What is a risk assessment matrix?

A risk assessment matrix (RAM) is a visual tool that plots severity against likelihood to determine risk levels. It helps organizations prioritize hazards and allocate resources for risk mitigation in line with ISO 31000 and ISO 45001. The standards themselves do not prescribe a specific matrix — each organization defines its own risk criteria and scales.

How is risk score calculated?

Risk score = Severity × Likelihood. Severity ranges from 1 (negligible) to 5 (catastrophic). Likelihood ranges from 1 (rare) to 5 (almost certain). The resulting score (1–25) maps to risk levels: Low, Medium, High, or Critical.

What do the risk levels mean?

Low (1-3): acceptable risk, monitor only. Medium (4-6): tolerable with controls, review periodically. High (8-12): significant risk requiring mitigation plan and management attention. Critical (15-25): intolerable risk, immediate action required, stop work if necessary.

ISO 45001 is the international standard for occupational health and safety management systems. It requires organizations to identify hazards, assess risks, and implement controls using a systematic approach. The risk matrix is a common tool for this process.

What is the difference between ISO 31000 and ISO 45001?

ISO 31000 provides general risk management guidelines applicable to any type of risk (financial, operational, strategic). ISO 45001 specifically addresses occupational health and safety risks. Both use similar risk assessment methodologies including the risk matrix.

Free Engineering Tool

Risk Assessment Matrix

Interactive 5×5 example risk matrix aligned with ISO 45001 / ISO 31000 risk management principles — the standards themselves do not prescribe a specific matrix. Select severity and likelihood to calculate risk score, view color-coded risk levels and recommended actions.

ISO 45001ISO 310005×5 Matrix

Results

Risk Level

—

Risk Score (S × L)

—

Severity × Likelihood

—

Recommended Action

—

Interactive 5×5 Risk Matrix — click any cell to select

SVG Risk Matrix

Risk Score Formula

Severity Scale

Rating	Level	Description
1	Negligible	No injury, negligible financial loss (<€1k)
2	Minor	First aid injury, minor financial loss (€1–10k)
3	Moderate	Medical treatment, moderate loss (€10–100k)
4	Major	Serious injury/disability, major loss (€100k–1M)
5	Catastrophic	Fatality/multiple fatalities, catastrophic loss (>€1M)

Likelihood Scale

Rating	Level	Frequency
1	Rare	May occur in exceptional circumstances (<1 per 10 years)
2	Unlikely	Could occur but not expected (1 per 5-10 years)
3	Possible	Might occur at some time (1 per 1-5 years)
4	Likely	Will probably occur (1+ per year)
5	Almost Certain	Expected to occur in most circumstances (multiple per year)

Risk Level Thresholds

Score	Level	Action
1–3	Low	Acceptable. Monitor and review periodically.
4–6	Medium	Tolerable with controls. Review and improve when practical.
8–12	High	Significant risk. Mitigation plan required. Management attention.
15–25	Critical	Intolerable. Immediate action. Stop work if necessary.

ចំណាំ៖ ISO 45001 and ISO 31000 do not prescribe this specific 5×5 matrix, score thresholds, financial bands or frequency definitions — the scales above are a widely used industry example. Each organization must define its own risk criteria, consequence and likelihood scales, and tolerability thresholds appropriate to its context.