Does ISO 45001 impose a risk matrix?

No. Clause 6.1.2 requires the organization to establish risk assessment criteria; it imposes no scale, no matrix and no threshold. A matrix is an internal convention: it must be defined, documented and applied consistently, and that is what is auditable.

Which matrix size should be chosen?

Three by three is quick to fill in and enough when risks are few and clearly distinct. Five by five allows ranking a large number of similar situations, at the cost of a longer debate on each score. The worst choice is to change scale once the assessment has started.

Should rating happen before or after existing controls?

Both, in that order. The initial risk is rated as if existing protections were not there, the residual risk is rated with them. The gap between the two shows what prevention has produced, and an auditor looks at it before anything else.

Must an activity stop when a risk is rated critical?

The standard sets no stopping threshold: it is for the organization to define what it does with each band and to write it into its criteria. Many decide that above a certain level work only resumes after an immediate control, but that rule is theirs, not the standard's.

Can psychosocial risks be rated on the same matrix?

They can, provided you accept that severity and likelihood are judged differently: the harm is delayed, often collective, and rarely attributable to a single event. ISO 45003 gives guidelines specific to these risks; it contains no requirements and is not certifiable.

Rate a risk

The scores you enter stay in your browser: nothing is transmitted or stored. The rating of a site's hazards is sensitive information.

Your scale

The standard imposes none. Choose the one you already use, and keep the same one everywhere.

Severity

Likelihood

Choose a severity and a likelihood to get a rating.

Your matrix

Your matrix
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15
2	2	4	6	8	10
1	1	2	3	4	5
	1	2	3	4	5

Severity in rows, likelihood in columns. The outlined cell is your rating.

The priority bands are a reading convention computed from your maximum, not a normative threshold.

HEMC

OH&S risk rating: severity and likelihood matrix

Issued on

Calculated on www.hem-consulting.com/en/outils/cotation-risque-sst-matrice-gravite-probabilite. References checked on 09/02/2026.

Indicative value. None of the standards cited imposes a threshold or a calculation method: the method used, the boundary and the source of the data must be stated beside the result.

What the standard requires, and what it does not

ISO 45001 requires the organization to establish its own risk assessment criteria, in clause 6.1.2. It imposes no matrix, no scale and no threshold: a three by three and a five by five matrix are equally acceptable. What gets audited is therefore not the choice of scale, but the fact that it is defined, documented and applied consistently. The colour bands shown here are a reading convention computed as a proportion of your own maximum; they help you order an action plan, they do not replace the criteria you must write.

How the rating is carried out

1
Set the scale once and for all
Three by three is enough for a small site, five by five discriminates better when risks are numerous. The choice matters less than sticking to it: two ratings on two scales cannot be compared.
2
Rate the severity
Rate the most severe plausible harm, neither the worst imaginable nor the most common. A crushed hand and a superficial cut are not rated at the same level even when the hazard is the same.
3
Rate the likelihood
It accounts for real exposure: duration of the task, number of people involved, frequency of the operation. A yearly operation and a daily one do not carry the same likelihood.
4
Rate the initial risk, excluding existing controls
This is the step most often skipped. Rating straight away with existing protections in place makes it impossible to demonstrate their effect, and deprives the organization of its best argument in an audit.
5
Rate the residual risk after controls
The score only drops if a genuinely implemented control justifies it. An intention, a planned action or an approved budget do not reduce a risk.

The mistakes most often found in audits

Rating the residual risk while believing you are rating the initial one: both scores end up identical and the action plan no longer demonstrates anything.
Lowering a score with no control behind it. A downward reassessment must rest on a genuinely implemented control, not on a planned action.
Skipping the reorganization of work. Many go straight from engineering controls to personal protective equipment, whereas the standard places collective protection and reorganization of work before them.
Changing scale midway, or letting two scales coexist across workshops: the scores no longer compare and the priority ranking loses its meaning.
Treating a rare but fatal harm as a low risk because the likelihood is low. This is where a misread matrix costs the most.
Forgetting psychosocial risks. Hazard identification under ISO 45001 must cover them, and ISO 45003 provides the guidelines for addressing them.

Frequently asked questions

Does ISO 45001 impose a risk matrix?: No. Clause 6.1.2 requires the organization to establish risk assessment criteria; it imposes no scale, no matrix and no threshold. A matrix is an internal convention: it must be defined, documented and applied consistently, and that is what is auditable.
Which matrix size should be chosen?: Three by three is quick to fill in and enough when risks are few and clearly distinct. Five by five allows ranking a large number of similar situations, at the cost of a longer debate on each score. The worst choice is to change scale once the assessment has started.
Should rating happen before or after existing controls?: Both, in that order. The initial risk is rated as if existing protections were not there, the residual risk is rated with them. The gap between the two shows what prevention has produced, and an auditor looks at it before anything else.
Must an activity stop when a risk is rated critical?: The standard sets no stopping threshold: it is for the organization to define what it does with each band and to write it into its criteria. Many decide that above a certain level work only resumes after an immediate control, but that rule is theirs, not the standard's.
Can psychosocial risks be rated on the same matrix?: They can, provided you accept that severity and likelihood are judged differently: the harm is delayed, often collective, and rarely attributable to a single event. ISO 45003 gives guidelines specific to these risks; it contains no requirements and is not certifiable.

Sources and verification

Values and definitions verified on 2026-09-02.

Indicative result. It helps you position yourself; it replaces neither a specialist's analysis nor the reporting obligations that apply to your activity.

Going further

A rating places a risk, it does not tell you whether the system that produced it holds up. The two resources below cover the requirements around risk assessment.

Risk assessment is rarely a standalone exercise: our QHSE expertise describes how it fits with the rest of the management system. See this expertise

The ISO 45001 self-assessment checklist covers the requirements of clauses 4 to 10, including hazard identification and risk assessment.

View the checklist

The ISO 45001 toolkit contains the system files, including the hazard identification procedure and the risk assessment register.

View the toolkit

All tools

Tools · ISO 45001

OH&S risk rating: severity and likelihood matrix

Choose your scale, rate the risk before controls, then after. The gap between the two is the first thing an auditor looks at.

Rate a risk

The scores you enter stay in your browser: nothing is transmitted or stored. The rating of a site's hazards is sensitive information.

Your scale

The standard imposes none. Choose the one you already use, and keep the same one everywhere.

Severity

Likelihood

Choose a severity and a likelihood to get a rating.

Your matrix

Your matrix
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15
2	2	4	6	8	10
1	1	2	3	4	5
	1	2	3	4	5

Severity in rows, likelihood in columns. The outlined cell is your rating.

The priority bands are a reading convention computed from your maximum, not a normative threshold.

HEMC

OH&S risk rating: severity and likelihood matrix

Issued on

Calculated on www.hem-consulting.com/en/outils/cotation-risque-sst-matrice-gravite-probabilite. References checked on 09/02/2026.

Indicative value. None of the standards cited imposes a threshold or a calculation method: the method used, the boundary and the source of the data must be stated beside the result.

What the standard requires, and what it does not

How the rating is carried out

1
Set the scale once and for all
Three by three is enough for a small site, five by five discriminates better when risks are numerous. The choice matters less than sticking to it: two ratings on two scales cannot be compared.
2
Rate the severity
Rate the most severe plausible harm, neither the worst imaginable nor the most common. A crushed hand and a superficial cut are not rated at the same level even when the hazard is the same.
3
Rate the likelihood
It accounts for real exposure: duration of the task, number of people involved, frequency of the operation. A yearly operation and a daily one do not carry the same likelihood.
4
Rate the initial risk, excluding existing controls
This is the step most often skipped. Rating straight away with existing protections in place makes it impossible to demonstrate their effect, and deprives the organization of its best argument in an audit.
5
Rate the residual risk after controls
The score only drops if a genuinely implemented control justifies it. An intention, a planned action or an approved budget do not reduce a risk.

The mistakes most often found in audits

Rating the residual risk while believing you are rating the initial one: both scores end up identical and the action plan no longer demonstrates anything.
Lowering a score with no control behind it. A downward reassessment must rest on a genuinely implemented control, not on a planned action.
Skipping the reorganization of work. Many go straight from engineering controls to personal protective equipment, whereas the standard places collective protection and reorganization of work before them.
Changing scale midway, or letting two scales coexist across workshops: the scores no longer compare and the priority ranking loses its meaning.
Treating a rare but fatal harm as a low risk because the likelihood is low. This is where a misread matrix costs the most.
Forgetting psychosocial risks. Hazard identification under ISO 45001 must cover them, and ISO 45003 provides the guidelines for addressing them.

Frequently asked questions

Does ISO 45001 impose a risk matrix?: No. Clause 6.1.2 requires the organization to establish risk assessment criteria; it imposes no scale, no matrix and no threshold. A matrix is an internal convention: it must be defined, documented and applied consistently, and that is what is auditable.
Which matrix size should be chosen?: Three by three is quick to fill in and enough when risks are few and clearly distinct. Five by five allows ranking a large number of similar situations, at the cost of a longer debate on each score. The worst choice is to change scale once the assessment has started.
Should rating happen before or after existing controls?: Both, in that order. The initial risk is rated as if existing protections were not there, the residual risk is rated with them. The gap between the two shows what prevention has produced, and an auditor looks at it before anything else.
Must an activity stop when a risk is rated critical?: The standard sets no stopping threshold: it is for the organization to define what it does with each band and to write it into its criteria. Many decide that above a certain level work only resumes after an immediate control, but that rule is theirs, not the standard's.
Can psychosocial risks be rated on the same matrix?: They can, provided you accept that severity and likelihood are judged differently: the harm is delayed, often collective, and rarely attributable to a single event. ISO 45003 gives guidelines specific to these risks; it contains no requirements and is not certifiable.

Sources and verification

Values and definitions verified on 2026-09-02.

Indicative result. It helps you position yourself; it replaces neither a specialist's analysis nor the reporting obligations that apply to your activity.

Going further

A rating places a risk, it does not tell you whether the system that produced it holds up. The two resources below cover the requirements around risk assessment.

Risk assessment is rarely a standalone exercise: our QHSE expertise describes how it fits with the rest of the management system. See this expertise

The ISO 45001 self-assessment checklist covers the requirements of clauses 4 to 10, including hazard identification and risk assessment.

View the checklist

The ISO 45001 toolkit contains the system files, including the hazard identification procedure and the risk assessment register.

View the toolkit

Online version

The same ISO 45001 standard, scoring itself as you go

The ISO 45001 workbook you have here also exists as an online audit, with 57 control points, a rate that updates as you go and a history of your passes. It is not the same document, it is the same standard tooled differently.

Guided entry, score computed continuously
Structured summary report, printable to PDF in one click
Fourteen-day trial, no credit card

Open the ISO 45001 audit checklist

NormePulse is published by HEM Consulting. The trial commits you to nothing and asks for no payment method.