A risk matrix is a grid that rates a risk by combining how likely harm is with how serious it would be. Multiply the two scores, such as 3 x 4 = 12, and the answer puts the risk in a band such as low, medium, high or extreme. It is a way to compare risks and decide what to fix first. This guide shows a 5×5 matrix you can copy, with worked examples for Queensland worksites.
Does Queensland law require a risk matrix?
No. The Work Health and Safety Act 2011 (Qld) and the Work Health and Safety Regulation 2011 (Qld) don’t set a risk matrix, and neither text uses the word. What they require is that you manage risk: eliminate risks so far as is reasonably practicable and, if you can’t, minimise them (section 17 of the WHS Act; section 35 of the WHS Regulation), using the hierarchy of control (section 36 of the WHS Regulation) and reviewing your controls (section 38 of the WHS Regulation).
The approved How to Manage Work Health and Safety Risks Code of Practice 2021 (Qld) says a risk assessment can be as simple as a discussion with your workers, or can use specific risk analysis tools. It also says that when a hazard is well known and its controls are well established, you may not need a formal assessment and can simply put the controls in place. A code of practice is guidance rather than law in itself, but a business must either follow an approved code or manage the risk in a way that gives an equivalent or higher standard of health and safety (section 26A of the WHS Act), and a court can rely on the code when deciding what is reasonably practicable (section 275 of the WHS Act).
Some assessments are required. For example, the Regulation requires a competent person to carry out a risk assessment for a confined space, recorded in writing (section 66 of the WHS Regulation). A matrix is one common way to structure an assessment like that, not the only way. See when a risk assessment should be carried out.
Step 1: score the likelihood
The approved code suggests rating the likelihood of harm as one of five levels. To estimate it, the code asks how often the task is done, how often people are near the hazard and whether it has happened before, in your workplace or elsewhere.
| Score | Likelihood | Meaning (from the code) |
|---|---|---|
| 5 | Certain to occur | Expected to occur in most circumstances |
| 4 | Very likely | Will probably occur in most circumstances |
| 3 | Possible | Might occur occasionally |
| 2 | Unlikely | Could happen at some time |
| 1 | Rare | May happen only in exceptional circumstances |
Step 2: score the consequence
The code asks you to consider how severe the harm could be, including whether the hazard could cause death, serious injury or illness, or only minor injuries needing first aid, and how many people could be harmed. It doesn’t set numbered consequence levels, so the scale below is an example written for this guide. Change the wording to suit your business, then use it the same way every time.
| Score | Consequence | Example meaning |
|---|---|---|
| 1 | Insignificant | No injury or illness |
| 2 | Minor | First aid only |
| 3 | Moderate | Medical treatment or time off work |
| 4 | Major | Serious injury or illness |
| 5 | Catastrophic | Death or permanent disability, or several people seriously harmed |
“Major” here is a rating label, not the legal test for a notifiable incident, which is set out in sections 35 to 37 of the WHS Act. Our guide to notifiable incidents in Queensland explains that test.
Step 3: read the 5×5 matrix
Find the likelihood down the side and the consequence across the top. The number in the box is likelihood x consequence. The bands used here are 1 to 4 low, 5 to 9 medium, 10 to 16 high and 20 to 25 extreme. They are an example layout written for this guide, not a legal standard and not taken from the code.
| Likelihood | Insignificant (1) | Minor (2) | Moderate (3) | Major (4) | Catastrophic (5) |
|---|---|---|---|---|---|
| Certain to occur (5) | 5: Medium | 10: High | 15: High | 20: Extreme | 25: Extreme |
| Very likely (4) | 4: Low | 8: Medium | 12: High | 16: High | 20: Extreme |
| Possible (3) | 3: Low | 6: Medium | 9: Medium | 12: High | 15: High |
| Unlikely (2) | 2: Low | 4: Low | 6: Medium | 8: Medium | 10: High |
| Rare (1) | 1: Low | 2: Low | 3: Low | 4: Low | 5: Medium |
One way a business might respond to each band (set your own rules and write them down):
- Low: manage with routine procedures and keep an eye on it.
- Medium: add controls and assign someone to do it by a set date.
- High: senior attention, and controls in place before the work goes ahead or continues.
- Extreme: stop the work until the risk is reduced.
Worked examples: before and after controls
Rate the risk as it stands, choose controls (most effective first, as the hierarchy of control requires), then rate it again. The second rating is the “residual risk”. These are illustrations written for this guide, not assessments of your site.
| Hazard and risk | Before controls | Controls | After controls |
|---|---|---|---|
| Moving heavy pallets by hand: back and shoulder strain | Very likely (4) x Moderate (3) = 12, High | Pallet jack or forklift instead of carrying (substitute and engineering), then training in lifting and team lifts (administrative) | Unlikely (2) x Moderate (3) = 6, Medium |
| Forklift and people on foot in a yard: a person struck | Possible (3) x Catastrophic (5) = 15, High | Separate walkways and barriers (isolate), traffic plan, spotter, high-visibility clothing | Rare (1) x Catastrophic (5) = 5, Medium |
| Leads across a walkway: trip and fall | Possible (3) x Minor (2) = 6, Medium | Hang leads overhead or use cable covers, housekeeping checks | Unlikely (2) x Minor (2) = 4, Low |
The hierarchy of control is in section 36 of the WHS Regulation: substitute, isolate or use engineering controls first, then administrative controls, then personal protective equipment (PPE). Read more in the hierarchy of controls, and see full worked tables in our risk assessment examples for construction.
What a risk matrix can’t do
- It doesn’t decide what is reasonably practicable. That is a legal weighing of likelihood, degree of harm, what you know, the controls available and cost (section 18 of the WHS Act). A “medium” score doesn’t mean you can stop.
- A low-probability, high-consequence risk can score “medium”. In the forklift example, 1 x 5 = 5 is still a possible death. The approved code says that where a hazard could cause death, serious injury or illness, more emphasis should be put on controls that eliminate the hazard or reduce the harm than on controls that only reduce the likelihood. Don’t let a middling number talk you out of a strong control.
- It is only as good as the information behind it. The code says to look at how work is actually done, not just what the manual says, and to include maintenance, cleaning, breakdowns and unusual situations. Ask the people who do the job.
- It isn’t a one-off. Review controls when they don’t control the risk, before a change that could create a new risk, or when a new hazard is identified, among other triggers (section 38 of the WHS Regulation).
3×3, 4×4 or 5×5?
A smaller grid is quicker for simple jobs. A 5×5 gives more detail for varied work. What matters is that everyone uses the same scale and the same definitions. Our risk assessment examples guide uses the code’s five likelihood levels with four consequence levels, which works equally well. Pick one, write it into your procedure and stick with it. Consult your workers when you choose it and when you use it, because the Act requires consultation when hazards are identified and risks assessed (section 49(a) of the WHS Act).
Record your ratings
The code suggests keeping a risk register that lists the hazards, what action is needed, who is responsible and by when. Our free risk assessment template and hazard report form are a good place to start, and the free hazard register template is a simple way to keep a register. For specific jobs, see the paid plant risk assessment form, the risk assessment for manual tasks template and the risk management policy and procedure. If you are still working out what is a hazard and what is a risk, start with hazard vs risk.
This guide is general information, not legal advice. Check the current law or talk to Workplace Health and Safety Queensland for your situation.
Templates for this job
Ready-to-edit Word and Excel templates for Queensland workplaces.
