Risk Assessment Matrix

The Risk Matrix helps you identify which hazards need immediate action. You find the likelihood of an incident in the left-hand column and the potential severity of the consequence in the top row. The box where they intersect provides the risk rating. This rating tells you if the current controls are enough or if you must stop work to fix the problem.

The 5-point scale for likelihood measures the chance of an incident happening.

• 1. Rare: The event is possible but has not happened in your industry and is unlikely to occur now.
• 2. Unlikely: The event could happen but is not expected.
• 3. Possible: The event might occur at some time. This is a common rating for trade sites if controls are basic.
• 4. Likely: The event will probably occur if nothing changes.
• 5. Almost Certain: The event is expected to occur regularly if no controls are in place.

The 5-point scale for consequence measures the severity of the outcome.

• 1. Insignificant: First aid only. No time off work required.
• 2. Minor: Medical treatment required. No permanent damage.
• 3. Moderate: Temporary high disability or significant time off work. Potential investigation by regulators.
• 4. Major: Permanent disability or single fatality.
• 5. Catastrophic: Multiple fatalities.

To calculate the risk rating, multiply the likelihood number by the consequence number. For example, if there is a moderate chance of a fall causing a major injury, you multiply Likely (4) by Major (4) to get a rating of 16.

A score between 1 and 4 is a Low risk. A score between 5 and 12 is a Medium risk. You must reduce these risks as far as reasonably practicable. A score between 8 and 15 is a High risk. A score between 16 and 25 is an Extreme risk.

You must apply the hierarchy of controls found in the Work Health and Safety Regulation 2011 (Cth) or your state specific equivalent. If a risk scores in the High or Extreme zone, you must act immediately. In some cases, you must stop work until the risk is lowered. You should follow the guidance in AS/NZS ISO 31000:2018 for risk management techniques. Your duty of care under the Work Health and Safety Act requires you to eliminate risks so far as is reasonably practicable. If elimination is not possible, you must minimise the risk using the most effective measure available.

Under the Work Health and Safety Act 2011 (the WHS Act), a Person Conducting a Business or Undertaking (PCBU) has a primary duty of care to ensure, so far as is reasonably practicable, that workers and other people are not exposed to health and safety risks arising from the business. This duty requires you to eliminate risks to health and safety. If it is not reasonably practicable to eliminate a risk, you must minimise it so far as is reasonably practicable.

A risk assessment matrix helps you satisfy this duty by providing a structured way to evaluate the severity of a hazard and the likelihood of it occurring. While the WHS Act does not explicitly require a written risk assessment for every hazard, you must understand the nature of the risk to control it effectively. The Work Health and Safety Regulations (WHS Regulations) specifically mandate risk assessments for certain high-risk activities, such as working with asbestos, hazardous chemicals, or in confined spaces. For general trade work, a formal assessment is best practice when hazards are not obvious or when you are unsure how to control them.

When using a risk matrix, you are applying the hierarchy of controls. This is a legal requirement under Regulation 36 of the WHS Regulations. You must work through the hierarchy from the top level (elimination) down to the lowest level (Personal Protective Equipment). Simply relying on low-level controls like PPE without first attempting to eliminate the hazard or substitute it with something safer is likely a breach of your legal duties.

The Code of Practice: How to Manage Work Health and Safety Risks provides practical guidance on this process. Following an approved Code of Practice is not mandatory in itself, but courts may rely on it to determine what is reasonably practicable in a legal proceeding. If you do not follow the Code, you must demonstrate that you used an equally effective or better method of managing the risk.

Consultation is a critical legal requirement under Section 47 of the WHS Act. You must consult, so far as is reasonably practicable, with your workers who carry out work for you and who are likely to be directly affected by a health and safety matter. When using a risk assessment matrix, you must involve your workers in the process. They often see the risks on the ground that you might miss. You must also consult with other duty holders if you share a workplace. Ignoring this consultation requirement can result in significant penalties and creates a workplace culture where safety risks are not properly identified or managed.

Follow these steps to meet your duties under the Work Health and Safety Act 2011 and the Work Health and Safety Regulations 2011. This process helps you comply with the Code of Practice: How to Manage Work Health and Safety Risks.

1. Identify hazards

Walk through your site and list anything that could cause harm. Think about the work you do, the equipment you use, and the environment. Common hazards include working at heights, electrical exposure, noise, dust, and manual handling. Talk to your workers. They often see risks you might miss. Check the Safety Data Sheets (SDS) for any chemicals you use. You must find every potential hazard before you start assessing the risk.

2. Assess likelihood

Look at each hazard and decide how likely it is to hurt someone. Is it certain to happen, or is it very unlikely? Consider your current safety measures. If you always use a safety harness, a fall might be unlikely. If you never wear one, a fall is almost certain. Be realistic. Do not underestimate the chance of something going wrong just because you have been lucky so far.

3. Assess consequence

Determine the severity of the injury if an accident occurs. Could it cause a fatality, permanent disability, or serious injury? Or would it just require first aid? Under Australian WHS laws, you must prioritise eliminating risks that cause death or serious injury. Be honest about the worst-case scenario.

4. Determine rating

Use the matrix to combine your likelihood and consequence scores. This gives you an overall risk rating like Extreme, High, Medium, or Low. This rating tells you which hazards need urgent attention. High or Extreme risks require immediate action. You must not start work if the risk is unacceptable.

5. Select controls

Use the hierarchy of control to choose the best safety measures. Elimination is the most effective control. If you cannot eliminate the hazard, minimise it using Substitution, Isolation, or Engineering controls. Administration controls and Personal Protective Equipment (PPE) are the least effective and should be used as a last resort or to support other controls. Record these controls in your safety plan.

6. Calculate residual risk

Review the hazard again with your new controls in place. Determine the new likelihood and consequence. Calculate the new rating to ensure the risk has dropped to an acceptable level. If the rating is still High or Extreme, you must go back and select stronger controls. You must keep reviewing this process to ensure your controls remain effective over time.

The hierarchy of controls is a standard method for selecting the most effective control measures to manage workplace risks. It ranks controls from the highest level of protection to the lowest. When you assess a risk using your Risk Assessment Matrix, you must work through this hierarchy to decide how to eliminate or minimise the danger.

Elimination This is the most effective control. You physically remove the hazard from the workplace. If the hazard is gone, the risk is gone. For example, you might eliminate a risk of working at heights by pre-assembling components on the ground rather than installing them at a height.

Substitution If you cannot eliminate the hazard, replace it with something less hazardous. This involves changing the process or the material. A common example is swapping a solvent-based chemical for a water-based alternative, or using a smaller piece of machinery that produces less noise or vibration.

Engineering Controls These involve physical changes to the workplace or equipment to isolate people from the hazard. They do not rely on human behaviour. Examples include installing physical guards on circular saws, using extraction fans to remove dust, or fitting vibration dampeners to machinery.

Administrative Controls Administrative controls alter the way people work. They rely on human behaviour and supervision, making them less effective than engineering controls. Examples include implementing job rotation schedules to reduce exposure to noise or vibration, providing safety signs, or developing Safe Work Method Statements (SWMS).

Personal Protective Equipment (PPE) PPE is the least effective control. It includes items like hard hats, safety glasses, high-vis clothing, and ear plugs. PPE does not stop the hazard from happening. It only minimises the impact on the worker if the hazard occurs. PPE should only be used as a last resort when there are no other options available, or as a temporary measure while higher-level controls are being put in place.

Under the Work Health and Safety Act 2011 and the Work Health and Safety Regulations, a Person Conducting a Business or Undertaking (PCBU) must eliminate risks so far as is reasonably practicable. If this is not possible, the PCBU must minimise the risks by applying the hierarchy of controls in the specific order listed above. You cannot simply jump straight to buying gloves or masks without first trying to eliminate, substitute, or engineer the problem out.

Always ensure your chosen control measures comply with relevant Australian Standards, such as AS/NZS 1801 for industrial head protection or AS/NZS 1336 for eye protection.

Residual risk is the level of risk that remains after you have applied all necessary control measures. It is the risk you actually live with on the job site. You do not eliminate every hazard completely. The goal of your risk management process is to reduce the risk to a level that is safe and acceptable.

Once you have selected and implemented your control measures, you must re-evaluate the risk using the same matrix you used for the initial assessment. Compare the new likelihood and severity of the incident happening with your controls in place. The resulting rating must be Low or Medium. If the rating remains High or Extreme, your current controls are not sufficient. You must not start work. You must go back to the hierarchy of controls and choose stronger measures.

Under the Work Health and Safety Act 2011 (Cth) and corresponding state legislation, a person conducting a business or undertaking (PCBU) must ensure, so far as is reasonably practicable, that risks are eliminated. If elimination is not possible, you must minimise the risks. An unacceptably high residual risk is a breach of your duty of care.

AS/NZS ISO 31000:2018 (Risk Management) reinforces the requirement for monitoring and review. You cannot simply set a control and forget it. You must verify that your controls work as intended in the real world. For Australian tradespeople, this means checking if a scaffold actually prevents a fall or if a ventilation system effectively removes dust.

Specific reassessment is critical after any incident or near miss. If a control fails, you must treat the situation as a new hazard. Document your findings in your Safe Work Method Statement (SWMS) or risk register. If a new control introduces a different hazard, you must assess that risk as well. For example, wearing heavy protective gloves might protect your hands from cuts but could reduce your dexterity when using power tools, increasing the risk of a different injury.

You must review your controls regularly. Regulations change, equipment wears out, and work conditions vary. A control that lowered the risk to Medium last year might not be effective today. Continuous monitoring ensures you remain compliant and your workers stay safe. Only proceed when the residual risk is documented and verified as Low or Medium.