, High or Extreme. In that example a score of 4 is Moderate and a score of 9 is High, where the example bands on this form call them Low and Moderate, so the bands here are examples and not a standard. CCOHS says such matrices can be customised and the parameters for scoring must be clearly defined so all team members understand them. It lists elimination, substitution, engineering controls, administrative controls and personal protective equipment as methods of control, and says records should show the hazard review, the risks, the controls and the monitoring, to a level that depends on the risk, the law and any management system. CCOHS says nothing about weaknesses of matrices.

    • ISO 45001:2018 (catalogue page, opened 20 October 2026)

      ISO 45001 is the occupational health and safety management system standard, and its catalogue page lists hazard identification and risk assessment among the requirements it specifies. ISO's catalogue page, opened in a browser on 20 October 2026, lists ISO 45001:2018 as edition 1 of March 2018, last reviewed and confirmed in 2024, with amendment 1 of 2024 and a draft revision under development, and describes it as specifying requirements for an occupational health and safety management system with hazard identification and risk assessment among its key elements. The clause title was not re-read on that date. The standard is paid, so it was not read beyond that page; ISO text not reproduced.

    Each source checked on 20 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    This form rates the risks of one risk assessment, row by row, and records what was decided about them. It is not the risk register: the register is a separate, summary template that carries the significant ratings of many assessments, and the rows here are the working behind them. It is not a job safety analysis either, which breaks one task into steps. The scale labels, the frequencies, the outcomes and the bands printed on the form are examples. Write your own over them, agree them before you score and keep them the same between assessments so that one person's 12 means what another's does.

    Assessment title and reference
    Why: A rating means something only against the assessment it belongs to. The reference lets a register row, an action or an incident point back to these rows.
    Common mistake: A form headed only with a date, so nobody can tell which assessment the ratings belong to.
    Activity, area or process rated
    Why: Regulation 3 and CCOHS both tie an assessment to specific work. Naming what is rated, and by implication what is not, keeps the rows to one scope.
    Common mistake: One sheet for "the site", so rows from different activities with different owners are mixed.
    Assessed by
    Why: CCOHS says an assessment should be done by a competent person or team who know the work, including the people who do it. Names, roles and the date show who judged the ratings and when.
    Common mistake: Scoring alone at a desk, without the people who do the work.
    Scale and bands agreed by
    Why: CCOHS says clearly defined parameters make ranking easier and that all team members must understand the scoring criteria. A name and a date show the scale was agreed before the first row was scored.
    Common mistake: Changing the bands after seeing the scores, so the result decides the scale.
    Likelihood counted per
    Why: A frequency of once a year means different things per task, per person or per site. Ticking the basis lets two assessors score the same hazard the same way.
    Common mistake: Not saying the basis, so a daily task and a yearly one land in the same row for the same hazard.
    Severity rated as
    Why: Severity can be the most likely outcome or the worst credible one. CCOHS describes severity as the highest level of damage possible from a hazard; whichever you choose, the choice has to be the same on every row.
    Common mistake: Scoring the most likely outcome on one row and the worst credible outcome on the next.
    Likelihood scale
    Why: A written meaning for each level, such as a frequency, anchors the score. The examples are ours, to change; CCOHS's three-level example, for instance, defines its probabilities by how often one individual may experience the harm.
    Common mistake: Using the numbers without the meanings, so 3 is "possible" to one person and "quite likely" to another.
    Severity scale
    Why: Each level is tied to an outcome (first aid, medical treatment, lost time, fatality), the same words your incident report uses, so incidents can later test your scores. Add wording for other harm, such as damage or environmental harm, if you rate it.
    Common mistake: A scale that covers injury only, then scoring a spill or a fire with it.
    Score bands
    Why: Say what each band means in your method and what it asks for. CCOHS's example draws its boundaries differently from the example bands on this form, so the bands are yours to set.
    Common mistake: Treating a band as a ruling that a risk is acceptable or not, when it only says what your method asks for at that score.
    Hazard and risk
    Why: HSE asks who might be harmed and how. A row that says what could happen, to whom and how can be rated and controlled; a bare topic cannot.
    Common mistake: "Manual handling" or "slips and trips" as a row, which is a topic and not one risk.
    Existing controls
    Why: HSE asks what you are already doing to control the risk. Only what is in place and working today belongs here, so the first rating describes today.
    Common mistake: Listing planned controls here, which understates the current risk.
    Rating with existing controls
    Why: L, S and L × S with the existing controls in place. CCOHS gives risk as probability times severity; reading L and S as well as the product matters because 5 × 1 and 1 × 5 both score 5.
    Common mistake: Treating equal scores as equal risks, or rating with no controls on one row and with today's controls on the next.
    Added control
    Why: HSE asks what further action is needed. The added control is the specific thing that will change the risk, which is why a residual rating has to sit beside one.
    Common mistake: "Improve training" with no specific action, or an action that is written but has no owner.
    Residual risk
    Why: The L, S and L × S you expect once the added control is working. CCOHS asks whether an adequate level of risk reduction has been achieved or further action is required; this column records the expected answer for you to check later.
    Common mistake: A lower residual rating with no added control named beside it, or lowered when the action is promised and not when it is checked.
    Owner
    Why: HSE asks who needs to carry out the action. One named person who can make the added control happen.
    Common mistake: A department or a job family, so nobody answers when the date passes.
    Review date
    Why: A date to look at the row again, plus the triggers in regulation 3(3) and on HSE's page: a change, a problem spotted by workers, an accident or a near miss.
    Common mistake: An annual date only, ignoring the change or the incident that should reopen the row.
    Decision on the rated risks
    Why: A matrix rates; it does not decide. HSE says you must do what is reasonably practicable, balancing the risk against money, time or trouble, so the decision, the person and the basis are written down beside the rating.
    Common mistake: Reading a band as the decision, so a score of 9 is accepted because it is Moderate and a 10 is refused because it is High, with no one deciding and no reason recorded.

    Worked example

    IllustrativeFour rating rows for a warehouse, using the example scales and bands of the form (invented site and people)

    RiskExisting controlsL × S with existing controlsAdded control and residual L × SOwner and review
    Pedestrian struck by a reach truck at aisle endsPainted walkways, 8 km/h speed limit3 × 5 = 15, HighFixed barriers at aisle ends and blue-spot warning lights: 2 × 5 = 10, HighWarehouse manager; after the barriers are fitted, then 12 months
    Back injury lifting 25 kg sacks at goods-inTwo-person lift rule4 × 3 = 12, HighVacuum tube lifter: 2 × 3 = 6, ModerateGoods-in lead; 6 months
    Slip on condensation at the freezer doorWeekly floor check3 × 2 = 6, ModerateDoor heater strip and a daily check: 2 × 2 = 4, LowFacilities; 12 months
    Pallet falls from a top rack level onto a pickerRacking inspected weekly3 × 4 = 12, HighRetention bars fitted to the beams: 2 × 4 = 8, ModerateWarehouse lead; 6 months

    Each score is likelihood times severity (3 × 5 = 15, 2 × 5 = 10, 4 × 3 = 12, 2 × 3 = 6, 3 × 2 = 6, 2 × 2 = 4, 3 × 4 = 12, 2 × 4 = 8) and each band is read from the example bands of the form: 1 to 4 Low, 5 to 9 Moderate, 10 to 15 High, 16 to 25 Extreme. Row 1 is still High after the added control, because severity stays at 5 while people and trucks share the aisle. What the High band asks for under your method, and whether the work may go on while the barriers are fitted, is a separate decision recorded in section 7 with who decided and why. The matrix only rated the risk.

    When a spreadsheet stops being enough

    A matrix in a spreadsheet or on paper stays consistent while one person scores it. Once several people or sites score against it, you need locked scale and band definitions, a history of every score change, and a way to see which ratings were made on the old scale when you change the bands.

    The harder problem is the links around the matrix: an incident tied to the risk it realised, an added control tied to its owner and due date, and a review that reopens a row when a change or an accident touches it, which are the review conditions of regulation 3(3). Paper and spreadsheets leave those links to memory.

    Ask any tool whether the matrix size, the labels and the bands are configurable, whether a decision about a rated risk is recorded with a name and a reason, and what happens to historic scores when you change them.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Reuse and credit

    Licensed CC BY 4.0: copy, adapt and share this template, also commercially, if you credit it, link to the licence and say if you changed it, without suggesting that QHSEtech endorses you. What the licence covers.

    Credit line

    5×5 Risk Assessment Matrix Template by QHSEtech (https://qhsetech.com/templates/risk-assessment-matrix-template), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

    HTML for a web page

    <a href="https://qhsetech.com/templates/risk-assessment-matrix-template">5×5 Risk Assessment Matrix Template</a> by <a href="https://qhsetech.com">QHSEtech</a>, licensed under <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>

    Related guides