Contractor Safety Tools

Hazard prioritization tool

Risk Matrix Calculator

Compare initial and residual hazard risk using a transparent 5 × 5 likelihood and severity model.

Assess initial and residual risk

Select the likelihood and severity before controls, then estimate the residual values expected after the proposed controls are implemented and verified.

Initial risk
Residual risk after controls

Likelihood describes the estimated chance that the hazardous event or exposure will occur.

Severity describes the credible consequence rather than the most convenient expected outcome.

Risk matrix result

Select initial and residual likelihood and severity values, then calculate the modeled risk scores.

Transparent model

How the 5 × 5 score is calculated

Each score is calculated by multiplying the selected likelihood and severity values:

Risk score = likelihood × severity

  • Low: scores 1 through 4
  • Moderate: scores 5 through 9
  • High: scores 10 through 16
  • Critical: scores 17 through 25

Assessment quality

Use credible likelihood and consequence estimates

  • Consider how often workers perform the task and how many workers may be exposed.
  • Use the credible potential consequence rather than only the most common minor outcome.
  • Include abnormal, emergency, maintenance, and nonroutine conditions.
  • Obtain worker input and review incident, inspection, and near-miss information.
  • Reassess when equipment, processes, staffing, or work conditions change.

Initial risk versus residual risk

Initial risk represents conditions before the proposed controls are relied upon. Residual risk represents the estimated risk after controls have been implemented and their effectiveness verified.

Do not lower a residual score merely because a control appears in a plan. Confirm that the control is installed, used correctly, maintained, and effective under actual work conditions.

Apply the hierarchy of controls

  1. Eliminate the hazard where feasible.
  2. Substitute a safer material or process.
  3. Use engineering controls to isolate exposure.
  4. Add administrative controls and safe work practices.
  5. Use suitable personal protective equipment as the final layer.

Important limitation

This 5 × 5 matrix is not an OSHA-required scoring formula, permission to proceed, or compliance determination. It cannot replace applicable standards, competent-person decisions, task-specific assessment, exposure monitoring, worker participation, or immediate control of recognized serious or imminent hazards.

Risk Matrix Calculator FAQs

How does this risk matrix calculate a score?

The calculator multiplies a likelihood value from 1 through 5 by a severity value from 1 through 5. It calculates initial and residual scores separately so the modeled effect of proposed controls remains visible.

Is a 5 by 5 risk matrix required by OSHA?

No. This matrix is a transparent prioritization model rather than an OSHA-required scoring formula. Employers must still follow applicable standards and address recognized serious hazards.

What is residual risk?

Residual risk is the estimated risk remaining after selected controls have been implemented and verified. It should not be based only on controls that are planned but not yet effective.

Can a low score authorize work to proceed?

No. A score cannot replace competent-person review, applicable standards, exposure assessment, worker input, permits, required protective systems, or immediate action for serious or imminent hazards.

Related contractor safety tools

JHA Generator

Document task steps, hazards, controls, and required PPE.

Safety Plan Generator

Create a project safety plan with hazards, controls, and emergency information.

Near Miss Report Generator

Capture potential outcomes, contributing factors, and preventive actions.

Primary references

Official safety sources

Review these primary OSHA resources alongside current state-plan, local, project, manufacturer, employer, and qualified-professional requirements that apply to the work.

External references are provided for research and verification. Their inclusion does not make a generated document compliant, approved, certified, or complete for a particular workplace.