To make it easy to determine a consistent risk rating for each hazard, it’s useful to have a tool that combines the likelihood of an accident or incident occurring with the potential consequences. This allows for easy identification of the highest risks in the business and the appropriate resources can be allocated.
Risk matrix and definitions example
An example risk matrix and definitions have been provided below:
Likelihood |
Impact / Consequence
|
|
1 Negligible
|
2 Minor
|
3 Moderate
|
4 Major
|
5 Catastrophic
|
|
5 Almost certain
|
5
|
10
|
15
|
20
|
25
|
|
4 Likely
|
4
|
8
|
12
|
16
|
20
|
|
3 Possible
|
3
|
6
|
9
|
12
|
15
|
|
2 Unlikely
|
2
|
4
|
6
|
8
|
10
|
|
1 Rare
|
1
|
2
|
3
|
4
|
5
|
|
Extreme risk
(20-25)
|
The process, task or activity in question must not occur or must cease until actions are taken to eliminate the hazard or minimise the risk.
CE/Board oversees specific review of effectiveness of new or additional controls before process, task or activity can commence or recommence.
|
|
Very high risk
(15-16)
|
Actions are to be taken to eliminate the hazard or minimise the risk.
The relevant Executive Manager oversees action plans and receives reports on progress. Specific consideration of control effectiveness and new or additional control options to be considered.
|
|
High risk
(10-12)
|
Actions are to be taken to eliminate the hazard or minimise the risk.
General Manager oversees action plans and receives reports on progress. Periodic consideration of control effectiveness and new or additional control options to be considered.
|
|
Moderate risk
(4-9)
|
Actions are to be taken to eliminate the hazard or minimise the risk.
Relevant Business Unit Manager oversees action plans and receives reports on progress. Periodic consideration of control effectiveness and new or additional control options to be considered.
|
|
Low risk
(1-4)
|
The process or activity in question continues with existing controls.
Ongoing monitoring of existing control effectiveness (within agreed business as usual (BAU) arrangements).
Continue to reduce the risk by adopting any improvements in safety the business becomes aware of.
|
All levels of an organisation should have awareness of the risks the organisation is exposed to, even ‘moderate’ and ‘low’ risks. The executive and governance bodies may not need to be involved in the active management of these risks, but should be aware of them – particularly regarding common themes between minor risks and the catastrophic events the organisation is exposed to, but is controlling with its safety systems.
Likelihood definitions
- Rare: May occur, but only in exceptional circumstances. It would be highly unexpected (ie not in the next 50 years)
- Unlikely: Could occur in some circumstances, but would be surprised if it happens (ie once in the next 11-50 years)
- Possible: Might occur in some circumstances (ie once in the next 2-10 years)
- Likely: Is expected to occur in most circumstances. Not surprised if it happens (ie at least annually and up to 10 times per year
- Almost certain: Is expected to occur and is almost inevitable (ie more than 10 times per year)
Impact/consequence definitions
- Negligible: Illness or injury that doesn’t require medical attention. No adverse effect on environment and regulator notification not required.
- Minor: Minor illness or injury requiring medical treatment (eg first aid) and/or minor effect on environment that can be cleaned up. Any potential damage remediation likely to cost less than $5,000. Regulator notification unlikely to be required.
- Moderate: Injury requiring admission to hospital and/or effect on environment that may take 1-2 months to restore and cost up to $20,000. Regulator notification mandatory.
- Major: Life threatening injury or multiple injuries requiring admission to hospital and/or significant effect on environment that may take up to a year to restore and cost up to $1,000,000. Regulator notification mandatory.
- Catastrophic: Death and/or catastrophic effect on environment that may take longer than a year to restore and cost more than $1,000,000. Regulator notification mandatory.
It’s important to remember that a single risk usually can result in a range of consequences, generally with less severe consequences being more common. To obtain one rating you generally consider the scenario that gives the highest number. However, you may choose to focus on the rating associated with the greatest consequence.
For instance, using the above matrix, a derailment of a rail vehicle:
- Possible likelihood (3) of moderate property damage (3) = 9
- Rare likelihood (1) of a fatality (5) = 5
Therefore it scores a 9 as the highest score and is classed as a ‘medium risk’.
