An HSE risk assessment matrix scores workplace hazards by multiplying Likelihood and Severity to produce a clear, color-coded risk rating.
OSHA does not mandate a specific matrix format, but the General Duty Clause and 29 CFR 1910.132 require employers to assess and document hazards.
The 5x5 matrix is the North American industry standard for construction, oil and gas, manufacturing, and healthcare because it separates risks more clearly.
Matrix scores only matter when paired with the NIOSH Hierarchy of Controls and rescored after controls are added.
2.6M+
US nonfatal workplace injuries in 2023 (BLS)
$167B
Annual US cost of work-related injuries (NSC, 2022)
1,000+
Workplace fatalities in Canada each year (StatCan)
Every year, thousands of US workers get hurt doing things their employer believed were safe. According to the Bureau of Labor Statistics, more than 2.6 million nonfatal workplace injuries were reported across private industry in 2023. Most of them were predictable. That is exactly why teams use an HSE risk assessment matrix: a simple grid that turns gut-feel hazards into clear, scored decisions. This guide walks you through how the matrix works, what OSHA actually requires, and how to use it on the job without drowning in paperwork.
What Is an HSE Risk Assessment Matrix?
An HSE risk assessment matrix is a grid that scores workplace hazards by combining how likely an incident is with how serious it would be. Likelihood goes on one axis, severity on the other. Multiply the two, and you get a risk rating that tells you whether the hazard is low, medium, high, or extreme. In North America, "HSE" stands for Health, Safety, and Environment, not the UK regulator.
Most North American sites use a 5x5 grid because it gives enough range to separate small annoyances from real life-altering risks.
Does OSHA Require a Risk Assessment Matrix?
Short answer: not exactly. OSHA does not mandate a specific matrix format. What it does require, under the General Duty Clause of the OSH Act, is that employers keep workplaces "free from recognized hazards." Standards like 29 CFR 1910.132 also require a written PPE hazard assessment.
In Canada, provincial OHS laws and CSA Z1002 expect a documented hazard and risk evaluation, again without a fixed template.
So you do not have to use a 5x5 matrix. But you do need to prove you assessed each hazard. A matrix is the cleanest way to do that, which is why most employers adopt one voluntarily.
How the 5x5 Risk Assessment Matrix Works
The math is simple: Risk = Likelihood x Severity. Both are scored on a 1 to 5 scale.
Step 1: Score the Likelihood
Ask: how often is this hazard likely to cause harm if no controls are added?
1 Rare (almost never)
2 Unlikely (could happen, but doubtful)
3 Possible (might happen at some point)
4 Likely (will probably happen)
5 Almost Certain (expected to happen often)
Step 2: Score the Severity
Ask: if it does happen, how bad is the worst realistic outcome?
1 Negligible (first aid only)
2 Minor (medical treatment, no lost time)
3 Moderate (lost-time injury, recordable under OSHA)
4 Major (serious injury, hospitalization, permanent disability)
5 Catastrophic (fatality or multiple fatalities)
Step 3: Calculate the Risk Rating
Multiply the two scores. The result is your risk rating, somewhere between 1 and 25.
HSE Risk Matrix Color Codes Explained
Most North American matrices follow the same color logic:
Green (1 to 5): Low risk. Monitor, no immediate action.
Yellow (6 to 10): Medium. Reasonable controls needed.
Orange (11 to 15): High. Action required before work continues.
Red (16 to 25): Extreme. Stop work, fix the hazard, then re-score.
These colors are not regulated. They are an industry convention used to give the matrix instant visual meaning on a shop floor.
3x3 vs 4x4 vs 5x5 Risk Matrix
Matrix
Best For
Trade-Off
3x3
Small businesses, low-hazard offices
Too coarse, lumps small and serious risks together
4x4
Mid-size firms, retail, logistics
A compromise, but no clear "middle" rating
5x5
Construction, oil and gas, manufacturing, healthcare
Most detail, slightly more training needed
Neither OSHA, NIOSH, nor CCOHS mandate one size. ANSI/ASSP Z690 and ISO 45001 both accept any scale that is consistent and documented.
Worked Example: Line-of-Fire Hazard on a US Jobsite
Here is how the matrix works in real life.
A general contractor is rigging a 2,000-pound steel beam with a crane on a Texas jobsite. Workers stand within the swing radius below the load. This is a classic line-of-fire hazard.
Likelihood: 4 (Likely, with no controls)
Severity: 4 (Major, possible permanent injury or fatality if the load drops)
Raw Risk Score: 16 (Red, Extreme)
Stop the job. The supervisor adds controls:
Tag lines on the load
Exclusion zone with barricades
Spotter with radio
Pre-lift JSA briefing for all workers
Now rescore:
Likelihood: 2 (Unlikely with controls in place)
Severity: 3 (Moderate, residual chance of impact)
Residual Risk Score: 6 (Yellow, Medium)
The work can proceed under the new plan. The crew documents the assessment in the daily hazard analysis, which is the proof OSHA would expect to see if it ever inspected.
Linking the Matrix to the NIOSH Hierarchy of Controls
A score on its own does nothing. What matters is what you do with it. The NIOSH hierarchy of controls is the bridge:
The higher the risk score, the higher up the hierarchy your controls should go. A red 16+ score usually demands engineering controls at a minimum. A green score might only need administrative reminders.
According to the National Safety Council, work-related injuries cost the US economy roughly $167 billion in 2022. Most of that is preventable with controls applied at the right level.
7 Common HSE Risk Matrix Mistakes to Avoid
Confusing the hazard (the source of harm) with the risk (its scored outcome)
Inflating likelihood because "anything could happen"
Ignoring the worst realistic outcome and scoring the average case instead
Forgetting to rescore after controls are added (residual risk)
Leaving out vulnerable workers like new hires, young workers, or contractors
Letting one person score in isolation rather than as a small team
Treating the matrix as a one-off form instead of a living document
Statistics Canada reports more than 1,000 workplace fatalities and over 300,000 accepted lost-time claims across Canada each year. Most root-cause reviews trace back to one of those scoring mistakes.
Which Standards Govern HSE Risk Assessment in North America?
A quick map of who says what:
OSHA (US): General Duty Clause and 29 CFR 1910 require hazard assessment, no format specified
NIOSH (US): Publishes the hierarchy of controls and methodology
ANSI/ASSP Z690 series: US national standard adopting ISO 31000 risk management principles
CSA Z1002 (Canada): National standard for occupational health and safety hazard identification and risk assessment
ISO 45001: International OH&S management system, accepted across both countries
CCOHS: Canadian advisory body with sector-specific guidance
OSHA's 2024 enforcement data shows fall protection, hazard communication, and lockout/tagout remain the three most-cited standards. All three are areas where a properly used matrix would have flagged the risk well before a citation.
Frequently Asked Questions
It is a 5-row by 5-column grid scoring likelihood from 1 (rare) to 5 (almost certain) against severity from 1 (negligible) to 5 (catastrophic). The two scores multiply to give a risk rating from 1 to 25.
OSHA requires hazard assessments under several standards, including PPE (29 CFR 1910.132). It does not require a specific matrix format, but documentation is expected.
Most North American matrices use Low, Medium, High, and Extreme bands, sometimes adding a Negligible tier. They map to score ranges 1-5, 6-10, 11-15, and 16-25.
A 3x3 has nine cells and is faster but less precise. A 5x5 has 25 cells, separates risks more clearly, and is standard in higher-hazard industries.
No. The matrix scores each hazard. The risk register is the master list of all hazards, scores, controls, and review dates that the matrix feeds into.
Final Thoughts
A good HSE risk assessment matrix is not a piece of paperwork. It is a shared language for your crew, your supervisors, and your safety team. Scored properly and rescored after controls, it turns gut-feel into evidence and protects both workers and the business that employs them.
Build the habit of running every new task through the matrix before tools come out of the truck. That five-minute habit is what keeps the incident report blank at the end of the shift.
What hazard would you score next on your site? Drop it in the comments, and share this guide with the safety officer who needs it most.
Get the Free 5x5 HSE Risk Matrix Template
Download a printable Excel and PDF template pre-aligned to OSHA and the NIOSH hierarchy of controls.
