How is the risk rating calculated?

Risk rating equals likelihood multiplied by severity. On a 5×5 matrix each runs 1 to 5, giving scores from 1 to 25; on a 3×3 matrix each runs 1 to 3, giving 1 to 9. The product is then placed into a colour band that sets the priority for action.

What do the bands mean on a 5×5 matrix?

A common HSE-style banding is: 1–4 low (acceptable, monitor), 5–9 medium (act within a defined period), 10–15 high (act soon, additional controls needed), and 16–25 intolerable (stop the activity until risk is reduced). Your organisation's risk appetite may set slightly different cut-offs.

What is the hierarchy of controls?

It is the ranked order of control effectiveness: eliminate the hazard, substitute it for something safer, apply engineering controls (guards, ventilation), apply administrative controls (procedures, training), and lastly personal protective equipment (PPE). Higher tiers are always preferred because they do not rely on human behaviour.

Why is PPE the last resort?

PPE only protects the individual wearing it, can fail or be worn incorrectly, and does nothing to reduce the hazard itself. It is the least reliable control, so it should supplement higher-tier measures rather than be the primary safeguard for a significant risk.

Does a low rating mean no action is needed?

Not necessarily. A low rating means the residual risk is broadly acceptable, but you should still record the assessment, keep existing controls in place, and review it periodically or after any incident, change of process, or new information.

What is the Health & Safety Risk Matrix Calculator?

Select hazard likelihood and severity to compute a risk rating (low, medium, high, or intolerable) on a standard UK HSE 5×5 or 3×3 risk matrix. Outputs the required control tier under the hierarchy of controls (eliminate, substitute, engineering, administrative, PPE). For H&S managers. Runs in your browser. It runs free in your browser on Gera Tools, with nothing uploaded.

Health & Safety Risk Matrix Calculator

Name: Health & Safety Risk Matrix Calculator
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

A risk matrix turns two judgements — how likely harm is and how serious it would be — into a single rating that drives action priority. This calculator implements the standard UK HSE-style 5×5 and 3×3 matrices and then points you to the level of control the hierarchy of controls expects for that rating.

How it works

The core formula is simply the product of the two scores:

risk rating = likelihood × severity

On a 5×5 matrix this gives 1 to 25; on a 3×3 matrix it gives 1 to 9. The product is banded into low, medium, high, and intolerable. Higher bands demand controls from higher up the hierarchy:

Eliminate -> Substitute -> Engineering -> Administrative -> PPE
(most effective)                                  (least effective)

Reading the 5×5 matrix bands

Score range	Band	Typical required action
1–4	Low	Acceptable — record assessment, review annually
5–9	Medium	Act within defined timescale, improve controls
10–15	High	Act soon — additional controls required
16–25	Intolerable	Stop activity until risk reduced

These thresholds follow common UK practice aligned with HSE guidance. Your organisation’s risk appetite may set slightly different cut-off points, which is why the calculator is flexible on band boundaries.

Worked example: working at height

Consider a maintenance worker cleaning gutters on a two-storey building without collective fall protection:

Likelihood — 3 (“possible” — falls happen with regularity in this type of work if controls are absent)
Severity — 4 (“major injury” — a fall from two storeys likely causes a broken limb or head injury at minimum)
Score — 3 × 4 = 12 (High)

High demands “act soon.” The hierarchy of controls response is:

Can the gutter be cleaned from the ground with a long-reach tool? (Eliminate the need to climb)
If not, can a mobile elevated work platform replace the ladder? (Engineering)
Can task frequency be reduced so the hazard arises less often? (Administrative)
Is a safety harness the final layer, not the primary one? (PPE — last resort only)

After implementing a long-reach cleaning system, likelihood drops to 1 (rarely needed to climb at all), giving a new score of 1 × 4 = 4 (Low). The risk is controlled, but the assessment is not deleted — it is retained as evidence.

Choosing 5×5 versus 3×3

Use 5×5 for formal risk assessments in construction, manufacturing, or clinical environments where fine distinctions in likelihood (from “rare” to “almost certain”) and severity (from “trivial” to “fatal”) meaningfully change the response.

Use 3×3 for quick triage, operational hot-spots, or in settings where staff need a fast, memorable scoring process. Three simple bands are easier to apply consistently but sacrifice granularity.

Recording the assessment

A completed risk matrix is only useful if it is recorded. Good practice includes: the hazard description, who might be harmed and how, the pre-control score, the controls in place, the post-control (residual) score, the person responsible for the controls, and the review date. Under UK law (the Management of Health and Safety at Work Regulations 1999), employers with five or more employees must record the significant findings of their risk assessment.