Risk Assessment Matrix: The 5×5 Risk Matrix for SWMS

A risk assessment matrix is a visual tool that helps you score the severity of hazards on a construction site. It works by combining two factors — how likely something is to happen (likelihood) and how bad it would be if it did (consequence). The result is a risk rating that tells you whether the hazard is acceptable, needs additional attention, or must be addressed before any work starts.

In Australian construction, the 5×5 matrix is the standard. Five levels of likelihood across one axis, five levels of consequence on the other, producing 25 possible risk scores from 1 (negligible) to 25 (extreme). The matrix is colour-coded: green for low risk, yellow for moderate, orange for high, and red for extreme. Every SWMS prepared under the WHS Regulation 2025 requires a risk assessment, and the 5×5 matrix is the most widely accepted format across all states and territories and across every major regulator.

If you have ever stared at a blank SWMS template wondering what number to put in the risk column, this page will sort you out. We will walk through every cell in the matrix, show you two full worked examples from real construction scenarios, and explain how modern SWMS builders auto-calculate the whole thing so you never have to guess again.

The risk matrix is not just a compliance exercise — it is the backbone of your safety planning. An inspector who sees a SWMS with no risk ratings, or with every hazard rated as Low regardless of its nature, will know immediately that the document was filled in without genuine thought. That is a prosecution trigger, and courts have repeatedly noted the absence of meaningful risk assessment as a factor in determining the severity of the breach.

The matrix has two axes. The horizontal axis measures likelihood — how probable is it that the hazard will cause harm? The vertical axis measures consequence — if the hazard does cause harm, how severe will it be?

Likelihood levels:

1 — Rare: Could happen but only in exceptional circumstances. Example: a meteorite strike on the work site, or a once-in-50-year structural failure of correctly engineered and maintained equipment.

2 — Unlikely: Could happen but not expected. Example: scaffold collapse on a scaffold that has been correctly erected, inspected, and tagged under AS/NZS 4994.1.

3 — Possible: Might happen at some point during the work. Example: a worker slips on a wet surface during rain, or a minor cable strike during excavation with service plans in hand.

4 — Likely: Will probably happen in most circumstances. Example: dust exposure during concrete cutting without water suppression; repetitive strain during long-duration manual handling without rotation.

5 — Almost Certain: Expected to happen regularly across normal working conditions. Example: musculoskeletal strain on a bricklaying job with no mechanical aids across a multi-week project; silica exposure during dry cutting of engineered stone before the 1 July 2024 ban.

Consequence levels:

1 — Insignificant: No injury or first aid only. Example: minor scratch, bruise, or soft-tissue discomfort requiring no medical attention.

2 — Minor: Medical treatment required, short-term impact, lost time of a day or less. Example: sprained ankle, minor laceration requiring stitches, mild chemical irritation.

3 — Moderate: Significant injury, temporary disability, lost time of days to weeks. Example: broken bone, moderate burns, hearing damage, serious strain or sprain.

4 — Major: Serious long-term injury, permanent disability, lost time of months to permanent. Example: amputation, spinal injury, severe crush injury, significant chemical exposure with lasting health effects.

5 — Catastrophic: Death or multiple fatalities, or injuries requiring life-long medical support. Example: fatal fall from height, structural collapse burying workers, electrocution, toxic release in confined space.

Multiply likelihood by consequence to get the risk score. Scores 1 to 4 are Low (green), 5 to 9 are Medium (yellow), 10 to 15 are High (orange), and 16 to 25 are Extreme (red). Any hazard scoring High or Extreme before controls must have effective controls that bring the residual risk down to Medium or Low before work proceeds. Some Medium residual ratings are acceptable with active monitoring; some are not, depending on the nature of the hazard and the reasonably practicable test.

Let's walk through a real-world scenario. You are an electrician upgrading a switchboard in a commercial building. The switchboard is energised at 415V three-phase and some circuits cannot be isolated because they supply essential services — fire systems, emergency lighting, refrigeration.

Hazard: Contact with live conductors during switchboard modification. Consequence: Electrocution, cardiac arrest, death — that is Catastrophic (5). Likelihood before controls: The work involves reaching into a partially energised switchboard with hand tools. One slip and you contact a live busbar. Without engineered controls in place, this is Likely (4).

Risk score before controls: 4 × 5 = 20 — Extreme (red). Work must not proceed until controls bring this down to an acceptable residual level.

Controls applied (in hierarchy order):

Isolate all circuits that can be isolated — reduces the scope of live exposure as far as practicable (engineering, partial elimination).

Arc-rated barriers around energised sections that cannot be isolated (engineering).

Lock-out/tag-out procedure per AS/NZS 4836 — each worker applies their own personal padlock to every isolation point (engineering).

RCD protection verified on all circuits before work begins, tested daily (engineering).

Permit-to-work system for any live testing — signed by the A-grade electrician and the site supervisor (administrative).

Two-person verification of isolation status (administrative).

Insulated gloves Class 0, arc-rated clothing, face shield (PPE — last resort for residual exposure).

Test-before-touch with a calibrated CAT IV voltage tester on every circuit before contact.

Likelihood after controls: With proper isolation, LOTO, barriers, two-person verification, and test-before-touch, the chance of contacting live conductors drops to Rare (1). Consequence after controls: Still Catastrophic (5) — if contact occurs despite controls, the outcome is the same. Electricity does not become less lethal because you put on gloves.

Residual risk score: 1 × 5 = 5 — Medium (yellow). Work can proceed with controls in place and continuous monitoring.

This is exactly how an inspector expects to see the risk matrix filled in. The consequence does not change — the controls make contact less likely but do not change what happens if contact occurs. That distinction matters, and an honest residual assessment recognises it.

Second scenario: a bricklaying crew is laying 400 concrete blocks per day on a residential build. Each block weighs 20 kilograms. Workers are bending, lifting, carrying, and placing blocks for 8 hours, with the task repeated across a multi-week project phase.

Hazard: Musculoskeletal injury from repetitive manual handling. Consequence: Moderate (3) — back strain, disc herniation, shoulder injury. Painful, potentially requiring surgery, potentially career-ending, but not immediately life-threatening. Likelihood before controls: Almost Certain (5) — without any mechanical aids, rotation, or ergonomic controls, a worker handling 400 × 20 kilogram blocks per day will almost certainly develop musculoskeletal issues within weeks.

Risk score before controls: 5 × 3 = 15 — High (orange). Controls required before the work can proceed to an acceptable residual level.

Controls applied:

Mechanical block lifter for pallets (engineering control — eliminates manual pallet breakdown at the start of each lift cycle).

Adjustable scaffold platform to maintain blocks at waist height (engineering — eliminates repetitive bending and reduces cumulative spinal load).

Job rotation: 2 hours on, 2 hours off bricklaying, with workers rotating through mixing, clean-up, and labouring tasks (administrative).

Manual handling training specific to block work, with refresher at each project phase (administrative).

Stretch and flex programme at each pre-start briefing (administrative).

Health monitoring for workers exceeding 3 months on repetitive manual handling tasks (administrative).

Likelihood after controls: Unlikely (2) — with mechanical aids and rotation, acute injury is unlikely across a long project, though cumulative fatigue remains a residual concern. Consequence after controls: Still Moderate (3) — a back injury is still a back injury regardless of controls.

Residual risk score: 2 × 3 = 6 — Medium (yellow). Acceptable with ongoing monitoring and willingness to add further controls if early warning signs appear in the crew.

Notice the controls here are heavily weighted toward engineering and administrative controls, not PPE. There is no meaningful PPE for manual handling — you cannot put a back brace on someone and call it a control measure. Inspectors know this. If a SWMS lists "wear a back brace" as the primary manual handling control, expect a conversation about the hierarchy of controls.

This is the question every PCBU asks: how low does the residual risk need to be before work can start? The WHS Regulation 2025 does not specify a numerical threshold — it uses the phrase "so far as is reasonably practicable" (SFAIRP). In practice, most construction SWMS target a residual risk score of 8 or below, which sits in the Low to Medium range on the 5×5 matrix.

Here is the practical framework that experienced safety professionals use, and the one Australian courts effectively apply when reviewing whether controls were adequate.

Residual risk 1 to 4 (Low, green): Work proceeds with standard precautions. Monitor controls but no special measures needed. This is the target residual level for routine tasks.

Residual risk 5 to 9 (Medium, yellow): Work proceeds with controls actively monitored. Supervisor should review controls daily and check that they remain in place and effective. This is where most construction SWMS land after proper controls are applied.

Residual risk 10 to 15 (High, orange): Work should not proceed without additional controls, senior management approval, or a specific risk treatment plan. If you cannot bring a hazard below High, you need to seriously consider whether the work method should change entirely — and document that consideration in the SWMS.

Residual risk 16 to 25 (Extreme, red): Work must not proceed. No amount of PPE makes an Extreme residual risk acceptable. Redesign the work method, find an alternative approach, or escalate to the client. Any SWMS submitted with an Extreme residual rating is evidence that the PCBU has not discharged the duty of care.

A common mistake: rating every hazard as Low after controls. Inspectors see through this immediately. If your SWMS shows every single hazard dropping from High to Low after controls, it looks like you have manipulated the numbers to get the answer you wanted rather than genuinely assessing the residual risk. Be honest. Some hazards remain Medium even with excellent controls — and that is fine, provided you are actively managing the residual exposure. What matters is that you have identified those residual risks and are not pretending they do not exist.

In a standard SWMS document, the risk matrix appears in the main body of the hazard and control section. For each work activity, you list the hazards, score the risk before controls, describe the controls, and then score the residual risk after controls. The matrix itself — the 5×5 table — usually appears on the first or second page as a reference key so that anyone reading the document can interpret the risk scores without external reference material.

The WHS Regulation 2025 requires that a SWMS identify hazards and assess risks, but it does not prescribe a specific format for the risk assessment. The 5×5 matrix is the de facto standard because it is widely understood, visually intuitive, and accepted by all regulators. Some organisations use a 4×4 or 3×3 matrix. These are legally acceptable but provide less granularity. A 3×3 matrix has only 9 possible risk scores, which makes it harder to distinguish between hazards that genuinely pose different levels of risk. That loss of resolution can mask genuinely high-risk hazards in a pool of generic Medium scores.

A good digital SWMS builder uses the 5×5 matrix by default. When you add a hazard, the system prompts you to select likelihood and consequence from drop-down menus with plain-English descriptions and construction-specific examples. It auto-calculates the risk score, colour-codes it, and places it in the correct position in the document. After you add controls, it prompts you to re-score the residual risk. If the residual risk is still High or Extreme, the system flags it and suggests additional controls from a hazard knowledge base.

The value of an automated matrix is not that it saves arithmetic — although it does. The value is that it enforces the discipline of before-and-after scoring, prevents the common failure of missing the residual assessment, and produces a document that is consistent across projects, trades, and reviewers. An inspector looking at a dozen SWMS from different subcontractors on a single site benefits from consistent presentation, and so does the PC reviewing them.