SWMS risk matrix: the 5x5 likelihood and consequence table
A 5x5 risk matrix rates each hazard by likelihood (1 to 5) and consequence (1 to 5) and multiplies them into a score from 1 to 25. It helps you rank risks before and after controls, but the WHS Regulations do not require one in a SWMS.
Does a SWMS need a risk matrix?
No. Regulation 299 lists what a SWMS must contain: the HRCW, the hazards and risks, the control measures, and how the controls are implemented, monitored and reviewed. A risk score is not on the list.
WorkSafe Victoria goes further. In its SWMS guidance it lists risk matrices and risk scores under things that may not be included, and says they are not legally required. WorkSafe WA says that if a SWMS is based on a workplace risk assessment, evidence of that assessment may be needed for the regulator or an audit, but it does not need to be detailed in the SWMS.
So why do so many SWMS have one? Because many principal contractors ask for a before and after rating, and because a matrix is a quick way to show that the controls actually reduce the risk. If your principal contractor wants one, include it and print the key. If you work in Victoria, check whether the site wants ratings at all.
When a risk assessment is needed
The model Code of Practice on managing WHS risks (WorkSafe WA version) says a risk assessment should be done when there is uncertainty about how a hazard may cause harm, when several hazards interact, or when changes may affect the controls. It is mandatory for some high risk activities, for example confined space entry, diving work and live electrical work.
It is not required when a law says how a hazard must be controlled, and a detailed one may not be needed when a code of practice or well-known industry controls already fit your situation. In those cases you can go straight to the controls.
Likelihood descriptors
Likelihood is how likely it is that someone will be harmed. The Code suggests thinking about how often the task is done, how often people are near the hazard, and whether it has happened before. These five levels follow the wording in the Code.
| Score | Likelihood | What it means |
|---|---|---|
| 5 | Almost certain | Expected to happen in most circumstances |
| 4 | Likely | Will probably happen in most circumstances |
| 3 | Possible | Might happen occasionally |
| 2 | Unlikely | Could happen at some time |
| 1 | Rare | May happen only in exceptional circumstances |
Consequence descriptors
Consequence is how bad the harm could realistically be. The Code asks you to think about the type of harm, what affects its severity (such as the height of a fall), how many people could be hurt, and whether one failure could lead to others. The descriptors below are a common way to set the five levels; no regulation fixes them, so you can adjust the wording to suit your business.
| Score | Consequence | Example of harm |
|---|---|---|
| 5 | Catastrophic | Death, or permanent disabling injury or illness |
| 4 | Major | Serious injury needing hospital treatment, such as fractures |
| 3 | Moderate | Injury needing medical treatment and time off work |
| 2 | Minor | First aid treatment, back at work the same day |
| 1 | Insignificant | No injury, or a near miss |
The 5x5 matrix
Multiply the likelihood score by the consequence score. A score of 1 to 4 is Low, 5 to 9 is Medium, 10 to 14 is High, and 15 to 25 is Extreme. These bands are a common convention, not a legal standard; whatever bands you use, keep them the same across all your documents.
| Likelihood | Insignificant (1) | Minor (2) | Moderate (3) | Major (4) | Catastrophic (5) |
|---|---|---|---|---|---|
| Almost certain (5) | 5 Medium | 10 High | 15 Extreme | 20 Extreme | 25 Extreme |
| Likely (4) | 4 Low | 8 Medium | 12 High | 16 Extreme | 20 Extreme |
| Possible (3) | 3 Low | 6 Medium | 9 Medium | 12 High | 15 Extreme |
| Unlikely (2) | 2 Low | 4 Low | 6 Medium | 8 Medium | 10 High |
| Rare (1) | 1 Low | 2 Low | 3 Low | 4 Low | 5 Medium |
What each band means on site
The law does not let a score decide whether you control a risk. The duty is to eliminate risks so far as is reasonably practicable and, if that is not possible, minimise them using the hierarchy of control (r.36). Use the bands to decide how urgent the action is and who needs to sign off, not whether to act.
- Extreme (15 to 25): do not start, or stop now. Change the method or add higher order controls until the score drops.
- High (10 to 14): only start with senior sign-off and controls from the top of the hierarchy in place and checked.
- Medium (5 to 9): proceed with the controls in place, supervised and checked at each pre-start.
- Low (1 to 4): proceed with normal controls and keep an eye on changes.
Worked example: roof tile replacement
A roofer is replacing cracked tiles on a two storey house with the eaves 6 m above a concrete driveway.
| Hazard | Before controls | Controls | After controls |
|---|---|---|---|
| Fall from the roof edge | Likely (4) x Catastrophic (5) = 20 Extreme | Scaffold edge protection along the full eaves; harness to a ridge anchor outside the protected area; rescue plan | Rare (1) x Catastrophic (5) = 5 Medium |
| Foot through a brittle tile | Possible (3) x Major (4) = 12 High | Walk on tile laps only; plan a route from the access point; cover the skylight | Unlikely (2) x Major (4) = 8 Medium |
| Tile falling on someone below | Possible (3) x Major (4) = 12 High | Barricade the driveway; lower tiles in a bucket; never throw them | Rare (1) x Major (4) = 4 Low |
| Silica dust from cutting | Likely (4) x Major (4) = 16 Extreme | Water suppression or on-tool extraction; cut outdoors; P2 respirator | Unlikely (2) x Major (4) = 8 Medium |
Common mistakes with risk ratings
Ratings are easy to get wrong, and reviewers notice.
- Lowering the consequence after controls. Edge protection makes a fall less likely; a fall from 6 m is still catastrophic if it happens.
- Giving a Low score to a control that relies only on PPE or a procedure.
- Using different bands or colours in different documents.
- Treating the score as the answer. A Medium risk still needs every reasonably practicable control.
- Leaving out the key, so a reviewer cannot tell what a 12 means.