5x5 Risk Assessment Matrix Explained: Scores, Bands & Worked Example

A 5×5 risk assessment matrix is a structured tool for turning a professional judgement about hazard severity and likelihood into a numerical score that drives proportionate action. This page explains how each element of the matrix works, grounds the methodology in UK regulatory context, and walks through a complete roof-maintenance worked example — from uncontrolled inherent risk to residual risk after controls are applied.

---

What Is a 5×5 Risk Assessment Matrix?

A 5×5 matrix plots two variables — how likely a harmful event is to occur and how severe the resulting harm would be — on a grid where each axis runs from 1 (lowest) to 5 (highest). Multiplying the two scores produces a risk rating between 1 and 25. That rating is then mapped to a band that tells the assessor what level of management action is required.

The format is an industry-standard convention, not a format mandated by any single UK statute. UK law requires employers to conduct a suitable and sufficient risk assessment; the 5×5 matrix is one widely used method for meeting that obligation. A matrix produces nothing on its own — it is only as good as the judgements fed into it.

---

How the Two Axes Work: Likelihood and Severity Defined

Likelihood axis (columns 1–5)

Score	Label	Plain-language anchor
1	Rare	Could happen but no known instance; requires an unusual combination of failures
2	Unlikely	Has happened in the industry but not at this site/task type; precautions make it improbable
3	Possible	Might occur; historical incidents exist at comparable sites
4	Likely	Expected to happen in most circumstances; or has happened before at this site
5	Almost certain	Will almost certainly occur if the task proceeds; near-miss already recorded

Severity axis (rows 1–5)

Score	Label	Plain-language anchor
1	Negligible	No injury or first-aid only; no time lost
2	Minor	Minor injury requiring medical treatment; short-term absence
3	Moderate	Injury resulting in a RIDDOR-reportable over-7-day absence
4	Major	Serious injury — fracture, amputation, permanent partial disability
5	Fatal	Single or multiple fatalities

Always anchor severity to the realistic worst-case injury to a person, not to property damage or project cost.

---

The 5×5 Grid Template (Colour-Coded)

The table below is your blank scoring template. Multiply the row value (severity) by the column value (likelihood) to find the cell score. Colour coding follows the band convention described in the next section.

How to use: identify your hazard's severity row, move across to the likelihood column, and read the score. Green = manage routinely; yellow = monitor and review; amber = active management required; red = stop and control before proceeding.

Severity ↓ / Likelihood →	1 Rare	2 Unlikely	3 Possible	4 Likely	5 Almost certain
5 Fatal	5	10	15	20	25
4 Major	4	8	12	16	20
3 Moderate	3	6	9	12	15
2 Minor	2	4	6	8	10
1 Negligible	1	2	3	4	5

Key: 🟢 Green = Trivial/Tolerable (1–3) | 🟡 Yellow = Low/Tolerable but monitor (4) | 🟠 Amber = Moderate (5–14) | 🔴 Red = Substantial/Intolerable (15–25)

---

Calculating Risk Score and Interpreting the Five Bands

Formula: Risk score = Likelihood score × Severity score

The five bands below are a commonly used industry convention, not statutory thresholds. They give the assessor a consistent framework for deciding what action is proportionate.

Risk Band Decision Tree

Band	Score range	Colour	Required employer action	Review frequency
Trivial	1–3	🟢 Green	No additional controls required; maintain existing precautions and document.	At next scheduled review or if conditions change
Tolerable	4	🟡 Yellow	Controls adequate but monitor for deterioration; consider whether further improvement is reasonably practicable.	At next scheduled review or if task/environment changes
Moderate-low	5–9	🟠 Amber	Active management needed; confirm controls are in place before authorising the task.	Supervisor review before work starts
Moderate	10–14	🟠 Amber	Active management needed; implement additional controls within a defined timescale; do not proceed without written plan.	Review within 3 months or after any incident
Substantial	15–19	🔴 Red	Work must not start until risk is reduced; escalate to senior management; implement controls before authorising the task.	Immediate; re-score before task commences
Intolerable	20–25	🔴 Red	Stop work immediately or do not commence; no work proceeds until inherent risk is reduced to at least Moderate band; senior sign-off required.	Continuous; re-assess after every control change

---

Inherent Risk vs Residual Risk: Why You Must Score Both

Inherent risk is the raw risk level before any controls exist — it answers: "How dangerous is this if we do nothing?"

Residual risk is scored after all control measures have been applied — it answers: "How dangerous is this once our controls are in place?"

Most risk assessment formats show both scores side by side. Showing only one creates a gap: an uncontrolled inherent score tells you the hazard is serious but gives no evidence that anything has been done about it; a residual score alone, without an inherent benchmark, hides how far the controls have reduced the risk and whether sufficient effort has been made.

The step most practitioners skip is documenting the mechanism by which controls reduced the likelihood or severity score — for example, installing a permanent parapet guard rail that prevents a person reaching an unprotected edge reduces likelihood from 4 (likely) to 2 (unlikely), because access to the hazardous zone is physically restricted.

---

Worked Example: Roof Maintenance Task

Scenario: A maintenance worker is tasked with inspecting and clearing gutters on a flat industrial roof fitted with fragile asbestos cement roofing sheets in sections. No permanent edge protection or roof access system is currently in place. The worker proposes to use an extension ladder to access the roof and walk to the gutter line unaccompanied.

Falls from height are one of the biggest causes of workplace fatalities and major injuries in the UK (HSE INDG401). Work at height means work in any place where, if there were no precautions in place, a person could fall a distance liable to cause personal injury (HSE INDG401). The Work at Height Regulations 2005 aim to prevent death and injury from a fall from height (HSE INDG401).

The statistical context makes this scenario especially serious: roof work accounts for a quarter of all deaths in the construction industry (HSG33), and falls through fragile materials — such as roof lights and asbestos cement roofing sheets — account for more of these deaths than any other single cause (HSG33). Critically, not all those killed while working on roofs are trained roofers; many people accessing roofs are maintenance workers (HSG33).

Step 1 — Inherent risk (no controls in place)

Element	Score	Rationale
Hazard	Fall from height through fragile roofing sheet	—
Likelihood	4 — Likely	Unprotected, unaccompanied access to fragile material; no means of detecting weak sections; ladder access alone is insufficient edge protection. Common causes of falls from height include falls from ladders and through fragile roofs (HSE INDG401).
Severity	5 — Fatal	A fall through an asbestos cement sheet onto a hard floor is readily fatal; consistent with HSG33 mortality data.
Inherent score	4 × 5 = 20 — Intolerable	Work must not commence. Controls required before any access is authorised.

Step 2 — Control measures applied (based on HSG33 and WAH Regs 2005 hierarchy)

1. Avoid the risk: Assess whether the task can be done from ground level (e.g. CCTV gutter inspection) — elimination considered but not practicable for physical clearance work.
2. Collective protection: Install temporary edge protection (guard rail and toe board system meeting Schedule 2, Work at Height Regulations 2005) along all open edges before any person accesses the roof.
3. Fragile surface protection: Install crawl boards or a purpose-designed roof walkway system across the fragile sheet sections to distribute load and prevent a person stepping directly onto fragile material.
4. Safe access: Replace ladder-only access with a fixed or temporary stairway or tower scaffold access platform to roof level, eliminating the unsecured ladder climb.
5. Supervision and buddy system: No lone working; a second person on the roof or at point of access with emergency contact capability.
6. Ladder pre-use check (where ladders remain in use for lower-level access): The user should carry out a pre-use check before using the ladder for a work task, and after something has changed (e.g. a ladder dropped or moved from a dirty area to a clean area) (HSE construction ladders). Pre-use checks provide the opportunity to pick up any immediate or serious defects before they cause an accident (HSE construction ladders).

Step 3 — Residual risk (controls applied)

Element	Score	Rationale
Likelihood	2 — Unlikely	Collective edge protection and crawl boards physically prevent uncontrolled access to fragile zones; supervisor present; access route improved. A fall is now improbable rather than expected.
Severity	4 — Major	Even with controls, a failure (e.g. a board displaced mid-task) could result in serious injury. Severity cannot be reduced below Major for this height and surface type.
Residual score	2 × 4 = 8 — Moderate-low	Active management — confirm controls are in place before authorising the task; review if conditions deteriorate or any near-miss occurs.

Before and After Summary

	Likelihood	Severity	Score	Band
Inherent (no controls)	4 — Likely	5 — Fatal	20	🔴 Intolerable
Residual (controls applied)	2 — Unlikely	4 — Major	8	🟠 Moderate-low

The 12-point reduction from 20 to 8 is achieved primarily by reducing likelihood through collective physical controls — it does not eliminate the hazard, which is why severity remains at 4.

---

5×5 vs 3×3 vs 4×4 Matrix: When to Use Each Format

Format	Cells	Best suited to	Limitation
3×3	9	Simple, low-hazard environments; small businesses; initial screening	Coarse: many different risks collapse into the same score band; nuance is lost
4×4	16	Medium-complexity environments; office/retail settings with a range of hazards	No true midpoint on each axis, which can skew scores toward extremes
5×5	25	Construction, manufacturing, maintenance, work at height; any environment with multiple severity gradations	Requires greater assessor competence to anchor scores consistently; overkill for trivial hazard inventories

The 5×5 format is most appropriate where the consequences span the full range from negligible to fatal, and where distinguishing between, for example, a score of 12 (Moderate) and 15 (Substantial) will materially change the management decision. For a simple office hazard register, a 3×3 may be both proportionate and sufficient.

---

Does a 5×5 Matrix Satisfy UK Legal Requirements?

No single UK regulation specifies that employers must use a 5×5 matrix, or any matrix format. The legal obligation — applicable across a range of UK health and safety legislation — is to carry out a suitable and sufficient risk assessment. The 5×5 matrix is one widely accepted method of meeting that obligation, provided it is:

• Task and site specific: completed for the actual work, location and personnel involved, not copied generically.
• Completed by a competent person: someone with the training, experience and knowledge to make reliable judgements about likelihood and severity.
• Reviewed when circumstances change: a static document that is never updated is unlikely to remain suitable and sufficient over time.
• Recorded where required: where the legal duty to record applies, the matrix scores and the control measures behind them must be documented, not just the final numbers.

A 5×5 matrix that records only scores without explaining the basis for each judgement — or that records residual risk without identifying the specific controls that produced it — is unlikely to meet the suitable and sufficient standard, regardless of the format used.

---

Seven Common Scoring Mistakes and How to Avoid Them

Scoring errors checklist — review each before signing off any matrix.

1. Anchoring severity to property damage, not injury. The matrix measures harm to people. A fire that destroys equipment but injures nobody scores differently from one that causes burns. Always ask: what is the realistic worst-case injury outcome?

2. Scoring likelihood without considering existing controls. Inherent likelihood must reflect the uncontrolled scenario. If you factor in existing controls at the inherent stage, you conflate inherent and residual risk and lose the evidence trail showing that controls made a difference.

3. Conflating inherent and residual risk. Inherent and residual must be scored and recorded separately. A single score with no before/after comparison is a gap that an inspector or legal review will identify immediately.

4. Selecting severity based on the most likely outcome, not the credible worst case. Risk assessment requires considering realistic worst-case harm. Minor cuts are the most common outcome of many tasks — but the credible worst case may be amputation. Score for the credible worst case.

5. Treating the matrix score as the decision, not an input to it. A score of 8 (Moderate-low) does not mean "nothing more to do." It means controls must be confirmed in place before the task is authorised. The assessor must still judge whether further improvements are reasonably practicable.

6. Failing to re-score after controls are added. A risk assessment that records inherent risk but never produces a residual score leaves the reader unable to tell whether the controls actually work. Always close the loop.

7. Using identical likelihood descriptors for different task frequencies. "Unlikely" means different things for a task done once a year versus one done daily. Calibrate likelihood to the exposure frequency of the specific task, not a generic definition.

---

Using the 5×5 Matrix Inside ramsdocs

ramsdocs risk assessment templates embed the 5×5 grid alongside method statement sections, so inherent and residual scores are captured in the same document as the control measures that justify them. This produces RAMS documentation that is PC review-ready, with scores and controls visible together rather than in separate files.

To use the matrix in ramsdocs:

1. Open a new risk assessment document and select the 5×5 matrix format.
2. List each hazard and score inherent likelihood and severity before entering any controls.
3. Add your control measures in the adjacent column.
4. Re-score likelihood and severity to produce the residual rating.
5. Check residual scores against the decision tree: any score ≥ 15 requires further action before the document can be marked ready for submission.

Important: ramsdocs documentation is designed to support compliance — it does not itself satisfy any legal obligation. All risk assessments produced using ramsdocs must be reviewed and adapted to the specific site, task, and personnel by a competent person before use.

---

Frequently Asked Questions

Q: Do I have to use a 5×5 matrix to comply with UK health and safety law? No. No UK regulation specifies the matrix format. The legal obligation is to conduct a suitable and sufficient risk assessment. A 5×5 matrix is one method that, when used correctly, can support that obligation. A proportionate approach — such as a 3×3 for low-hazard environments — may equally satisfy the requirement.

Q: What is the difference between inherent and residual risk? Inherent risk is the score before any control measures exist. Residual risk is the score after controls are applied. Both must be recorded; showing only one leaves a gap in the evidence trail.

Q: Can a residual risk score of 8 (Moderate-low) mean work is safe to proceed? It means work can proceed once a supervisor has confirmed the stated controls are actually in place. It does not mean the hazard is eliminated or that no further improvement is needed. Review whether additional improvements are reasonably practicable.

Q: How do I score likelihood for a task that happens only once a year? Adjust your likelihood anchor for the exposure frequency. A task performed once annually with no prior incidents and solid controls in place may genuinely sit at 1 (Rare) or 2 (Unlikely), even if the hazard is severe.

Q: What does 'suitable and sufficient' risk assessment mean in practice? It means the assessment must be appropriate to the nature of the work and the level of risk; identify all significant hazards; involve all who may be affected; result in valid conclusions; and remain current. A 5×5 matrix completed generically — not reviewed for the actual site and task — is unlikely to meet this standard.

Q: When should I use a 3×3 instead of a 5×5 matrix? A 3×3 is appropriate for simple, low-hazard environments where the range of credible harm is narrow and the management response does not need fine gradation. A 5×5 is more appropriate wherever consequences span the full severity range, including the possibility of serious injury or fatality.

How should 5×5 matrix scores be communicated to the workforce before a task begins? Record the inherent and residual scores in your written risk assessment, then brief the relevant scores and the controls they drive at a toolbox talk before work starts — workers need to understand not just what to do but why that specific control brought the risk down to an acceptable band. Keep a signed attendance sheet for each briefing as evidence that communication took place. Where conditions change during the task, a short on-site briefing should be used to re-communicate any revised scores before work continues.

What format works best for presenting matrix scores at a toolbox talk? Display the relevant matrix cell on a printed or projected version of your 5×5 grid, calling out the inherent score first and then the residual score after controls — the visual contrast between, say, a red cell and an amber cell makes the value of the control measures immediately tangible to operatives. Avoid reading out numbers alone; anchor each score to the plain-language label on your matrix (for example, "Likely" or "Major") so the audience can calibrate without needing to know the scoring system. A one-page summary sheet showing the hazard, both scores, and the specific controls required can be left on site for reference throughout the task.

Who qualifies as a competent person to complete a 5×5 risk assessment on a UK construction site? There is no single statutory definition of competency that applies to all construction risk assessments; the level of knowledge and experience required is proportionate to the complexity and hazard level of the task being assessed. For asbestos risk assessments specifically, the Asbestos: Risk assessment source confirms that whoever carries out the assessment must have adequate knowledge, training and expertise in understanding the risks, know how the work activity may disturb asbestos, be familiar with the Control of Asbestos Regulations, and have the ability and authority to collate all necessary information. For general construction hazards, the practical benchmark is whether the individual can correctly identify the hazard, make a defensible judgement about likelihood and severity, recognise when specialist input is needed, and select controls grounded in the hierarchy — a combination of relevant trade experience, formal risk assessment training, and site-specific knowledge.

Does a 5×5 risk assessment need to be completed by a manager rather than a supervisor or leading hand? Seniority of job title is not the determining factor — competence is. A working supervisor with the relevant knowledge, site familiarity, and authority to implement controls can be well placed to complete or contribute to an assessment, provided the findings are reviewed by someone with the technical depth to challenge the scores where needed. The Construction method statements source notes that significant findings must be recorded where five or more people are employed, implying the assessment must be a substantive document capable of scrutiny — whoever completes it must be able to defend every score and control decision if questioned by a principal contractor or enforcing authority.

---

Disclaimer: The worked example, scoring bands, and decision tree on this page are illustrative tools to support understanding of the 5×5 risk assessment matrix. They are not a substitute for a site-specific risk assessment. All risk assessment documentation must be reviewed and adapted to the specific site, task, hazards, personnel, and prevailing conditions by a competent person before it is relied upon. Risk score bands are industry conventions, not statutory thresholds. ramsdocs documentation is designed to help produce records that support compliance — it does not itself constitute compliance.