Workplace Risk Assessment: The Risk Matrix and the Hierarchy of Controls

Why isn’t a risk assessment form on file enough?

Many sites have a written, approved risk assessment, but it was written years ago for work that has since changed, or copied from another site. A real risk assessment is a decision tool: what could hurt people here? What will we do about it? Who will do it, and by when?

The International Labour Organization summarises the process in five simple steps, suitable even for small and medium-sized enterprises. ^[3]

Step one: identify hazards as they really are

Start with a walk around the site and watch how the work is actually done, not how the procedure says it is done. The UK Health and Safety Executive (HSE) recommends checking accident and ill-health records to reveal less obvious hazards, and including non-routine work such as maintenance and cleaning, as well as health hazards such as manual handling and work-related stress. ^[1]

Then decide who might be harmed and how: workers, contractors, visitors and members of the public. Some groups need particular attention, such as new and young workers, new or expectant mothers and people with disabilities. ^[1] Involve workers in this step; they are often the first to notice a hazard. ^[1]

Step two: estimate the risk with a likelihood and severity matrix

Once the hazard is identified, estimate the risk: how likely is harm, and how serious would it be? ^[1] Many organisations use a matrix that multiplies a likelihood score (for example from 1, rare, to 5, almost certain) by a severity score (from 1, minor injury, to 5, death or permanent disability), giving a score from 1 to 25 that is rated low, medium or high.

The matrix helps set priorities and gives teams a common language, but it has limits:

• It is not precise measurement: the score is a judgement, and two people may give the same hazard different scores.
• It can hide rare, high-consequence hazards: a hazard with likelihood 1 and severity 5 scores only 5, even though the outcome could be a death.
• A post-control score needs evidence: lowering the score on paper without actually applying the control gives a false sense of safety.

So record what each score is based on, and treat any hazard with maximum severity as a priority even if its likelihood seems low.

Step three: choose controls using the hierarchy of controls

The US National Institute for Occupational Safety and Health (NIOSH) sets a preferred order of controls. Elimination comes first because it prevents exposure entirely, then substitution with a less hazardous alternative, provided it does not create new risks, then engineering controls such as guards and ventilation, then administrative controls such as training, job rotation and restricted access, and finally personal protective equipment. ^[2]

The reason is that higher controls work without depending much on human behaviour, while administrative controls and PPE are effective only if workers use them correctly and consistently. ^[2] NIOSH notes that elimination and substitution are simplest and cheapest at the design stage, and that engineering controls may cost more at first but usually have lower long-term operating costs. ^[2]

HSE notes that you do not have to eliminate every risk, but you must do what is “reasonably practicable”, balancing the risk against cost, time and effort. ^[1]

Steps four and five: assign owners, record and review

Every control action needs an owner and a deadline, or recommendations stay on paper. ^[3] Record the findings: the hazards, who might be harmed and how, and the controls in place. HSE stresses that paperwork should not replace actually controlling the risks. ^[1]

Review the assessment when staff, processes, substances or equipment change, after any accident or near miss, and when you suspect controls have stopped working. ^[1]

A hypothetical example: a distribution warehouse

A warehouse uses forklifts that travel the same aisles as pedestrians. The site walk shows that workers take shortcuts between racks, and the incident log records three near misses in two months.

The team rates the likelihood of a collision at 3 and the severity at 5, giving a score of 15: a high risk. Instead of simply circulating a notice asking people to “be careful”, the team separates pedestrian walkways from forklift routes with fixed barriers (an engineering control), adds mirrors at intersections and a speed limit (engineering and administrative controls), and keeps high-visibility vests as the final layer. It then assigns an owner and deadline to each action and reviews the near-miss log after a month. The figures are hypothetical, to illustrate the method.

Common mistakes in risk assessment

• Copying an assessment from another site without visiting the real one.
• Jumping to PPE as the first solution.
• Ignoring non-routine work such as maintenance, cleaning and night shifts.
• Lowering the risk score before the control is actually in place.
• Not involving workers, or not telling them the results.

Conclusion

Start from the site, not the form; use the matrix to set priorities, not to hide severe hazards; choose controls as high up the hierarchy as possible; give every action an owner and a date; and review the assessment whenever the work changes.