1. What is a Risk Matrix?
A Risk Matrix is a visual decision-making tool used to rank risk by combining two factors: the likelihood that a hazardous event may occur and the severity of the consequences if it does occur. In construction, the matrix supports one essential decision before work begins: whether the activity may proceed, requires stronger controls or must be stopped.
The most common equation is R = L × S, where R is the risk rating, L is likelihood and S is severity. The arithmetic is simple, but the result should never be treated as an objective truth by itself. A score is meaningful only when the scales are clearly defined, the assessment team understands the actual work conditions and the proposed controls are verified in the field.
A hazard is a source, condition or behaviour with the potential to cause harm. Risk is the combination of the probability that the hazard will lead to an event and the seriousness of the resulting harm. High voltage is a hazard; the possibility of electric shock under a particular isolation arrangement, together with the potential injury, is the risk. A deep excavation is a hazard; collapse, falls and oxygen deficiency depend on soil conditions, depth, groundwater, shoring, access and work organisation.
| Term | Question | Construction example | Management output |
|---|---|---|---|
| Hazard | What can cause harm? | Electricity, suspended loads, excavations, toxic gas | Hazard register |
| Hazardous event | What may happen? | Electric shock, scaffold collapse, falling object, crane overturn | Incident scenario |
| Consequence | Who or what may be affected? | Injury, fatality, fire, asset loss, project shutdown | Severity rating |
| Risk | How do likelihood and consequence combine? | L4 × S5 = 20 | Priority and action |
2. Why is a Risk Matrix essential in construction?
A construction site is a constantly changing system. The same area may be a material-delivery route in the morning, a crane operating zone in the afternoon and a hot-work location at night. Personnel, equipment, elevation, weather and interfaces between contractors change continuously. Experience remains valuable, but it cannot replace a structured assessment process.
A Risk Matrix creates a shared language between the client, consultant, main contractor, subcontractors and work crews. When all parties use the same scoring scales and acceptance criteria, safety discussions become less subjective. A red-zone risk cannot be justified by saying, “we have always done it this way.” At the same time, genuinely low risks do not need disproportionate controls that waste resources.
The matrix also connects HSE to construction project management, programme, quality, cost and change control. It supports a project culture based on discipline, accountability and Stop Work Authority, rather than paperwork completed after decisions have already been made.
| Value | Without a structured matrix | With effective implementation | Evidence |
|---|---|---|---|
| Prioritisation | Resources spread across all issues | Focus on critical and high risks | Ranked action list |
| Approval | Based on personal judgement | Based on consistent criteria | Approval level and hold points |
| Communication | Different interpretations | Common language across parties | Clear toolbox talks |
| Prevention | Reaction after incidents | Control before exposure | Reduced unsafe conditions and near misses |
| Learning | Forms disconnected from reality | Reviews triggered by change | Revision history and lessons learned |
3. The process for building and approving a Risk Matrix
Step 1 — Define the scope and break the work into steps
A scope such as “structural works” is too broad. Break it down into transport, fabrication, lifting, positioning, temporary restraint, bolting or welding, inspection and removal of lifting equipment. Correct task breakdown exposes the points where energy, movement, height or simultaneous operations create risk.
Step 2 — Identify hazards and credible event scenarios
Use site walks, checklists, incident and near-miss data, manufacturer instructions and lessons from similar projects. Consider people, plant, materials, methods, environment and interfaces. Writing only “fall from height” is not enough. The assessment should explain who may fall, from where, during which step and because of which control failure.
Step 3 — Assess the initial risk
Initial risk is rated before new controls are introduced. Do not lower the score because workers are expected to “be careful.” Human attention is not a substitute for edge protection, guarding, interlocks, energy isolation or engineered stability.
Step 4 — Select controls according to the hierarchy
Prioritise elimination, substitution, engineering controls, administrative controls and, finally, personal protective equipment. A strong assessment does not use the same list of helmets, glasses and harnesses for every hazard.
Step 5 — Assess residual risk
Re-score likelihood and severity after controls have been selected and implemented. A control that exists only in a method statement cannot be credited as an active protective layer. Residual risk must reflect verified site conditions.
Step 6 — Approve, communicate and verify
A signature is not the end of the process. The responsible person must verify permits, equipment condition, exclusion zones, rescue arrangements and worker understanding. If a critical control is not ready, the activity remains at a Hold Point.
4. Building reliable likelihood and severity scales
An organisation may use three, four or five levels, but each definition must be specific enough for independent assessors to reach similar conclusions. Terms such as “possible” and “serious” create inconsistent scoring if they are not supported by frequency, exposure or consequence criteria.
| Level | Description | Indicative frequency | Site indicator |
|---|---|---|---|
| 1 | Rare | May not occur during the project lifecycle | Exposure has largely been designed out |
| 2 | Unlikely | Known in the industry but uncommon | Several independent controls are in place |
| 3 | Possible | May occur once during the project | Success depends significantly on procedure compliance |
| 4 | Likely | May occur repeatedly without control | Frequent exposure or changing conditions |
| 5 | Almost certain | Expected under current conditions | Warning signs, near misses or failed controls already exist |
| Level | People | Assets and programme | Environment and reputation |
|---|---|---|---|
| 1 | No injury or very minor first aid | No meaningful disruption | Negligible effect |
| 2 | Minor injury or first aid | Small repair or local delay | Internal complaint |
| 3 | Medical treatment or lost time | Work-package shutdown or moderate loss | Reportable event |
| 4 | Major injury or multiple injuries | Project disruption or major damage | Significant legal and reputational effect |
| 5 | Single or multiple fatalities | Catastrophic loss and prolonged shutdown | Major environmental, legal or reputational crisis |
5. How to read 3×3, 4×4 and 5×5 Risk Matrices
A 3×3 matrix is suitable for simple activities, a limited number of hazards and rapid decisions. A 4×4 matrix offers more distinction while remaining relatively easy to operate. A 5×5 matrix is common on major projects because it provides greater resolution, but it can create false precision if the definitions are unclear.
| S ↓ / L → | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | 5 | 10 | 15 | 20 | 25 |
| 4 | 4 | 8 | 12 | 16 | 20 |
| 3 | 3 | 6 | 9 | 12 | 15 |
| 2 | 2 | 4 | 6 | 8 | 10 |
| 1 | 1 | 2 | 3 | 4 | 5 |
| Score | Level | Decision | Minimum authority | Timing |
|---|---|---|---|---|
| 1–4 | Low | Proceed with routine controls | Work supervisor | Maintain and monitor |
| 5–9 | Medium | Add controls and verify before work | Engineer or HSE representative | Before release |
| 10–14 | High | Do not start until the risk is reduced | Construction Manager or HSE Manager | Immediate action |
| 15–25 | Extreme | Stop, redesign or eliminate the hazard | Project leadership | No programme exception |
6. Turning risk scores into effective controls
A frequent failure is to calculate a score and then record vague controls such as “follow safety rules,” “wear full PPE” or “provide supervision.” These statements cannot be objectively verified and do not identify what must be installed, who owns the action or what acceptance criteria apply.
A good control is specific, observable and assigned. For falling objects, this may include a debris deck at a defined elevation, toe boards, an exclusion zone, tool tethering, pre-shift inspection and supervisor sign-off. The instruction “be careful of falling objects” does not reduce risk in a measurable way.
| Priority | Control | Construction example | Reliability | Verification |
|---|---|---|---|---|
| 1 | Elimination | Assemble at ground level instead of working at height | Very high | The exposure no longer exists |
| 2 | Substitution | Use a less hazardous material or process | High | Approved replacement specification |
| 3 | Engineering | Guardrails, interlocks, shoring and machine guarding | High | Installation and functional test |
| 4 | Administrative | Permits, segregation, training and signage | Medium | Records and field observation |
| 5 | PPE | Helmet, eye protection, harness and respirator | User-dependent | Correct type, condition, fit and use |
For complex activities such as steel structures, MEP construction, lifting operations and industrial maintenance, engineering controls must be coordinated with design and work sequencing. Maintenance risks should also connect with MRO services, energy isolation and restart planning.
7. Risk Matrix examples for high-risk construction work
The examples below illustrate how to move from a generic hazard description to a management decision. The ratings are indicative and must be adjusted to actual project conditions.
| Activity | Hazardous event | Initial risk | Key controls | Residual risk |
|---|---|---|---|---|
| Work at height | Fall from an open edge | 20 | Guardrails, closed platform, lifeline, rescue plan, inspection | 6 |
| Crane lifting | Dropped load or crane overturn | 20 | Lifting plan, ground check, load chart, rigger, exclusion zone | 8 |
| Excavation | Collapse and burial | 15 | Engineered shoring, dewatering, gas test, safe access | 6 |
| Electrical work | Unexpected energisation | 20 | LOTO, test for dead, grounding and key control | 4 |
| Hot work | Fire caused by sparks | 12 | Permit, removal of combustibles, fire watch, gas test | 4 |
| Confined space | Oxygen deficiency or toxic gas | 25 | Continuous gas monitoring, ventilation, standby and rescue system | 8 |
| Scaffolding | Collapse or fall | 20 | Design, foundation, ties, full decking, inspection tag and load limit | 6 |
| Forklift operation | Collision with pedestrians | 12 | Route segregation, speed control, warning devices and spotter | 4 |
7.1 Work at height
A personal harness alone does not prevent a fall and may leave the worker suspended in need of rapid rescue. Collective protection should therefore be prioritised: guardrails, secure platforms, safe access, engineered anchors and a practical rescue plan.
7.2 Lifting operations
Lifting risk depends on load weight, centre of gravity, working radius, ground bearing capacity, wind, lifting accessories and surrounding interfaces. A lifting plan must reflect the actual crane and actual configuration. Experience never replaces a load chart or accessory inspection.
7.3 Electrical isolation
Unexpected energisation during maintenance can be fatal. A robust system identifies every energy source, isolates, locks, tags, releases stored energy, verifies zero energy and controls restart. This is a key interface between HSE, inspection and maintenance discipline.
8. Risk Matrix, JSA, Method Statement and Permit to Work
A Risk Matrix does not replace a Job Safety Analysis, and a JSA does not replace the Method Statement. Each document answers a different question. The Method Statement explains how the work will be organised and performed. The JSA breaks the activity into steps and identifies hazards and controls at each step. The Risk Matrix ranks priorities. The Permit to Work confirms that a defined high-risk activity may proceed at a specific place and time.
| Tool | Main purpose | When prepared | Main users | Control focus |
|---|---|---|---|---|
| Method Statement | Describe technical method and work sequence | Before mobilisation | Engineering, QA/QC and HSE | Technical feasibility and conditions |
| JSA/JHA | Analyse hazards step by step | Before work and after change | Work crew, supervision and HSE | Controls at each work step |
| Risk Matrix | Rank and prioritise risk | Initial and residual assessment | Assessors and approvers | Acceptance threshold |
| Permit to Work | Authorise a high-risk activity | Immediately before release | Permit issuer and performing authority | Field conditions are ready |
| Toolbox Talk | Communicate hazards and safe method | Before shift or task | Entire work team | Understanding and commitment |
9. Ten common Risk Matrix mistakes
1. Copying an old project
The hazard list may look familiar, but the soil, plant, interfaces and workforce are different. A copied form creates paperwork without control.
2. Scoring to obtain approval
Lowering likelihood or severity to force a score into an acceptable zone transfers risk to the workforce.
3. Using PPE as the main control
PPE is the final layer. Elimination, substitution and engineering measures should come first.
4. Confusing initial and residual risk
The two ratings demonstrate the effect of controls. If they are identical, review the controls or the scoring logic.
5. Writing controls that cannot be verified
“Comply with safety rules” is not a measurable field condition.
6. Excluding the work crew
Office-only assessments often miss access, posture, sequence, congestion and practical limitations.
7. Ignoring contractor interfaces
Many serious events arise from simultaneous operations and conflicting activities.
8. Failing to review after change
Different equipment, weather, night work or a new operator may significantly alter risk.
9. Using colour without a decision rule
Every colour must trigger an action, authority level and completion deadline.
10. Not checking the field
A control recorded on paper may be missing, damaged or misunderstood.
10. Risk assessment approval checklist
A checklist does not replace professional competence, but it reduces omissions and creates evidence that both the document and the field conditions have been reviewed.
| No. | Review item | Acceptance criterion | Evidence |
|---|---|---|---|
| 1 | Scope and sequence | All work steps reflect actual conditions | Method Statement and drawings |
| 2 | Assessment team | Engineering, HSE and performing personnel involved | Attendance record |
| 3 | Hazards and event scenarios | More than a generic hazard name | JSA and risk register |
| 4 | Likelihood and severity scales | Clear and consistently applied | HSE procedure |
| 5 | Initial risk | Not artificially reduced for approval | Review comments |
| 6 | Hierarchy of Controls | Elimination and engineering prioritised | Drawings, data sheets and photographs |
| 7 | Action owners | Each action has an owner and deadline | Action tracker |
| 8 | Residual risk | Within the approved threshold | Approved Risk Matrix |
| 9 | Emergency and rescue plan | Practical and resourced | Rescue plan and drill |
| 10 | Worker communication | Workers understand the hazards and controls | Toolbox record |
| 11 | Field verification | Controls are physically in place | Inspection checklist and photographs |
| 12 | Change triggers | Conditions requiring reassessment are defined | Revision history |
11. Comparing sites with and without effective risk assessment
A site without an effective system tends to react after unsafe conditions have already developed. A mature site identifies changing conditions before they become incidents: intersecting crane routes, weak ground, expired inspections, poor weather, low visibility, simultaneous operations or changes in personnel.
12. Risk Matrix and international management systems
ISO 45001 requires organisations to identify hazards, assess occupational health and safety risks and determine controls. ISO 31000 provides broader risk-management principles and framework guidance. PMBOK considers uncertainty in the context of project management. OSHA, HSE UK and national regulations provide more specific requirements for particular work types.
A company should not claim that its matrix is “international standard” unless it can identify the procedure, scoring definitions, acceptance criteria and applicable references. The matrix must also comply with Vietnamese law, client requirements, contract conditions and the project management system.
13. Digital Risk Matrices and future development
Risk assessment can be digitised through electronic forms, QR access at work areas, dashboards, photographic evidence, digital signatures and revision histories. When connected to weather data, sensors, AI cameras, BIM or CMMS, the system may alert users to changing conditions and trigger reassessment.
Digitalising a weak process only accelerates poor decisions. Before investing in software, the organisation should standardise its hazard taxonomy, scoring scales, approval rights, action management and data quality. Technology should support judgement, not replace management accountability.
14. Conclusion: a Risk Matrix must lead to action
A Risk Matrix is powerful when it is used for its intended purpose: identifying what may cause harm, determining priorities, selecting controls and confirming that conditions are ready before exposure occurs. It becomes meaningless when copied, cosmetically scored or signed only to complete a procedure.
A professional project does not ask only, “Do we have a Risk Matrix?” It asks, “What is the most important risk today, which control is protecting people and what evidence shows that the control is working?” That question brings HSE back to its true purpose: protecting people through science, engineering, discipline and responsibility.
FAQ — Frequently asked questions about Risk Matrices
1. What is a Risk Matrix?
It is a table that ranks risk by combining likelihood and consequence to support prioritisation and control decisions.
2. Is a 5×5 matrix always better than a 3×3 matrix?
No. The appropriate model depends on task complexity, scale definitions and user competence.
3. What is the standard risk score formula?
The common formula is R = L × S, where L is likelihood and S is severity.
4. Who should participate in the assessment?
Engineering, HSE, supervision, the performing team and relevant equipment or operations specialists.
5. When should a Risk Matrix be reviewed?
After changes in method, plant, key personnel, location, weather, simultaneous operations, incidents or near misses.
6. How is a Risk Matrix different from a JSA?
The matrix ranks risk; the JSA analyses hazards and controls for each work step.
7. What is initial risk?
The rating before additional controls are introduced.
8. What is residual risk?
The rating after controls have been implemented and verified.
9. Can severity always be reduced?
No. Severity should be reduced only when the control genuinely limits the potential consequence.
10. Is PPE enough for a high risk?
Usually not. PPE is the final layer in the Hierarchy of Controls.
11. Can work proceed in a red zone?
No. Work should not start until the risk has been reduced and approved.
12. Can one template be used for every project?
A common framework may be used, but the assessment must be adapted to actual conditions.
13. Does a Risk Matrix replace a Method Statement?
No. Each document serves a different purpose and they must be coordinated.
14. Can a Risk Matrix be digital?
Yes, after the underlying process, scoring rules and responsibilities have been standardised.
Related articles and resources
Connect with INDUSVINA
INDUSVINA supports clients with Risk Matrices, JSA, Method Statements, HSE documentation and practical risk-control solutions tailored to each project.
Hotline/Zalo: 0979 823 639 • Email: info@indusvina.com
