5x5 Risk Matrix Explained: How to Score Risk
The 5x5 risk matrix is the tool most UK construction risk assessments use to turn a judgement about a hazard into a number. It sounds technical, but the idea is simple: how likely is the harm, and how bad would it be. This guide explains the two axes, how the risk score is worked out, how to read the colour bands, and how to apply it properly on a real job, with worked examples and the mistakes to avoid.
What a 5x5 risk matrix is
A 5x5 risk matrix is a five by five grid used to rate the level of risk from a hazard. One axis measures how likely the harm is, on a scale of 1 to 5. The other measures how severe the harm would be if it happened, also on a scale of 1 to 5. You pick a number on each axis, multiply them together, and the result is a risk rating between 1 and 25. The higher the number, the more pressing the risk.
The point of the matrix is consistency. Instead of one person calling a task risky and another calling it fine, everyone scores it the same way and lands on a comparable number. That makes it far easier to prioritise: you tackle the high scores first, and you can show a client, a principal contractor or an inspector how you reached each rating.
The two axes explained
Everything on the matrix comes down to two questions. Score each one from 1 to 5.
Likelihood, 1 to 5
Likelihood is how probable it is that the hazard actually causes harm, given the work and the controls already in place. A typical scale reads:
- 1, Rare. Very unlikely to happen, would be a surprise.
- 2, Unlikely. Could happen but not expected.
- 3, Possible. Might happen from time to time.
- 4, Likely. Will probably happen at some point.
- 5, Almost certain. Expected to happen, perhaps often.
Severity, 1 to 5
Severity, sometimes called consequence, is how serious the outcome would be if the harm occurred. A typical scale reads:
- 1, Negligible. Minor discomfort, no real injury or a trivial one.
- 2, Minor. First aid injury, no time off.
- 3, Moderate. Injury needing medical treatment, some time off work.
- 4, Major. Serious injury, long term harm or a specified injury under RIDDOR.
- 5, Catastrophic. Fatality or multiple serious injuries.
The exact wording of each level varies between organisations, but the shape is always the same: a low number is trivial and a high number is life changing.
How to calculate the risk score
The risk rating is simply likelihood multiplied by severity.
The result runs from 1, meaning likelihood 1 by severity 1, up to 25, meaning likelihood 5 by severity 5.
So if a task has a likelihood of 3, meaning it might happen from time to time, and a severity of 4, meaning a serious injury, the risk score is 3 multiplied by 4, which is 12. That single number is then compared against the colour bands to decide how urgently you need to act.
The 5x5 matrix
Read the matrix by finding the severity row down the left and the likelihood column across the top. The cell where they meet is the risk score for that combination. The colours show the level of concern at a glance.
| Severity down / Likelihood across | 1 Rare |
2 Unlikely |
3 Possible |
4 Likely |
5 Almost certain |
|---|---|---|---|---|---|
| 5 Catastrophic | 5 | 10 | 15 | 20 | 25 |
| 4 Major | 4 | 8 | 12 | 16 | 20 |
| 3 Moderate | 3 | 6 | 9 | 12 | 15 |
| 2 Minor | 2 | 4 | 6 | 8 | 10 |
| 1 Negligible | 1 | 2 | 3 | 4 | 5 |
How to band the scores
Once you have a score you need to know what it means. The scores are grouped into bands, usually shown as green, amber and red, so a number becomes a level of action. A widely used banding is:
| Score | Band | What it means |
|---|---|---|
| 1 to 6 | Low, green | Broadly acceptable. Keep existing controls in place and review as normal. |
| 8 to 12 | Medium, amber | Reduce the risk further where reasonably practicable. Add controls and monitor. |
| 15 to 25 | High, red | Not acceptable as it stands. Stop or add strong controls before the work proceeds. |
Treat these bands as guidance, not a fixed law. The cut-off points differ between organisations, and some matrices split the middle into two bands or shade individual cells slightly differently. What matters is that your own risk assessment procedure states the bands you use and that you apply them consistently. Always check the bands set out in your company system before you score a real job.
Worked examples
Two quick examples show how the same matrix handles very different tasks.
Example 1, working at height on a scaffold
A fall from a scaffold could be fatal, so severity is 5. With a properly built, inspected scaffold, edge protection and trained operatives, a fall is unlikely, so likelihood is 2. The score is 5 multiplied by 2, which is 10, landing in the amber band. That tells you the controls are helping but the residual risk still needs active monitoring and cannot be ignored.
Example 2, minor cut from hand tools
A nick from a hand tool is a first aid injury, so severity is 2. On a busy site small cuts happen fairly often, so likelihood is 3. The score is 2 multiplied by 3, which is 6, sitting in the green band. Sensible controls such as gloves and tidy work are enough, and this task should not steal attention from the higher scores.
Using it in a construction risk assessment
The matrix is one part of a proper risk assessment, not the whole thing. In practice you score each hazard twice.
- Score the raw risk. Rate likelihood and severity as if no controls were in place, and record the initial score. This shows how serious the hazard is on its own.
- Add your controls. Decide the measures that reduce the risk, working through the hierarchy of control, from eliminating the hazard down to protective equipment as a last resort.
- Score the residual risk. Rate likelihood and severity again with the controls applied, and record the residual score. This is the number that shows whether the work is safe to proceed.
- Act on the band. If the residual score is still red, the controls are not enough and you go back and strengthen them before the work starts.
Recording both the initial and residual scores demonstrates your reasoning and proves the controls actually bring the risk down to an acceptable level.
Common mistakes
- Adding instead of multiplying. The score is likelihood multiplied by severity, not added. Adding flattens the scale and understates the worst combinations.
- Scoring severity too low. Severity is the worst realistic outcome, not the most likely one. If a fall could kill, severity is 5 even if serious falls are uncommon.
- Scoring the raw risk and stopping. The number that matters is the residual risk after controls. Forgetting the second score hides whether the work is actually safe.
- Chasing a low number. The matrix supports a judgement, it does not replace it. Nudging a score down to reach green defeats the purpose and leaves people exposed.
- Ignoring your own bands. Using cut-off points from a template that does not match your company procedure leads to inconsistent decisions. Use the bands your system defines.
Related guides
- Risk assessment for construction: the basics, for the underlying five step method the matrix sits inside.
- How to write a risk assessment, a plain-English walkthrough.
- Young person risk assessment, for assessing risk to under-18 workers.
- RAMS template, to sit your scored assessment inside a full method statement.
- AI risk assessments in construction, on producing scored assessments faster.
Frequently asked questions
What does a 5x5 risk matrix mean?
A 5x5 risk matrix is a grid used to rate risk. One axis rates how likely a hazard is to cause harm on a scale of 1 to 5, and the other rates how severe that harm would be, also on a scale of 1 to 5. The two scores are multiplied to give a risk rating between 1 and 25, which is then compared against colour bands to decide how urgently the risk needs controlling.
How do you calculate a risk score?
You calculate a risk score by multiplying likelihood by severity. Rate how likely the harm is on a 1 to 5 scale, rate how serious the harm would be on a 1 to 5 scale, then multiply the two numbers. For example, a likelihood of 3 and a severity of 4 gives a risk score of 12. The lowest possible score is 1 and the highest is 25.
What are the colour bands on a 5x5 risk matrix?
The colour bands group risk scores into levels of concern. A common approach is green for low risk, amber for medium risk and red for high risk. For example, scores of 1 to 6 may be green, 8 to 12 amber and 15 to 25 red. The exact cut-off points vary between organisations, so always check the bands set out in your own risk assessment procedure.
Is a 5x5 matrix better than a 3x3 matrix?
Neither is inherently better. A 3x3 matrix is quicker and simpler, which suits low complexity tasks. A 5x5 matrix gives more resolution, so it separates a moderate risk from a serious one more clearly, which is useful on construction sites where hazards vary a lot. The right choice is whichever your organisation uses consistently and applies with sound judgement.
The shortcut
Scoring every hazard by likelihood and severity, applying the right controls and re-scoring the residual risk is careful work that eats your evenings. Site Manager AI produces project specific risk assessments, method statements and RAMS in minutes, with the hazards identified, controls suggested and risk ratings applied, all scoped to current UK regulations. You get compliant, professional documents and your evenings back.
See how it worksFrom £9.99/month, cancel anytime. Lifetime access also available.
This article is general guidance for UK construction and is not legal advice. Risk banding and scoring scales vary between organisations, so check the procedure and bands set out in your own management system and current HSE guidance.