Risk Matrix Template: A 5×5 Matrix With Consequence Criteria You Can Defend

Most risk matrix templates you can download are a coloured grid and nothing else. Five rows, five columns, green through red, and not one word about what the words mean.

That is the part that matters. A grid is trivial to draw. The hard part, and the part an auditor asks about, is what separates a level 3 consequence from a level 4, and who decided. Without that written down, two people assessing the same hazard will score it differently, and neither of them will be wrong, because there is nothing to be wrong against.

The template below includes the grid. It also includes the four things that make the grid mean something: a consequence scale per discipline, a likelihood scale with a stated probability basis, the control hierarchy, and a rule about who may accept what.

It is a spreadsheet, it is free, and there is nothing to fill in to get it.

What is in the file

Six sheets.

Every cell you are meant to replace is shaded pale yellow and written in italics. Those are the cells only you can answer. The samples are there to show the calibration, not to be adopted.

Why 5×5, and why the cells are ranked 1 to 25

A 5×5 matrix gives enough separation to be useful without inviting false precision. A 3×3 collapses too much, with everything landing in the middle band, and anything larger implies a resolution the underlying judgement does not have.

The more important choice is what is written in each cell. This template ranks all 25 cells from 1 to 25 rather than multiplying likelihood by consequence.

Multiplication produces ties between events that are not equivalent. A rare catastrophe and a frequent nuisance can reach the same product and need completely different responses. Ranking forces the order to be decided deliberately, and it lets a register be sorted into a genuine priority list rather than four coloured piles.

You can see it in the template. Cell 15 and cell 11 are both rated Medium, and 15 outranks 11: a rare catastrophe is treated as more pressing than a frequent nuisance. That ordering is a decision, and it is yours to change.

If you want the longer argument for why the criteria behind the grid matter more than the grid, we made it in your risk matrix has numbers, who decided what they mean.

Is there an Australian standard risk matrix?

No, and this is worth being clear about because a lot of people go looking for one.

AS ISO 31000:2018, the Australian adoption of ISO 31000, is titled Risk management: Guidelines. Guidelines, not requirements. It sets out principles, a framework and a process, and it deliberately does not prescribe a matrix, a scale, or a set of scores. It cannot, because a matrix only works when it is calibrated to one organisation’s context. The older AS/NZS 4360 has been superseded and should not be cited as current. We cover the standard itself in ISO 31000 risk management explained.

So there is no official Australian matrix to copy. What there is instead is a requirement, in every management system standard, that you define your own criteria and apply them consistently:

• ISO/IEC 27001 clause 6.1.2 requires risk criteria, including risk acceptance criteria.
• ISO 45001 clause 6.1.2.2 covers assessment of OH&S risks.
• ISO 14001 clause 6.1.2 covers significance criteria.
• ISO/IEC 42001 clauses 6.1.2 and 6.1.4 cover AI risk assessment and the AI system impact assessment.
• ISO 9001 clause 6.1 prescribes no method at all, which is why the quality column is usually the weakest one on the page.

The template is built to satisfy the first four and to give the fifth something to work with.

Which hierarchy of controls, and why it matters which

This trips people up, because Australia has two versions in circulation and the poster on most site sheds matches neither.

The template uses the five items in ISO 45001 clause 8.1.2: eliminate, substitute, engineering controls and reorganisation of work, administrative controls including training, and adequate personal protective equipment. That is the agreed international expression and it is what a certification auditor reads.

Model WHS Regulation 36 carves it up differently. Eliminate, then minimise by substitution, isolation or engineering controls, used singly or in combination and not ranked against each other, then administrative controls, then PPE. Isolation is named there and is not named in the standard, where it sits inside item 3.

Same intent, different grouping. Use the standard’s five if you are certified, keep the regulation in mind as the duty a court applies, and state in your documents which one you are using. Inconsistency between the two is a finding waiting to happen.

One detail that is easy to miss and changes how people write controls: reorganisation of work sits at item 3, with engineering controls, not down at item 4. Changing when or how work is done ranks above writing a procedure about it.

The template tags each item with what it usually moves.

If you want the practical companion to this, the energy wheel and the hierarchy of controls covers identifying the hazard before you control it.

A worked example, end to end

Abstract matrices are easy to agree with. Here is one run through properly.

The hazard. Forklifts operating in the same warehouse aisles as order pickers on foot.

Step 1: score it before controls

Likelihood: L4 Likely. Under the template’s stated basis, per person per year of exposure to the task, roughly 1 in 100. There have been near misses here, and the industry incident history is extensive.

Consequence: C4 Major. Under the injury column, a lost time injury of several days or more. A pedestrian struck by a forklift is not a first aid case.

L4 against C4 is cell 21: Extreme.

Step 2: read the action required

At rank 20 to 25 the template says: work does not commence. Additional controls are required. Nobody may accept it.

That is the point of writing the action table. Extreme is not a colour, it is a stop.

Step 3: apply the hierarchy from the top

• Eliminate. Can the pedestrian and the forklift be separated entirely, by moving picking to a different shift or a different area? If yes, that is item 1 and it is the answer.
• Substitute. Different plant, a pallet jack instead of a counterbalance forklift in that aisle.
• Engineering and reorganisation. Physical barriers, a dedicated walkway, separated entry points, and re-sequencing picking so it does not run while forklifts do.
• Administrative. Traffic management plan, training, exclusion zone procedures.
• PPE. High visibility clothing.

Note the order this produces in practice. High visibility clothing is item 5 and moves almost nothing. It makes the pedestrian easier to see. It does nothing about the mass and momentum arriving.

Step 4: rescore with the controls in place

Say you implement physical separation and re-sequenced picking, so pedestrians and forklifts share the aisle only during a controlled exception.

Likelihood drops to L2 Unlikely. Engineering controls and reorganisation move likelihood, which is exactly what the hierarchy sheet predicts.

Consequence stays at C4 Major. Nothing about the control reduces the harm if the interaction happens anyway. This is the part people get wrong: they drop both axes because they feel better about the risk.

L2 against C4 is cell 14: Medium. Acceptance sits with the Operations Manager, in writing.

Step 5: check it against the target

The template’s stated target is residual risk reduced to Low. Medium is not Low.

To reach Low you would need L1 Rare against C4, which is cell 8, and that means complete separation with no shared-aisle exception at all. If that is not reasonably practicable, the template requires you to record the reason and have the acceptance signed at the named authority level. That record is the thing a regulator or an auditor asks for, and it is almost always the thing that does not exist.

How to fill it in, in order

1. Set the likelihood basis first. One basis for the whole workbook, written in the yellow cell. Per person per year of exposure is the supplied sample. Two assessors working to different bases produce different scores from identical facts and never work out why.
2. Set the financial bands. Against your own turnover and balance sheet, not ours. Then read across: a fatality and your C5 dollar figure should feel like the same weight of bad day. If they do not, one of the two columns is wrong.
3. Calibrate the remaining consequence columns against each other. A level 4 should mean the same weight of bad day whichever column it sits in.
4. Name the acceptance authorities. Real job titles. Make them independent, because an acceptance signed by the person carrying the schedule pressure is a formality rather than a decision.
5. Decide whether you accept the 1 to 25 ranking. It is a set of decisions, not arithmetic. Change any cell you disagree with, and write down why.

Do not use the same adjective at three levels. If C3, C4 and C5 all say “major”, two assessors will split them differently every time.

A fifteen minute test that produces a real finding

Take three closed risks from your register. Hand them to two people separately and ask each to score likelihood and consequence from your criteria, without conferring.

If the scores differ, the problem is the criteria rather than the people, and that is your finding. It is also the fastest way to demonstrate to a management review that the register is not as solid as the colours suggest.

What a risk matrix cannot do

Worth saying, because the tool gets asked to carry more than it can.

• It does not make a judgement objective. It makes a judgement consistent and reviewable, which is different and more useful.
• It does not replace the reasonably practicable test. Australian WHS law asks what was reasonably able to be done, weighing likelihood, harm, knowledge, availability of controls and cost in that order. A matrix informs that, it does not answer it. The duty itself sits with the PCBU.
• It does not work across organisations. Two businesses using the same grid with different criteria will produce different numbers, which is why a contractor’s score and yours are not comparable without checking the criteria behind them.
• It does not handle a risk nobody identified. The matrix is the second half of the job. The first half is finding the hazard.

Frequently asked questions

Is there a standard Australian risk matrix I should use?

No. AS ISO 31000:2018 is guidelines, not requirements, and deliberately prescribes no matrix. AS/NZS 4360 is superseded. Every management system standard asks you to define your own criteria instead.

Should I multiply likelihood by consequence?

We would not. Multiplying produces ties between events that need different responses. This template ranks all 25 cells so a register can be sorted into a real priority order.

Is a 5×5 better than a 3×3?

For most businesses, yes. A 3×3 collapses too much into the middle band. Larger than 5×5 implies a precision the underlying judgement does not have.

What risk score is acceptable?

That is not a question a matrix can answer. It is a question your business answers in advance and writes into the action table. The template’s supplied target is residual risk reduced to Low, with anything higher requiring a recorded reason and a named signature.

Can I use this for information security or AI risk, not just safety?

Yes. The consequence sheet carries a column per discipline, including information security and AI and automated decisions. Keeping one set of criteria across every standard you run is the point. Separate matrices that disagree get found by opening two documents.

Does using this template make us compliant?

No. It gives you a defensible structure and a record of the decisions behind it. The duty comes from the law and the requirements come from the standard, and both are tested against what you did.

Do I have to give you my email to download it?

No. There is no form.

The conversation behind the criteria

A matrix is only as good as the conversation that set its criteria, and that conversation is usually the one that never gets scheduled.

Streamline builds risk frameworks that hold up when an auditor opens two documents and compares them. If you want an independent read on whether your criteria would survive that, get in touch.