The 5x5 risk matrix is the standard method for assessing hazards in construction SWMS documents across New Zealand and Australia. It provides a systematic, repeatable way to evaluate how likely a hazard is to cause harm, how severe that harm would be, and whether your control measures are actually reducing the risk to an acceptable level.
This guide covers the complete methodology: the likelihood and consequence scales, the full colour-coded matrix, the difference between inherent and residual risk, and worked examples for two common construction scenarios. It also addresses the critical question of when a risk rating means you must stop work.
Contents
How the Risk Matrix Works
Risk is the product of two factors:
- Likelihood — How likely is it that the hazard will cause harm?
- Consequence — If the hazard does cause harm, how severe will it be?
Each factor is rated on a scale of 1 to 5. The risk score is calculated by multiplying them together:
Risk Score = Likelihood x Consequence
This produces scores ranging from 1 (lowest) to 25 (highest), which map to four risk categories: Low, Medium, High, and Extreme. The matrix provides a common language for discussing risk and a standardised framework for deciding what level of control is required.
The 5x5 matrix is referenced in WorkSafe New Zealand guidance, Safe Work Australia guidance, and is consistent with the risk management principles in AS/NZS ISO 31000:2018 and the risk assessment methodology in AS/NZS 4360.
Likelihood Scale (1–5)
Likelihood describes how probable it is that the hazard will result in harm, given the specific work conditions, equipment, environment, and duration of exposure. When rating likelihood, consider the frequency of the activity, the number of workers exposed, the duration of exposure, and any history of similar incidents.
| Score | Descriptor | Description | Practical Guidance |
|---|---|---|---|
| 1 | Rare | May occur only in exceptional circumstances | Has never occurred in the organisation or similar operations. Would require an unusual combination of failures. |
| 2 | Unlikely | Could occur at some time but is not expected | Has occurred elsewhere in the industry but not in this organisation. Possible but not anticipated under normal conditions. |
| 3 | Possible | Might occur at some time during normal operations | Has occurred occasionally in the organisation or regularly in the industry. Reasonable to expect it could happen. |
| 4 | Likely | Will probably occur in most circumstances | Has occurred several times in the organisation. Known to happen frequently in similar operations across the industry. |
| 5 | Almost Certain | Expected to occur in most circumstances | Occurs regularly. Without intervention, it is virtually certain to happen during this task. History of repeated occurrence. |
Rating tip: Rate likelihood based on the specific conditions of this task, not in the abstract. A fall from a roof is “Possible” (3) during general roof work with proper access, but “Likely” (4) during edge protection installation when guardrails are not yet in place. Same hazard, different likelihood based on the work step.
Consequence Scale (1–5)
Consequence describes the most credible worst-case outcome if the hazard results in harm. Rate the realistic worst case, not the absolute worst case. A fall from 3 metres is more likely to result in a serious fracture (Major, 4) than multiple fatalities (Catastrophic, 5), so rate it at 4.
| Score | Descriptor | Health Impact | Examples |
|---|---|---|---|
| 1 | Insignificant | First aid treatment only, no lost time | Minor cuts, bruises, superficial abrasions. Worker returns to work immediately after treatment. |
| 2 | Minor | Medical treatment injury, short-term impact | Sprains, strains, lacerations requiring stitches, minor burns. May require medical visit but recovery is complete within days. |
| 3 | Moderate | Lost time injury, hospital admission | Fractures, significant burns, concussion, disc injury. Worker unable to return to full duties for weeks or months. |
| 4 | Major | Permanent disability or single fatality | Amputation, spinal cord injury, permanent hearing loss, fatal fall, electrocution fatality. |
| 5 | Catastrophic | Multiple fatalities or irreversible widespread harm | Structural collapse with multiple workers in the zone, explosion, catastrophic equipment failure affecting multiple people. |
The Full 5x5 Matrix
The following matrix shows the risk score for every combination of likelihood and consequence. Cells are colour-coded by risk category.
| Consequence | |||||
|---|---|---|---|---|---|
| Likelihood | 1 Insignificant |
2 Minor |
3 Moderate |
4 Major |
5 Catastrophic |
| 5 — Almost Certain | 5 | 10 | 15 | 20 | 25 |
| 4 — Likely | 4 | 8 | 12 | 16 | 20 |
| 3 — Possible | 3 | 6 | 9 | 12 | 15 |
| 2 — Unlikely | 2 | 4 | 6 | 8 | 10 |
| 1 — Rare | 1 | 2 | 3 | 4 | 5 |
Risk Score = Likelihood x Consequence. Green = Low (1–4), Yellow = Medium (5–9), Orange = High (10–16), Red = Extreme (20–25).
Risk Rating Categories
Each risk score maps to one of four categories, each with a specific required response:
| Score | Category | Required Response |
|---|---|---|
| 1–4 | Low | Risk is acceptable. Proceed with standard controls and routine monitoring. Document in SWMS for completeness. |
| 5–9 | Medium | Risk is tolerable with monitoring. Implement additional controls where reasonably practicable. Supervisor oversight required. Review controls regularly. |
| 10–16 | High | Risk is significant. Senior management or client approval required before work proceeds. Additional controls must be implemented. Continuous monitoring during work. Consider redesigning the task. |
| 20–25 | Extreme | Risk is intolerable. Work must not proceed under any circumstances. The task must be redesigned, additional controls must be implemented, or the work must be cancelled. No management authority to override this. |
Inherent vs Residual Risk
Every hazard in a SWMS requires two risk assessments:
- Inherent risk (also called “uncontrolled risk”) — The risk level before any control measures are applied. This represents the raw danger of the hazard if nothing is done to manage it.
- Residual risk (also called “controlled risk”) — The risk level after control measures are applied. This represents the remaining risk that workers are actually exposed to during the work.
The comparison between inherent and residual risk serves two critical purposes:
- It demonstrates that controls are effective. If inherent risk is High (16) and residual risk is Medium (6) after controls, you can see that the controls reduce the risk by 10 points. This is the evidence that your controls are working.
- It identifies whether more controls are needed. If inherent risk is Extreme (20) and residual risk is still High (16) after controls, the reduction is insufficient. You need stronger controls, higher up the hierarchy of controls.
Key principle: Controls should primarily reduce likelihood, not consequence. You cannot change the consequence of a fall from 8 metres (it will always be Major or Catastrophic). But you can reduce the likelihood of that fall from “Likely” to “Rare” through guardrails, harnesses, and restricted access. When rating residual risk, focus on how controls change the likelihood of the hazardous event occurring.
Worked Example: Working at Heights
Task: Installing solar panels on a two-storey commercial building with a flat roof and 600mm parapet. Three workers, boom lift for access, two-day duration.
Hazard: Fall from Roof Edge
Inherent risk assessment (before controls):
- Likelihood: 4 (Likely) — Workers will be moving across the roof carrying panels, working near edges during installation. The parapet is only 600mm, below the 900mm minimum for effective edge protection.
- Consequence: 4 (Major) — Two-storey fall (approximately 6–8 metres) could result in permanent disability or fatality.
- Inherent risk score: 4 x 4 = 16 (High)
Control measures applied:
- Engineering: Install temporary guardrails (900mm height with mid-rail and toe board) along all roof edges where parapet is below 900mm, before any work on the roof surface commences.
- Engineering: Use boom lift for panel delivery to roof level, eliminating the need to carry panels up ladders or across the roof from access points.
- Administrative: All three workers must hold current Working at Heights certification (NZ Unit Standard 23229). Pre-start briefing to identify fall hazards and review rescue plan.
- PPE: Full body harness with twin-tail shock-absorbing lanyard connected to certified roof anchor points (AS/NZS 1891) during guardrail installation phase only.
Residual risk assessment (after controls):
- Likelihood: 2 (Unlikely) — With guardrails in place, fall from edge requires guardrail failure. Harness provides backup during installation phase. Trained workers understand edge awareness.
- Consequence: 4 (Major) — Consequence does not change. A fall, if it occurs despite controls, would still be from 6–8 metres.
- Residual risk score: 2 x 4 = 8 (Medium)
Risk reduced from 16 (High) to 8 (Medium). The controls cut the likelihood in half while the consequence remains the same. This is a realistic and compliant assessment.
Worked Example: Excavation Near Services
Task: Excavation of a 2-metre-deep trench for stormwater pipe installation in a commercial car park. Underground power cables and telecommunications conduits are known to be within 2 metres of the excavation line.
Hazard: Strike on Underground Electrical Cable
Inherent risk assessment (before controls):
- Likelihood: 4 (Likely) — Cables are confirmed within 2 metres of the dig line. Mechanical excavation at this proximity has a high probability of cable strike without precautions.
- Consequence: 5 (Catastrophic) — Contact with a live high-voltage cable during excavation could result in electrocution of the operator and potentially workers in the trench or on adjacent equipment.
- Inherent risk score: 4 x 5 = 20 (Extreme)
Extreme inherent risk. A score of 20 means the task cannot proceed as planned. The work method must be redesigned with additional controls before work can commence. This is exactly what the matrix is designed to identify.
Control measures applied:
- Isolation: Contact network operator to de-energise and isolate the cable for the duration of excavation work. Obtain written confirmation of isolation before work begins.
- Engineering: Engage a qualified cable locator to mark the exact position of all underground services using ground-penetrating radar and electromagnetic locator (to AS 5488). Mark positions with paint and pegs at 2-metre intervals.
- Substitution: Hand dig within 1 metre of any marked service — no mechanical excavation within the caution zone. Use non-conductive hand tools (fibreglass-handled spades).
- Administrative: Operator must hold current Excavation in the Vicinity of Underground Services competency. Spotter assigned during all mechanical excavation. Daily toolbox talk reviewing service locations.
- PPE: Electrical-rated insulating gloves and boots (Class 0 minimum per AS/NZS 2225) when hand digging near marked cable locations.
Residual risk assessment (after controls):
- Likelihood: 1 (Rare) — Cable is de-energised and isolated. Location is precisely marked. Hand digging within caution zone eliminates mechanical strike. Multiple layers of verification.
- Consequence: 2 (Minor) — With cable de-energised, a strike would damage the cable but not electrocute the worker. Consequence drops significantly because the energy source is isolated.
- Residual risk score: 1 x 2 = 2 (Low)
Risk reduced from 20 (Extreme) to 2 (Low). The isolation control (de-energising the cable) is the critical factor — it reduces both likelihood and consequence. This demonstrates why higher-order controls in the hierarchy are so important for high-consequence hazards.
When to Stop Work
The risk matrix is not just an assessment tool — it is a decision-making framework. Certain risk ratings require specific actions:
Extreme Residual Risk (20–25): Absolute Stop
If any hazard in a SWMS has a residual risk rating of Extreme after all identified controls are applied, the task must not proceed. No supervisor, project manager, or client can authorise work with Extreme residual risk. The task must be:
- Redesigned to change the work method
- Supplemented with additional higher-order controls
- Postponed until conditions change (e.g., weather, isolation available)
- Cancelled entirely if no safe method can be found
This is not a negotiable position. Under HSWA 2015 section 36(2), a PCBU must ensure, so far as is reasonably practicable, that the health and safety of other persons is not put at risk. Proceeding with Extreme risk violates this duty.
High Residual Risk (10–16): Conditional Proceed
High residual risk is acceptable only with documented management approval and continuous monitoring. It should trigger a review of whether additional controls are available. If the inherent risk was Extreme and controls reduced it to High, the SWMS should document why further reduction is not reasonably practicable.
Site Conditions Change
Risk ratings are based on the conditions at the time of assessment. If conditions change — unexpected weather, additional services discovered during excavation, equipment failure, personnel changes — the SWMS must be reviewed and risk ratings reassessed. What was Medium risk in dry conditions may become High risk in rain.
Common Assessment Errors
1. Underrating Consequence to Avoid High Scores
Some assessors rate the consequence of a fall from height as “Moderate (3)” to keep the overall score in the Medium range. This is dishonest assessment. A fall from 6 metres can kill or permanently disable — that is Major (4) or Catastrophic (5), regardless of how inconvenient a High risk rating is for the project.
2. Rating Residual Risk Too Low
After listing controls, some assessors drop both likelihood and consequence to 1, producing a residual score of 1 (Low). This is rarely realistic. Controls reduce risk; they do not eliminate it. If a fall from height has a consequence of Major (4) inherently, the consequence remains Major (4) residually — controls do not change the laws of physics.
3. No Justification for Ratings
Writing “Likelihood: 2, Consequence: 3” without explaining why is not a valid assessment. The rating should be justified in context: “Likelihood 2 (Unlikely) because guardrails prevent edge approach and workers are certified in fall prevention. Consequence remains 4 (Major) because the fall height of 7 metres has not changed.”
4. Identical Ratings for All Hazards
If every hazard in your SWMS has the same inherent and residual risk rating, the assessment has not been done properly. Different hazards have different likelihoods and consequences. Slipping on a wet surface is not the same risk as contact with overhead power lines.
For guidance on writing the complete SWMS document that contains these risk assessments, see our SWMS writing guide.
Auto-Calculate Risk Ratings in Your SWMS
SafeMethod AI automatically rates inherent and residual risk for every hazard using the 5x5 matrix. Risk scores are calculated, colour-coded, and validated — no Extreme residual risk is ever accepted. You can adjust any rating and the scores recalculate instantly.
Generate Your First SWMS FreeNo credit card required. 3 free SWMS per month.