How to Use a Risk Matrix in Australian Workplaces: A Step-by-Step Guide

A risk matrix is the tool that makes that process consistent, auditable, and defensible under Australian WHS law. It is a grid that scores workplace hazards by multiplying their probability of occurring by the severity of their potential harm. The resulting score places each hazard in one of four action bands: Acceptable, Adequate, Tolerable, or Unacceptable.

This guide covers how a risk matrix works, how to read and complete one correctly under Australian WHS requirements, and what a free template needs to include to be useful in the field.

Key Takeaways

• A risk matrix calculates risk by multiplying probability by impact across a given scale, producing scores that guide control decisions.
• Australian WHS law requires businesses to assess and manage risks as far as reasonably practicable; a risk matrix is the standard tool for documenting that process.
• Vehicle incidents (42% of fatalities in 2023) and falls from height (up 71% between 2022 and 2023) are among the highest-priority hazards across Australian industries.
• A 5×5 matrix produces 25 possible risk scores, giving safety teams more precision than 3×3 or 4×4 versions.
• A paper matrix has limits; digital risk registers allow real-time updates, audit trails, and field access across multiple sites.

What Is a Risk Matrix and Why Does Australian Law Require One?

Australian workplaces recorded 146,700 serious workers’ compensation claims in 2023-24, more than 400 serious claims every working day, according to Safe Work Australia’s Key Work Health and Safety Statistics 2025. Most of those claims involved a hazard that could have been scored, prioritised, and controlled before anyone got hurt.

A risk matrix is a visual grid that scores workplace hazards by multiplying probability by severity. The result places each hazard in an action band: Acceptable, Adequate, Tolerable, or Unacceptable. Safety teams use the score to decide whether to act immediately, plan controls, or monitor the hazard.

Under the Work Health and Safety Act 2011 (WHS Act), every business must manage risks so far as reasonably practicable. A risk matrix is the accepted method for documenting that assessment.

Safe Work Australia sets out a four-step process: identify hazards, assess risks, control risks, and review. Risk assessment (the second step) requires you to consider both how likely a hazard is to cause harm and how severe that harm would be. A risk matrix makes that judgement consistent and auditable.

How the 5×5 Matrix Compares to 3×3 and 4×4 Versions

A 3×3 matrix produces nine possible risk scores. A 4×4 produces 16 and a 5×5 produces 25. More granularity means finer distinctions between risk levels, which matters when you are prioritising controls across a long hazard register.

For industries with complex or high-frequency hazards such as construction, transport, manufacturing, and field services, the 5×5 format is the standard choice. Simpler 3×3 versions may suit lower-risk administrative environments.

How to Read a Risk Matrix: The Two Axes Explained

A 5×5 risk matrix has two axes: probability along the horizontal and impact along the vertical. Each axis uses a 1–5 scale, with one representing the lowest level and five the highest. Every cell in the grid is the product of its two axis values.

Probability (Likelihood)

Probability refers to how likely the hazard is to cause harm.

Impact (Severity)

Impact refers to how serious the harm would be if the hazard were realised.

Colour Coding

The completed grid uses standard colour bands:

• Green (1–4) — Acceptable: existing controls are adequate; monitor and maintain.
• Amber (5–9) — Adequate: review controls and consider improvements; no immediate action required.
• Orange (10–16) — Tolerable: controls must be reviewed and improved within a set timeframe; do not defer.
• Red (17–25) — Unacceptable: cease the activity immediately; do not resume until adequate controls are in place.

How to Calculate Your Risk Score

The formula is: Probability score multiplied by Impact score equals the Risk Score.

Worked example: A delivery driver works a late shift on a wet road with a loaded heavy vehicle. The team assesses the probability of a vehicle incident as 4 (Likely, given exposure frequency) and the impact as 4 (Major, given vehicle mass and road speed). 

Risk Score = 4 x 4 = 16. This falls in the Tolerable band and must be reviewed with additional controls, such as fatigue management, route planning, or load scheduling, before work continues.

How to Use a Risk Matrix Step by Step

Step 1: Define the Task or Activity

Name the specific task, not a broad category. “Working at height” is too vague. “Installing roof sheeting on a residential project at six metres above ground level” is specific enough to identify the right hazards and assign accurate scores. Include the location, date range, and who is exposed.

Step 2: Identify the Hazards

List every hazard associated with the task. Use physical site inspection, historical incident reports, consultation with the workers who will do the job, and any relevant manufacturer data sheets or safe work method statements. Safe Work Australia’s guidance on identifying and assessing hazards notes that workers must be consulted at each step of the risk management process, because they identify hazards that supervisors cannot observe from a distance.

Step 3: Assign Probability and Impact Scores

Score each hazard without assuming controls that are not yet installed. If a fall arrest system is not in place at the time of assessment, score the hazard without it. Scoring with controls assumed understates the risk, produces an artificially low score, and defeats the purpose of the assessment.

Step 4: Determine the Risk Level and Required Action

Multiply the scores. Place the result in the correct band. For any score of 10 or above, document the specific control measures you will apply, who is responsible, and by what date. For scores of 17 and above, work must not proceed until controls are in place.

Step 5: Record, Review, and Update

Enter the completed assessment into your risk register with a review date and a named responsible person. Reassess after any incident or near miss, after any change to the task, environment, or workforce, and at the scheduled review date.

Risk Matrix Examples Across Australian Industries

Knowing how to score a hazard in theory is one thing. Applying it to the conditions your team faces is another. The worked examples below use real hazard categories drawn from Safe Work Australia’s national fatality data.

Construction: Falls from Height

A commercial construction crew is scheduled to install formwork on the second floor of a new building. The hazard is a fall from the open edge at four metres.

Probability: 4 (Likely, as workers are regularly at the edge without barriers). Impact: 5 (Severe, as a four-metre fall can be fatal). Risk Score: 20. This is Unacceptable. Work must not proceed until edge protection is installed and a safe work method statement is in place.

Falls from height increased 71% between 2022 and 2023 in Australia, rising from 17 to 29 fatalities. Safety officers managing Quality, Health, Safety and Environment (QHSE) for construction operations are under particular pressure to document these assessments before work begins.

Transport and Logistics: Vehicle Incidents

A logistics operator runs a night shift with fatigue-affected drivers carrying oversize loads on regional routes. Under the Heavy Vehicle National Law (HVNL), operators have Chain of Responsibility (CoR) obligations that extend to schedulers, loaders, and consignors, not just drivers. Risk matrix assessment: Probability 4, Impact 5, Score 20. Controls required include fatigue management plans, route risk assessments, and Electronic Work Diary (EWD) compliance checks before departure.

CoR obligations mean that a poor risk assessment is not only a safety failure, but a legal exposure for the entire supply chain.

Manufacturing: Body Stressing and Plant Contact

A production team operates a press machine with a manual feed process. The hazard is hand and finger contact with the press mechanism. Probability: 3 (Possible, as guards are in place but frequently bypassed). Impact: 4 (Major, crush injuries typical). Risk Score: 12. This is Tolerable but must be reviewed. Engineering controls, specifically interlocked guarding, should replace the administrative reliance on worker behaviour.

Safety officers overseeing QHSE for manufacturing sites typically carry multiple active assessments like this, which is where a digital register becomes necessary.

Field Services: Lone Worker and Electrical Exposure

A field technician is tasked with inspecting a rooftop solar installation at a commercial property, working alone. Two hazards apply: working at height (Probability 3, Impact 4, Score 12) and unverified electrical isolation (Probability 2, Impact 5, Score 10). Both fall in the Tolerable band and require controls.

For lone workers, controls must address both the physical hazard and the absence of immediate assistance if an incident occurs. QHSE for field services operations require check-in protocols, work permits, and confirmation that isolation has been verified and documented before work begins.

What Does a Free Risk Matrix Template Need to Include?

A compliant Australian risk matrix template captures eight elements for every identified hazard. Missing any one of them leaves the assessment incomplete and the documentation insufficient for a WHS inspection or post-incident investigation.

1. Task or Activity Description — specific enough to identify the hazards unique to this task.
2. Hazard Identified — named clearly, not as a general category.
3. Who Is Exposed — workers, contractors, visitors, or the public.
4. Probability Score (1–5) — with the level label (Rare through Almost Certain).
5. Impact Score (1–5) — with the severity label (Insignificant through Severe).
6. Risk Score (P x I) — and the risk band (Acceptable, Adequate, Tolerable, or Unacceptable).
7. Control Measures — listed in hierarchy order: elimination first, PPE last.
8. Review Date and Responsible Person — a named individual, not a team or role title.

Most teams start with a spreadsheet template and find it works for simple, single-site operations. The problem comes with scale. When the same hazard exists across ten sites with different control measures in place, reviewing each spreadsheet manually is time-consuming and error-prone. Version control becomes a genuine compliance risk.

When Does a Paper Matrix Create a Compliance Risk?

A paper or spreadsheet risk matrix has no version control, no audit trail, and no field access. When a control measure is updated on one copy, every other copy becomes inaccurate. During a WHS inspection or post-incident investigation, that inconsistency is difficult to defend.

ISO 45001:2018 is the international standard for occupational health and safety management systems. It requires organisations to maintain documented information on risks and opportunities as part of their risk-based thinking approach. A spreadsheet cannot confirm when it was last updated, by whom, or whether every site is working from the same version. It does not meet that requirement.

Operations teams managing risk across multiple sites or crews need a risk management module, not a static file. The module must keep every assessment current, accessible from the field, and linked to corrective action workflows. Kynection connects risk assessments to incident reports, inspection schedules, and contractor records. A change in site conditions updates the risk register in real time.

For teams under HVNL or ISO 45001 obligations, that live connection between field activity and the risk register matters. It separates a system that holds up under audit from one that does not.

Build a Risk Register That Holds Up Under Scrutiny

A risk matrix is a starting point, not a filing exercise. The value is in how it drives decisions: which tasks get re-assessed, which controls get upgraded, and which workers get better information before they start. Australian WHS law measures compliance by whether risks were managed to a reasonably practicable standard, and a documented, reviewed, and acted-upon risk register is the clearest evidence that standard was met.

For teams ready to move beyond spreadsheets and paper forms, Kynection’s One System connects risk assessment, incident management, and compliance documentation across every site and every crew. Book a demo to see how the risk register works in practice.

Frequently Asked Questions

Is a risk matrix legally required under Australian WHS law? 

The WHS Act 2011 does not mandate a specific tool, but it requires duty holders to manage risks as far as reasonably practicable. The Safe Work Australia Model Code of Practice on Managing WHS Risks (November 2024) details a four-step risk management process that includes assessing risks. Using a risk matrix is the accepted method for documenting that assessment and demonstrating compliance during an inspection or investigation.

What is the difference between a risk matrix and a risk register? 

A risk matrix is the scoring tool that assigns probability and impact values to individual hazards. A risk register is the document or system that records all identified hazards, their scores, the controls in place, and the review schedule. The matrix feeds the register; the register is the living record that WHS regulators and auditors review.

How often does a risk matrix assessment need to be reviewed? 

The Safe Work Australia Model Code of Practice recommends reviewing risk controls whenever work activities change, after any incident or near miss, and at a scheduled interval appropriate to the hazard level. High-risk activities scoring 10 and above should be reviewed more frequently than low-risk tasks. Every assessment should carry a review date and a named responsible person.

Can the same risk matrix template be used for different industries? 

The matrix structure (probability axis, impact axis, and scoring formula) is consistent across industries. The hazards, scores, and control measures must reflect the specific conditions of each workplace. A construction site template applied without modification to a transport depot will produce inaccurate scores and miss industry-specific hazards such as fatigue, load restraint, and HVNL obligations.

What happens if a hazard scores in the Unacceptable band? 

A score of 17–25 means the risk is unacceptable and the activity must cease until adequate controls are in place. The WHS Act and the Safe Work Australia Model Code of Practice are clear that reasonably practicable action is required. Documenting the score and continuing the activity without control escalation would not meet that obligation. Seek qualified advice from your WHS regulator or legal counsel for your specific circumstances.